Forum Discussion

Yashrajsp10's avatar
Yashrajsp10
Copper Contributor
Nov 07, 2022

Azure Firewall Logs

Hi,

I was checking some firewalls logs by running the below query

 

CommonSecurityLog
| where DeviceProduct == "firewall1" or DeviceProduct == "firewall2"
| project
TimeGenerated,
DeviceName,
SourceIP,
DestinationIP,
DestinationPort,
Protocol,
DeviceAction,
Activity
| sort by TimeGenerated desc
| where DestinationIP contains "a.b.c.d"

 

I do get the results after this. But I do not understand the result in the "DeviceAction" column

 

Result is: 

TimeGenerated [UTC]
2022-11-05T15:12:23.003Z
DeviceName
f03xxxxxxxxxx
SourceIP
172.x.x.x
DestinationIP
103.x.x.x
DestinationPort
80
Protocol
tcp
DeviceAction
reset-both
Activity
THREAT
 
What does reset-both mean?

Resources