Network / Security event
AGWFirewallLogs
Azure Application Gateway WAF logs with OWASP rule matches, blocked requests, and web attack detections
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC5 Network activity
Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services
ACSC
- 2. Network device logs
- 8. Cloud platform logging
- 12. Windows DNS server analytic event logs
CISA
- 3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs
MITRE data sources
- Network Traffic: Network Traffic Content
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
Action6ClientIp6Hostname6TimeGenerated6Message5RequestUri5TransactionId5DetailedData3DetailedMessage3
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.