Blog Post

Azure Network Security Blog
5 MIN READ

Automated Detection and Response for Azure WAF with Sentinel

ShabazShaik's avatar
ShabazShaik
Icon for Microsoft rankMicrosoft
Dec 08, 2022
Introduction:    Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and Cross-site scripting are among the most common atta...
Updated Sep 01, 2023
Version 3.0
azure waf
MelissaRay's avatar
MelissaRay
Copper Contributor
Feb 11, 2025

ShabazShaik, thank you for the comprehensive and clear explanation. I tried to deploy the v2 template for my Application Gateway, but it seems incompatible to changes that happened to AppGateway as I came down with a few struggles:

  1. The minimum template version is now 01-07-2022, which was easy enough to fix in the HTTP part of the logic app.
  2. It requires 'FQDN' for all backenAddressPools of the appGateway, where some policies don't have FQDN but IPs, when trying to parse it failed then I made it so there's no requirement. I'm not sure of its impacts, however. 
  3. The policy goes over all the custom rules of the App Gateway Policy, but it doesn't seem to tolerate WAF polices of Rate Limit type, leading to an error in the final HTTP as well. I tried to mitigate it, however with no success as it requires changing the parsing and addition actions.

Do you perhaps have any idea how to mitigate it, or have an updated version besides https://github.com/Azure/Azure-Network-Security/blob/master/Azure%20WAF/Playbook%20-%20WAF%20Sentinel%20Playbook%20Block%20IP%20-%20New/templateV2.json (the problematic version)?

Thank you!