如何从Azure WAF日志过滤自定义规则，仅保留微软默认规则拦截记录？

Great question—maintaining a list of custom rules to exclude is definitely a hassle, so let's fix this with a cleaner, low-maintenance approach that targets the default ruleset directly.

The key trick here is that Microsoft's Default Ruleset (DRS) rules have a consistent naming pattern in Frontdoor WAF logs. They always start with DefaultRuleSet_ followed by the version and rule ID (like DefaultRuleSet_2.2_SQLI-942100). Custom rules you create won't use this prefix, so we can filter using this pattern to automatically include only default ruleset blocks.

Here's your modified query with this targeted filter added:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorWebApplicationFirewallLog"
| where action_s == "Block"
// Filter to only include Microsoft Default Ruleset rules
| where ruleName_s startswith "DefaultRuleSet_"
| where requestUri_s contains "xxx" or requestUri_s contains "xxx" or requestUri_s contains "xxx" or requestUri_s contains "xxx" or requestUri_s contains "xxx" or requestUri_s contains "xxx"
| extend ParsedUrl = parseurl(requestUri_s)
| summarize BlockCount = count() by TimeStamp = bin(TimeGenerated, 3h), ClientIP = clientIP_s, RuleName = ruleName_s, Host = host_s, PATH = tostring(ParsedUrl.Path)
| order by TimeStamp desc 

Quick Tips: #

• If you're using an older version of the default ruleset or notice a slightly different prefix (like Microsoft_DefaultRuleSet_), adjust the startswith value to match. To confirm the exact prefix used in your logs, run this quick check:

  AzureDiagnostics
  | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorWebApplicationFirewallLog"
  | distinct ruleName_s
  

• This method stays future-proof: any new custom rules you add later won't appear in your results without needing to update the query.

内容的提问来源于stack exchange，提问作者Matt Douhan