{"id":7465,"date":"2023-03-02T09:00:00","date_gmt":"2023-03-02T17:00:00","guid":{"rendered":""},"modified":"2025-06-10T09:21:01","modified_gmt":"2025-06-10T16:21:01","slug":"azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/","title":{"rendered":"Azure WAF guided investigation Notebook using Microsoft Sentinel for automated false positive tuning"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>With special thanks to Pete Bryan, Principal Security Research Manager, Microsoft Security.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The SQL injection attack remains one of the critical attacks in the <a href=\"https:\/\/owasp.org\/www-project-top-ten\/\" target=\"_blank\" rel=\"noreferrer noopener\">OWASP Top 10<\/a>, and it involves injecting a SQL query via the input data field into a web application without input validation. According to <a href=\"https:\/\/query.prod.cms.rt.microsoft.com\/cms\/api\/am\/binary\/RE5bUvv?culture=en-us&amp;country=us\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Digital Defense Report 2022<\/a>, 67 percent of web application exploits include SQL injections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/azure.microsoft.com\/products\/web-application-firewall\/\">Azure Web Application Firewall (Azure WAF)<\/a> provides centralized protection of your web applications from exploits and vulnerabilities. It protects against OWASP Top 10 attacks, bot attacks, application layer Distributed Denial of Service (DDoS) attacks, and other web attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure WAF detects SQL injection attacks and blocks them by default. In certain instances, this could be a false positive that requires investigation and creation of <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/web-application-firewall\/afds\/waf-front-door-exclusion\" target=\"_blank\" rel=\"noreferrer noopener\">Azure WAF exclusions<\/a>. To complete a successful investigation, full context about the attack is needed and a process that guides you through the investigation is required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We are pleased to announce a new <a href=\"https:\/\/github.com\/Azure\/Azure-Sentinel-Notebooks\/blob\/master\/Guided Investigation - Azure WAF SQLI.ipynb\" target=\"_blank\" rel=\"noreferrer noopener\">Azure WAF guided investigation to tune WAF policy Notebook<\/a> in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. This Notebook allows you to understand the WAF alert and pivot on key entities of the WAF event such as the request URI, client IP, hostname, and correlate with Threat Intelligence feeds to get a holistic view of the attack surface.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"azure-waf-investigations-powered-by-microsoft-sentinel\">Azure WAF investigations powered by Microsoft Sentinel<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Azure WAF is deeply integrated with Microsoft Sentinel, Microsoft\u2019s Security Information and Event Management (SIEM) solution. Using the existing Azure WAF data connector, WAF logs are ingested and later analyzed for a variety of web application attacks and powerful visualizations pivoting on the full attack pattern are presented to you. This Notebook is built using <a href=\"https:\/\/msticpy.readthedocs.io\/en\/latest\/index.html\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Threat Intelligence Center\u2019s MSTICpy packages<\/a>. With this Notebook, you can access rich historical contextual information using Microsoft Sentinel\u2019s capabilities like incident generation, entity graph, and threat intelligence correlation, in conjunction with Azure WAF\u2019s SQL injection detections based on OWASP rules and Microsoft Threat Intelligence rules.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"automated-investigation-and-mitigation-of-web-application-attacks\">Automated investigation and mitigation of web application attacks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Our new <a href=\"https:\/\/github.com\/Azure\/Azure-Sentinel-Notebooks\/blob\/master\/Guided Investigation - Azure WAF SQLI.ipynb\" target=\"_blank\" rel=\"noreferrer noopener\">Azure WAF guided investigation to tune WAF policy Notebook<\/a> provides an automated guided investigation for triaging Sentinel incidents triggered by Azure WAF SQL injection rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The solution includes the following components:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\">Azure WAF data connector in Microsoft Sentinel.<\/li>\n\n\n\n<li class=\"wp-block-list-item\">Microsoft Sentinel incidents that are generated due to SQL injection attack detected by the Microsoft Sentinel analytic rules.<\/li>\n\n\n\n<li class=\"wp-block-list-item\">Azure WAF Notebook that helps investigate Azure WAF logs and automatically applies WAF exclusions to the WAF policy.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A high-level diagram explaining the data flow is given below:<\/p>\n\n\n<figure class=\"wp-block-image size-large has-custom-border\"><img decoding=\"async\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp\" alt=\"High-level diagram explaining the data flow is given below: This picture describes Azure WAF protecting backends hosted in Azure, other clouds and on-premises from traffic originating from malicious actors as well as legitimate users. A WAF triggered log is analyzed by the Sentinel Notebook and an automated exclusion is applied for a confirmed false positive.