Prohibiting Domain Fronting with Azure Front Door and Azure CDN Standard from Microsoft (classic)

JessieJia 

It seems to me that the third query has a mistake. I think it must have been about the errorInfo_s field. Then it would be like this:

AzureDiagnostics

//AFD standard/premium, run this to determine if any of the resources have domain fronting behavior and have domain fronting blocking enabled.
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"

| where errorInfo_s == "SSLMismatchedSNI"

| project TimeGenerated, clientIp_s, sni_s, requestUri_s, userAgent_s

I'm right?

thanks