nicholls-c

// front door waf
AzureDiagnostics 
| where Category == "FrontDoorWebApplicationFirewallLog" 
| join (AzureDiagnostics | where action_s == "Block") on $left.trackingReference_s == $right.trackingReference_s 
| project TimeGenerated, host_s, ruleName_s, details_msg_s, details_matches_s