Blog Post

Azure Network Security Blog
5 MIN READ

Automated Detection and Response for Azure WAF with Sentinel

ShabazShaik's avatar
ShabazShaik
Icon for Microsoft rankMicrosoft
Dec 08, 2022
Introduction:    Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and Cross-site scripting are among the most common atta...
Updated Sep 01, 2023
Version 3.0
azure waf
MelissaRay's avatar
MelissaRay
Copper Contributor
Feb 11, 2025

ShabazShaik, thank you for the comprehensive and clear explanation. I tried to deploy the v2 template for my Application Gateway, but it seems incompatible to changes that happened to AppGateway as I came down with a few struggles:

  1. The minimum template version is now 01-07-2022, which was easy enough to fix in the HTTP part of the logic app.
  2. It requires 'FQDN' for all backenAddressPools of the appGateway, where some policies don't have FQDN but IPs, when trying to parse it failed then I made it so there's no requirement. I'm not sure of its impacts, however. 
  3. The policy goes over all the custom rules of the App Gateway Policy, but it doesn't seem to tolerate WAF polices of Rate Limit type, leading to an error in the final HTTP as well. I tried to mitigate it, however with no success as it requires changing the parsing and addition actions.

Do you perhaps have any idea how to mitigate it, or have an updated version besides https://github.com/Azure/Azure-Network-Security/blob/master/Azure%20WAF/Playbook%20-%20WAF%20Sentinel%20Playbook%20Block%20IP%20-%20New/templateV2.json (the problematic version)?

Thank you!

  • rhotrix's avatar
    rhotrix
    Copper Contributor
    Apr 11, 2025

    Hi MelissaRay , are you able to find a solution to this? 

    • MelissaRay's avatar
      MelissaRay
      Copper Contributor
      May 05, 2025

      Hi there! I see you already mitigated your problem. My team managed to fix the parts that malfunctioned in the Logic App for us, in addition to making it clearer and AppGateway-specific.

      According to my team, there was a part that the seemed to be for debugging: For Each 6 & 7 inside condition 4. It iterated over all values and set the MatchValue variable, then added it to the existing list, which caused trouble. After changing the points I described in the first reply and removing the loops, it worked.

      To summarize the changes:
      1 - change template version to 01-07-2022 in necessary places

      2 - In the section of the "backendAddresses", we removed 'required' altogether , but it might not cause trouble for you. 

      3 - When going over the rules (adding the rules that are not SentinelBlockIP), we checked whether the rule type is RateLimitRule. The original Template lacked some values we required, specifically groupByUserSession. Again, you might not encounter it.

      4 - remove (we used the designer) loops 6 & 7 from the logic app, it worked for us afterwards.

      This is the general idea of the changes we made post-deployment from Github. I hope it helps anyone who encounters the same problems. We also recommend making the logic app clearer by renaming the loops \ variables according to what they hold, and keep only the resource type you need. The logic app is much clearer, readable and simplified!

       Have a good day,
      Melissa.