# Diagnostic logging is enabled in Azure Front Door WAF
Without diagnostic logging enabled for Azure Front Door WAF, security teams lose visibility into blocked attacks, rule matches, access patterns, and WAF…
Source: https://maester.dev/docs/tests/ZTA.26889
## Overview
Without diagnostic logging enabled for Azure Front Door WAF, security teams lose visibility into blocked attacks, rule matches, access patterns, and WAF events occurring at the network edge. Threat actors attempting to exploit web application vulnerabilities through SQL injection, cross-site scripting, or other OWASP Top 10 attacks would go undetected because no WAF logs are being captured or analyzed. The absence of logging prevents correlation of WAF events with other security telemetry, eliminating the ability to construct attack timelines during incident investigations. Furthermore, compliance frameworks such as PCI-DSS, HIPAA, and SOC 2 require organizations to maintain audit logs of web application security events, and the lack of WAF diagnostic logging creates audit failures. Azure Front Door WAF provides multiple log categories including Access Logs and WAF Logs, which must be routed to a destination such as Log Analytics, Storage Account, or Event Hub to enable security monitoring and forensic analysis.
## Remediation
Configure diagnostic settings for Azure Front Door to enable WAF log collection
- [Create diagnostic settings in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/create-diagnostic-settings)
Enable WAF logging to capture firewall events and rule matches
- [Azure Front Door WAF monitoring and logging](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor)
Create a Log Analytics workspace for storing and analyzing WAF logs
- [Create a Log Analytics workspace](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace)
Monitor Azure Front Door using diagnostic logs and metrics
- [Monitor metrics and logs in Azure Front Door](https://learn.microsoft.com/en-us/azure/frontdoor/front-door-diagnostics)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Logging and detection |
| ATT&CK | [T1190](/docs/tests?mitre=T1190) Exploit Public-Facing Application |
| Licence | Azure_FrontDoor_Standard, Azure_FrontDoor_Premium |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.