Whenever I run this query on my Front Door Logs Query, I get an error
Query could not be parsed at '|' on line [2,1] Token: | Line: 2 Position: 1 Request id: 15b8af89-92a0-4c9e-9801-5c26f19e9665
This is the query I'm using:
AzureDiagnostics
//AFD standard/premium, run this to determine if any of the resources have domain fronting behavior
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where result_s == "SSLMismatchedSNI" or errorInfo_s == "SSLMismatchedSNI"
| project TimeGenerated, clientIp_s, sni_s, requestUri_s, userAgent_s
AzureDiagnostics
//AFD standard/premium, run this to determine if any of the resources have domain fronting behavior but not have domain fronting blocking enabled
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where result_s == "SSLMismatchedSNI"
| project TimeGenerated, clientIp_s, sni_s, requestUri_s, userAgent_s
AzureDiagnostics
//AFD standard/premium, run this to determine if any of the resources have domain fronting behavior and have domain fronting blocking enabled.
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where result_s == "SSLMismatchedSNI"
| project TimeGenerated, clientIp_s, sni_s, requestUri_s, userAgent_s