\" class=\"wp-image-32376 webp-format\" style=\"border-radius:0px\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp 1024w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-300x175.webp 300w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-768x449.webp 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.webp 1084w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" data-orig-src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp\"><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Let us look at two use case scenarios for using this Notebook:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"understanding-the-attack-landscape-when-there-is-a-true-positive\">Understanding the attack landscape when there is a true positive<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Using the Notebook, you can pivot on various attack artifacts such as IP, URL, or domain threat intelligence, and understand the entity graph. This Notebook retrieves the WAF SQLi rule that generated the detection and looks up related SQLi rule events within the pre-selected time. Based on the above details, if you decide that the SQL injection attack is valid then you can update the incident severity and priority. In this scenario, the web application remains protected by Azure WAF.<\/p>\n\n\n<figure class=\"wp-block-image size-large has-custom-border\"><img decoding=\"async\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527-1024x657.webp\" alt=\"Understanding the attack landscape when there is a true positive:This picture describes a threat actor trying to access a SQL database connected to a web application protected Azure WAF. WAF detects SQL injection attack and blocks the call. The log is analyzed in Sentinel Notebook to correlate with Threat Intelligence and visualize in the alert entity graph.\" class=\"wp-image-32378 webp-format\" style=\"border-radius:0px\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527-1024x657.webp 1024w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527-300x192.webp 300w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527-768x493.webp 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527.webp 1105w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" data-orig-src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141527-1024x657.webp\"><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"understand-the-attack-pattern-and-create-exclusions-if-there-is-a-false-positive\">Understand the attack pattern and create exclusions if there&nbsp;is a false positive<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Using the Notebook, you can pivot on various attack artifacts such as IP, URL, or domain threat intelligence, and understand the entity graph. This Notebook retrieves the WAF SQLi rule that generated the detection and looks up related rule events. It also retrieves raw WAF logs to understand the relations between the request URI, client Ips, hostname entities and allows you to dynamically access the OWASP rule set in GitHub to understand the rule match pattern. Based on the investigations, if you decide this incident is a false positive, the process to automatically create granular exclusions is presented to you and the exclusions are applied to the Azure WAF policy using Azure WAF APIs.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large has-custom-border\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"546\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture5-1-1024x546.webp\" alt=\"A screenshot of a computer\" class=\"wp-image-41256\" style=\"border-radius:0px\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture5-1-1024x546.webp 1024w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture5-1-300x160.webp 300w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture5-1-768x409.webp 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture5-1.webp 1368w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The following personas would benefit from this Notebook:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"persona-developer-at-someunionflight-com\">Persona: Developer at SomeUnionFlight.com<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"understanding-sql-injection-detection-logic\">Understanding SQL injection detection logic<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Chris is a developer at SomeUnionFlight.com. His company hosts a website for users to search for flights and make flight reservations. They have hosted their website behind WAF with Azure Front Door (AFD) where AFD accepts user requests to search their website. SomeUnionFlight.com has an SQL backend where they store flight information. He notices that when users try to access the website, their access is getting blocked because the URL has \u201cUnion\u201d keyword which is triggering the SQL injection rule. This detection is considered as a false positive because the \u201cUnion\u201d keyword is used to mention a website name and not an SQL injection attack. He would like an investigation experience that helps him understand how to analyze this detection using Microsoft Sentinel and determine if it is a false positive. He would also like to automatically create exclusions for false positives for the URL without having to disable the entire rule.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"persona-secops-analyst-at-contoso-com\">Persona: SecOps analyst at Contoso.com<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"understanding-collateral-attack-vectors\">Understanding collateral attack vectors<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ashley is a Security Operations analyst at Contoso.com. Her company has purchased both Azure WAF and Microsoft Sentinel. She oversees analyzing WAF logs and identifying attack patterns. She would like to understand if the client IP or the request URI associated with the WAF rule that triggered the SQL injection are Indicators of Compromise (IoC). By understanding related Threat Intelligence Indicators of Compromises, she can prevent future attacks on her organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"get-started-today\">Get started today<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SQL injection attacks are getting more prevalent by the day and Azure WAF protects web applications from these attacks. To enable a high-quality investigation experience for Azure WAF customers, we have created this new Azure WAF guided investigation Notebook that enables you quickly understand full attack surface and take actions on the incidents. You can follow our <a href=\"https:\/\/aka.ms\/azurewafnotebook\" target=\"_blank\" rel=\"noreferrer noopener\">step-by-step instructions<\/a> to learn how to use the Notebook.