// Application Gateway WAF Analytics

Explain blocked requests, false positives, and risky sources fast.

Import WAF Log Analytics exports and get dashboards for blocked requests, matched rules, rule groups, source IPs, and tuning recommendations.

WAF request trace

126 blocked

RulesIPsURIs

Live insight preview

Free sample dashboard

23

Blocked URIs

12

Top source IPs

5

Rule groups

Medium

False-positive risk

Suggested next query
AzureDiagnostics | where action_s == 'Blocked' | summarize count() by clientIp_s, requestUri_s
// Overview

Immediate value before sales calls.

WAF logs reveal what the firewall evaluates, matches, and blocks. Luminoxis packages the common investigation queries into clear dashboards so teams can tune rules without losing protection.

See blocked requests by IP, URI, rule ID, and rule group.

Identify false positives before they hurt customer conversion.

Detect spikes in malicious traffic and repeated offending sources.

Turn WAF analysis into ticket-ready recommendations for platform teams.

// How It Works
01

Upload WAF Log Analytics exports from Application Gateway or Front Door.

02

Generate dashboards for matched and blocked requests by IP, URI, and rule.

03

Review recommended rule tuning, API gateway policy changes, and source blocks.

04

Enable continuous monitoring, alerting, and ticketing integrations on paid plans.

Build your first dashboard

Export a small sample from Azure Log Analytics, upload it here, and get an instant dashboard preview.

What to pull from Azure

  1. 1Open the workspace that receives your Application Gateway or Front Door WAF diagnostics.
  2. 2Paste the WAF query below, set the time range to Last 24 hours, and run it.
  3. 3Use Export > CSV or Download as CSV, then upload that file here.
Starter KQL query
AzureDiagnostics
| where Category has "ApplicationGatewayFirewallLog"
  or Category has "FrontdoorWebApplicationFirewallLog"
| where TimeGenerated > ago(24h)
| project TimeGenerated, action_s, ruleId_s, ruleGroup_s, clientIp_s, requestUri_s, Message
| take 1000
CSV is best for the free flow. JSON from Azure Monitor query results also works.
// Pricing
Free
R0

starter

Validate value with sample uploads and limited dashboard history.

  • Basic dashboard
  • 3 uploads per month
  • 24-hour insight window
  • Lead summary by email
Start Free
Core
R699

per month

For teams that need repeatable reviews and deeper operational visibility.

  • Unlimited uploads
  • 30-day history
  • Advanced visualisations
  • Report exports
Checkout Core
Pro
R1,499

per month

AI-assisted recommendations, collaboration, and workflow integrations.

  • AI root-cause insights
  • Custom dashboards
  • API access
  • Priority support
Checkout Pro

Security promise: logs are encrypted at rest on paid tiers, free-tier samples are purged after processing, and users can request deletion from account support.

Customer Story

31

rule matches prioritised

Security and platform teams get a shared view of top matched rules and suspicious sources, then act on the highest-value tuning opportunities first.

The dashboard gives our engineers a single place to explain what changed, why it matters, and what to fix next.

Platform Lead

Azure product team

The free upload flow makes the value obvious before procurement gets involved. That is exactly how a technical product should feel.

Engineering Manager

SaaS operations