Forum Discussion

knoxbox's avatar
knoxbox
Copper Contributor
May 19, 2020

AzureDiagnostics table not showing action_s and ruleId_s columns

Logs are coming from an Application Gateway setup as a WAF v2.0.

The logs are sent to my workspace, but the action_s and ruleId_s fields are not present in the AzureDiagnostics table. This prevents me from detecting which HTTP requests are being flagged by OWASP rules.

 

I have a second Application Gateway setup as a WAF with logs going to another workspace, and there the AzureDiagnostics table shows the action_s and ruleId_s fields. Both  firewalls are setup the same.

Azure Log Analytics
azure monitor

3 Replies

  • PhilipVandeVyver's avatar
    PhilipVandeVyver
    MCT
    Apr 19, 2023
    Those fields are only being created when new records with the "action_s" and "ruleId_s" are being injected in the Log Analytics Workspace.
    If no HTTPS requist are flagged by the OWASP rules, no logging is done and the fields are not created.
  • JcLIF070's avatar
    JcLIF070
    Copper Contributor
    Nov 29, 2022
    I am having this same issue with no current resolution. Did you ever find a way to fix this?

Resources