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This new Azure WAF Notebook can be found in Microsoft Sentinel under the Notebooks in the Threat Management section.<\/p>\n\n\n<figure class=\"wp-block-image size-large has-custom-border\"><img decoding=\"async\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-1024x497.webp\" alt=\"This picture describes that this new Notebook can be found by hovering over the Notebooks blade on the left side and searching for the keyword &ldquo;WAF&rdquo;. The Azure WAF &ndash; guided investigation Notebook is presented to you.\" class=\"wp-image-7469 webp-format\" style=\"border-radius:0px\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-1024x497.webp 1024w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-300x146.webp 300w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-768x373.webp 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-1536x746.webp 1536w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-2048x995.webp 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" data-orig-src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture6-1024x497.webp\"><\/figure>\n\n\n<figure class=\"wp-block-image size-large is-resized has-custom-border\"><img decoding=\"async\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7-677x1024.webp\" alt=\"This picture displays the Notebook description and allows users to launch the Notebook using the &ldquo;Create from template&rdquo;.\" class=\"wp-image-7470 webp-format\" style=\"border-radius:0px;width:677px;height:auto\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7-677x1024.webp 677w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7-198x300.webp 198w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7-768x1162.webp 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7.webp 920w\" sizes=\"(max-width: 677px) 100vw, 677px\" data-orig-src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2023\/03\/Picture7-677x1024.webp\"><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Azure Web Application Firewall (Azure WAF) provides centralized protection of your web applications from exploits and vulnerabilities.<\/p>\n","protected":false},"author":38,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","_alt_title":"","footnotes":"","msx_community_cta_settings":[]},"categories":[1466,1457,1459,1461],"tags":[],"audience":[3053,3056],"content-type":[1481],"product":[1561,1616],"tech-community":[],"topic":[],"coauthors":[1704],"class_list":["post-7465","post","type-post","status-publish","format-standard","hentry","category-hybrid-multicloud","category-networking","category-security","category-web","audience-it-decision-makers","audience-it-implementors","content-type-thought-leadership","product-microsoft-sentinel","product-web-application-firewall","review-flag-disable","review-flag-microsofts","review-flag-new-1680286579-546","review-flag-percent"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure<\/title>\n<meta name=\"description\" content=\"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure\" \/>\n<meta property=\"og:description\" content=\"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Azure Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/microsoftazure\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-02T17:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-10T16:21:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1084\" \/>\n\t<meta property=\"og:image:height\" content=\"634\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sowmya Mahadevaiah\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@azure\" \/>\n<meta name=\"twitter:site\" content=\"@azure\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sowmya Mahadevaiah\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\"},\"author\":[{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/sowmya-mahadevaiah\/\",\"@type\":\"Person\",\"@name\":\"Sowmya Mahadevaiah\"}],\"headline\":\"Azure WAF guided investigation Notebook using Microsoft Sentinel for automated false positive tuning\",\"datePublished\":\"2023-03-02T17:00:00+00:00\",\"dateModified\":\"2025-06-10T16:21:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\"},\"wordCount\":1029,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp\",\"articleSection\":[\"Hybrid + multicloud\",\"Networking\",\"Security\",\"Web\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\",\"name\":\"Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure\",\"isPartOf\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp\",\"datePublished\":\"2023-03-02T17:00:00+00:00\",\"dateModified\":\"2025-06-10T16:21:01+00:00\",\"description\":\"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.\",\"breadcrumb\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.webp\",\"contentUrl\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.webp\",\"width\":1084,\"height\":634,\"caption\":\"graphical user interface, application\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog home\",\"item\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Azure WAF guided investigation Notebook using Microsoft Sentinel for automated false positive tuning\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#website\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\",\"name\":\"Microsoft Azure Blog\",\"description\":\"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.