Rules (XQL)
[INGEST:vendor = "msft", product = "azure", target_dataset = "msft_azure_waf_raw", no_hit = drop]
/*
Filter ApplicationGatewayAccessLog and ApplicationGatewayFirewallLog events
*/
filter category in ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog") OR Type in ("AGWAccessLogs", "AGWFirewallLogs")
/*
Supported datetime formats:
yyyy-MM-ddThh:mm:ssZ - %FT%XZ - "2025-05-03T00:27:53Z"
yyyy-MM-ddThh:mm:ss.E7SZ - %FT%H:%M:%E*SZ - "2025-05-02T13:26:25.3391768Z"
yyyy-MM-ddThh:mm:ssEz - %FT%X%Z - "2024-11-19T10:50:39+00:00" (%Ez is RFC 3339-compatible numeric time zone)
MMM dd yyyy HH:mm:ss - "Nov 19 2024 12:50:39"
*/
| alter
timeStamp_t = to_string(timeStamp_t),
timeStamp = to_string(timeStamp),
time = to_string(time)
| alter
tmp_get_time_1 = if(len(timeStamp_t) > 0 , parse_timestamp("%FT%XZ" ,timeStamp_t) ,null),
tmp_get_time_2 = if(timeStamp contains "+", parse_timestamp("%FT%X%Z", timeStamp ),len(timeStamp) > 0 and timeStamp not contains "+", parse_timestamp("%h %d %Y %X", timeStamp ),null),
tmp_get_time_3 = if(len(time) > 20 and time not contains ".", parse_timestamp("%FT%X%Z", time ),len(time) = 20 and time not contains ".", parse_timestamp("%FT%XZ", time ),time ~="\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{1,9}Z", parse_timestamp("%FT%H:%M:%E*SZ", time ),null)
| alter
_time = coalesce(TimeGenerated , tmp_get_time_1 , tmp_get_time_2 , tmp_get_time_3 )
| fields -tmp_get_time_1, tmp_get_time_2, tmp_get_time_3;
/*
Filter FrontDoorAccessLog and FrontDoorWebApplicationFirewallLog events
*/
filter Category in ("FrontDoorAccessLog", "FrontDoorWebApplicationFirewallLog")
| alter
time = to_string(time)
| alter
tmp_get_time = if(len(time) > 20 and time not contains ".", parse_timestamp("%FT%X%Z", time ),len(time) = 20 and time not contains ".", parse_timestamp("%FT%XZ", time ),time ~="\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{1,9}Z", parse_timestamp("%FT%H:%M:%E*SZ", time ),null)
| alter
_time = coalesce(TimeGenerated , tmp_get_time);