Skip to content
Related Articles

Related Articles

Microsoft Azure – Firewall Network Flow Logs with TimeGenerated using KQL

View Discussion
Improve Article
Save Article
Like Article
  • Last Updated : 31 Jan, 2022

Here, In this article, we will be using the azure kql log queries to fetch the azure network flow logs traffic flowing through by setting the time using TimeGenerated in query. We will look into a few various examples and how we can use them to filter the results.

KQL Query Example 1:

To find the Azure network logs of Inbound and Outbound for the last 12 hours by projecting the TimeGenerated, Protocol, SourceIP, Target, Action, and Complete display message of Network flow log.

AzureDiagnostics
| where TimeGenerated > ago(12h)
| where Category == "AzureFirewallNetworkRule"
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| project TimeGenerated, Protocol, SourceIP, Target, Action, Complete_MSG=msg_s

Output:

KQL Query Example 2:

To find the Azure network logs of Inbound and Outbound for the last 5 minutes by projecting the TimeGenerated, Protocol, SourceIP, Target, Action, and Complete display message of Network flow log.

AzureDiagnostics
| where TimeGenerated > ago(5m)
| where Category == "AzureFirewallNetworkRule"
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| project TimeGenerated, SourceIP, Target, Action, msg_s

Output:

KQL Query Example 3:

To find the Azure network logs of Inbound and Outbound for the last 7 days by projecting the TimeGenerated, Protocol, SourceIP, Target, Action, and Complete display message of Network flow log.

AzureDiagnostics
| where TimeGenerated > ago(7d)
| where Category == "AzureFirewallNetworkRule"
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| project TimeGenerated, SourceIP, Target, Action, msg_s

Output:

KQL Query Example 4:

To find the Azure network logs of Inbound and Outbound with time range using between keyword and to projecting the TimeGenerated, Protocol, SourceIP, Target, Action and Complete display message of Network flow log.

AzureDiagnostics
| where TimeGenerated between(datetime("2022-01-05 00:00:00") .. datetime("2022-01-08 12:00:00"))
| where Category == "AzureFirewallNetworkRule"
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| project TimeGenerated, SourceIP, Target, Action, msg_s

Output:

My Personal Notes arrow_drop_up
Recommended Articles
Page :

Start Your Coding Journey Now!