Diagnostic logging is enabled in Azure Front Door WAF

Overview

Without diagnostic logging enabled for Azure Front Door WAF, security teams lose visibility into blocked attacks, rule matches, access patterns, and WAF events occurring at the network edge. Threat actors attempting to exploit web application vulnerabilities through SQL injection, cross-site scripting, or other OWASP Top 10 attacks would go undetected because no WAF logs are being captured or analyzed. The absence of logging prevents correlation of WAF events with other security telemetry, eliminating the ability to construct attack timelines during incident investigations. Furthermore, compliance frameworks such as PCI-DSS, HIPAA, and SOC 2 require organizations to maintain audit logs of web application security events, and the lack of WAF diagnostic logging creates audit failures. Azure Front Door WAF provides multiple log categories including Access Logs and WAF Logs, which must be routed to a destination such as Log Analytics, Storage Account, or Event Hub to enable security monitoring and forensic analysis.

Remediation

Configure diagnostic settings for Azure Front Door to enable WAF log collection

• Create diagnostic settings in Azure Monitor

Enable WAF logging to capture firewall events and rule matches

• Azure Front Door WAF monitoring and logging

Create a Log Analytics workspace for storing and analyzing WAF logs

• Create a Log Analytics workspace

Monitor Azure Front Door using diagnostic logs and metrics

• Monitor metrics and logs in Azure Front Door

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Logging and detection
ATT&CK	T1190 Exploit Public-Facing Application
Licence	Azure_FrontDoor_Standard, Azure_FrontDoor_Premium
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.