\",\"publisher\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\",\"name\":\"Microsoft Azure Blog\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp\",\"contentUrl\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Azure Blog\"},\"image\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/microsoftazure\",\"https:\/\/x.com\/azure\",\"https:\/\/www.instagram.com\/microsoftdeveloper\/\",\"https:\/\/www.linkedin.com\/company\/16188386\",\"https:\/\/www.youtube.com\/user\/windowsazure\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/person\/a3047486833511917401a93d26f70b9a\",\"name\":\"laurengoodwin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g4845c2dabb16550539c6ad38a01ab841\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g\",\"caption\":\"laurengoodwin\"},\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/laurengoodwin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure","description":"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/","og_locale":"en_US","og_type":"article","og_title":"Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure","og_description":"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.","og_url":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/","og_site_name":"Microsoft Azure Blog","article_publisher":"https:\/\/www.facebook.com\/microsoftazure","article_published_time":"2023-03-02T17:00:00+00:00","article_modified_time":"2025-06-10T16:21:01+00:00","og_image":[{"width":1084,"height":634,"url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.png","type":"image\/png"}],"author":"Sowmya Mahadevaiah","twitter_card":"summary_large_image","twitter_creator":"@azure","twitter_site":"@azure","twitter_misc":{"Written by":"Sowmya Mahadevaiah","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#article","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/"},"author":[{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/sowmya-mahadevaiah\/","@type":"Person","@name":"Sowmya Mahadevaiah"}],"headline":"Azure WAF guided investigation Notebook using Microsoft Sentinel for automated false positive tuning","datePublished":"2023-03-02T17:00:00+00:00","dateModified":"2025-06-10T16:21:01+00:00","mainEntityOfPage":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/"},"wordCount":1029,"commentCount":0,"publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage"},"thumbnailUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp","articleSection":["Hybrid + multicloud","Networking","Security","Web"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/","name":"Azure WAF guided investigation to tune WAF policy Notebook | Microsoft Azure Blog | Microsoft Azure","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage"},"thumbnailUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210-1024x599.webp","datePublished":"2023-03-02T17:00:00+00:00","dateModified":"2025-06-10T16:21:01+00:00","description":"We are pleased to announce a new Azure WAF guided investigation to tune WAF policy Notebook in preview. It guides you through an investigation experience to understand the Azure WAF incidents in Microsoft Sentinel, identify false positives, and automatically apply exclusions to WAF rules to address the false positives. Learn more.","breadcrumb":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#primaryimage","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.webp","contentUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-13-141210.webp","width":1084,"height":634,"caption":"graphical user interface, application"},{"@type":"BreadcrumbList","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-waf-guided-investigation-notebook-using-microsoft-sentinel-for-automated-false-positive-tuning\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog home","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"Azure WAF guided investigation Notebook using Microsoft Sentinel for automated false positive tuning"}]},{"@type":"WebSite","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","name":"Microsoft Azure Blog","description":"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.","publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/azure.microsoft.com\/en-us\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization","name":"Microsoft Azure Blog","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","contentUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","width":512,"height":512,"caption":"Microsoft Azure Blog"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/microsoftazure","https:\/\/x.com\/azure","https:\/\/www.instagram.com\/microsoftdeveloper\/","https:\/\/www.linkedin.com\/company\/16188386","https:\/\/www.youtube.com\/user\/windowsazure"]},{"@type":"Person","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/person\/a3047486833511917401a93d26f70b9a","name":"laurengoodwin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g4845c2dabb16550539c6ad38a01ab841","url":"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0b47220d480d83e3118b16d74903754bf5fbb94a5dea133eacd3351cb50e7f2c?s=96&d=mm&r=g","caption":"laurengoodwin"},"url":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/laurengoodwin\/"}]}},"msxcm_display_generated_audio":false,"msxcm_animated_featured_image":null,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Azure Blog","distributor_original_site_url":"https:\/\/azure.microsoft.com\/en-us\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/7465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/comments?post=7465"}],"version-history":[{"count":1,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/7465\/revisions"}],"predecessor-version":[{"id":41257,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/7465\/revisions\/41257"}],"wp:attachment":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/media?parent=7465"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/categories?post=7465"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tags?post=7465"},{"taxonomy":"audience","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/audience?post=7465"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/content-type?post=7465"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/product?post=7465"},{"taxonomy":"tech-community","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tech-community?post=7465"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/topic?post=7465"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/coauthors?post=7465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}