Front Door WAF policy: How to get logs when "Block by ASN"

Azure Front Door WAF logs do not include an ASN field; identify the IP evaluated by the ASN rule from socketIP_s or clientIP_s, then perform a separate IP-to-ASN lookup.

Identify the evaluated IP

The WAF log schema exposes SocketIP, ClientIP, RuleName, and related request data, but not ASN. ^1^

Use this query for the blocked custom rule:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.CDN"
| where Category == "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block"
| where ruleName_s == "<your-ASN-rule-name>"
| project TimeGenerated, ruleName_s, action_s,
          clientIP_s, socketIP_s, requestUri_s,
          trackingReference_s
| order by TimeGenerated desc

Choose the IP column according to the ASN rule’s match variable:

• SocketAddr → use socketIP_s. This is the address on the TCP connection seen by Front Door; when a proxy is involved, it is the proxy address.
• RemoteAddr → use clientIP_s. This represents the original client IP derived from X-Forwarded-For.

Front Door resolves that selected IP to an ASN internally before applying AsnMatch. ^2^

If the expected columns do not appear under those names, inspect one record because the destination/table schema can affect column presentation:

AzureDiagnostics
| where Category == "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block"
| where ruleName_s == "<your-ASN-rule-name>"
| take 1

Retrieve the ASN separately

If Microsoft Sentinel is enabled for the workspace and the caller is authorized to invoke the Microsoft.SecurityInsights enrichment endpoint, submit the evaluated IP to its geolocation API:

GET https://management.azure.com/subscriptions/[Subscription ID]/resourceGroups/[Resource Group] Group]/providers/Microsoft.SecurityInsights/enrichment/ip/geodata/?ipaddress={ipAddress}&api-version={api-version}
Authorization: Bearer {access-token}

Read the ASN field from the response. The API also returns the organization and carrier, and is limited to 100 calls per user per hour. ^3^

This enrichment reconstructs the likely current ASN for the logged IP. It does not reveal the exact ASN value that Front Door evaluated at request time; mappings can change, and Front Door does not emit its resolved ASN in the documented WAF log.

For repeated analysis, populate a Sentinel watchlist with evaluated IPs as the search key and their ASN as another column, then enrich the WAF events:

let AsnMap =
    _GetWatchlist('ip-to-asn')
    | project SearchKey, ASN, Organization;
AzureDiagnostics
| where Category == "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block"
| where ruleName_s == "<your-ASN-rule-name>"
| extend EvaluatedIP = socketIP_s   // Use clientIP_s for RemoteAddr
| lookup kind=leftouter AsnMap on $left.EvaluatedIP == $right.SearchKey
| project TimeGenerated, EvaluatedIP, ASN, Organization,
          ruleName_s, requestUri_s

The watchlist must first be created and populated with an IP-to-ASN mapping; SearchKey should contain the evaluated IP. Sentinel recommends using SearchKey for watchlist joins. ^4^

References

1. Azure Web Application Firewall monitoring and logging (front-door-standard-premium)
2. What is AS number matching for Azure Front Door?
3. Enrich entities in Microsoft Sentinel with geolocation data via REST API (Public preview)
4. Build queries or detection rules with watchlists in Microsoft Sentinel