All Apps and Add-ons

Azure Aplication Gateway Webapplication Firewall

maikelroolvink
New Member

Hi,

i was hoping you can help me out, im trying to parse the Azure Aplication Gateway Webapplication Firewall files within splunk but im not getting it right, the json is in the following format;

{
"resourceId": "/SUBSCRIPTIONS//RESOURCEGROUPS//PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/",
"operationName": "ApplicationGatewayFirewall",
"time": "2016-09-20T00:40:04.9138513Z",
"category": "ApplicationGatewayFirewallLog",
"properties": {
"instanceId":"ApplicationGatewayRole_IN_0",
"clientIp":"108.41.16.164",
"clientPort":1815,
"requestUri":"/wavsep/active/RXSS-Detection-Evaluation-POST/",
"ruleId":"OWASP_973336",
"message":"XSS Filter - Category 1: Script Tag Vector",
"action":"Logged",
"site":"Global",
"message":"XSS Filter - Category 1: Script Tag Vector",
"details":{"message":" Warning. Pattern match "(?i)(<script","file":"/owasp_crs/base_rules/modsecurity_crs_41_xss_attacks.conf","line":"14"}}
}

I all ready downloaded and installed the Splunk Add-on for Microsoft Cloud Services but the logsource is not included and the other are not working.

the link below gives more information about the Azure Aplication Gateway Webapplication Firewall
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-webapplicationfirewal...

0 Karma

droth333
Explorer

Run it thru xpath! Works great.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...