Case Study

Front Door WAF SOAR Automation

A timer-triggered .NET Function App that queries Log Analytics for abusive Front Door client IPs and keeps Azure WAF BlockedIPs custom rules in sync — managed identity only, no secrets in code.

SOAR Azure Front Door WAF Log Analytics Azure Functions .NET 8

The Challenge

Bots Probe Faster Than Manual Blocks

Front Door WAF logs show the same abusive IPs hammering endpoints for hours. Manual blocklist updates cannot keep up — and attackers only need one successful attempt.

Earlier approaches mixed more moving parts than necessary. We needed a simpler, stable loop: read abusive IPs from Log Analytics, compare them to the live WAF policy, and update a dedicated custom rule only when the set actually changes.

The threshold we used: more than 500 blocked requests from an IP in 24 hours (excluding rate-limiter and known Outlook noise). Once those IPs are on the WAF block list, even a later successful exploit path is denied at the edge.

The Solution

Function App + Managed Identity + WAF Policy

A .NET 8 in-process timer Function queries Log Analytics every 15 minutes, then PATCHes Front Door WAF policies through the Azure Resource Manager API.

Runtime loop

Timer trigger every 15 minutes
KQL against Front Door WAF diagnostics in Log Analytics
Collect client IPs above the abuse threshold
Export each WAF policy, update the BlockedIPs custom rule match values
Skip the PUT when the IP set is unchanged

Identity & access

System-assigned managed identity on the Function App
Log Analytics Reader on the workspace
Contributor on the WAF policies (ARM update)
DefaultAzureCredential locally and in Azure — no stored secrets
Dev/prod policy names selected from the Function App site name

Timer (every 15 min) │ ▼ Azure Function (.NET 8 in-process) ├─ DefaultAzureCredential / managed identity ├─ LogsQueryClient → Log Analytics (KQL) └─ ARM REST → Front Door WAF policies │ ▼ Custom rule BlockedIPs (IP match → Deny traffic) Prerequisite: create BlockedIPs on each WAF policy (IP match + seed address) KQL filter: Front Door WAF Block actions, >500 requests / 24h

Azure portal Edit custom rule panel for BlockedIPs with IP address match and Deny traffic action — WAF prerequisite: a custom rule named BlockedIPs — IP address match on RemoteAddr, action Deny traffic. The Function App refreshes the match values on each run.

Implementation

From Local Debug to Azure Timer

Developed as a Visual Studio .NET 8 Function project, tested with the developer’s Azure credentials, then published to the Function App that authenticates with its system-assigned identity.

Visual Studio showing BlockWAFIP.cs timer function with KQL query against Front Door WAF logs — Core timer function: query Front Door WAF block events from Log Analytics, collect abusive client IPs, then update WAF policies when the set changes.

Azure portal Functions list showing TimerTriggerFunction enabled with Invocations and more monitor link — Deployed timer function in the Azure portal — invocations and logs available from Monitor.

Function execution log showing KQL query run and Blocked IPs result with addresses redacted — Successful run (~515 ms): KQL executed, abusive IPs identified (redacted), ready for WAF sync.

Outcome

BlockedIPs Shows Up in the Noise

Once the automation is live, the custom rule appears alongside managed rule sets in Front Door analytics — proof that previously noisy IPs are now denied at the edge.

Front Door analytics charts highlighting BlockedIPs custom rule among top event triggers — Production signal: BlockedIPs among top WAF event triggers — automated blocks continuing after the initial probe spike from managed rule sets.

Technology

What We Used

Platform & security

Azure Front Door WAF custom rules Log Analytics KQL Azure Functions Managed Identity Entra ID RBAC

Application

.NET 8 in-process Timer trigger Azure.Identity Azure.Monitor.Query ARM REST API Visual Studio

The Result

Abuse Cap at the Edge

Threat actors get a hard ceiling on probe volume. After the threshold, their IP is denied by WAF — even if they later find a request that would have succeeded.

15m
Detection & sync interval
500+
Blocked requests / 24h → auto-block
0
Secrets in code — managed identity
Idempotent
Skips WAF PUT when IP set unchanged

Edge denial for repeat offenders — reduces the window for vulnerability discovery

Simple stack: one Function App, managed identity, Log Analytics, and existing WAF policies

Portal invocations and App Insights-ready logging for alerting on failures or hits

Dev and prod WAF policy sets selected automatically from the Function App environment name

Similar Challenge?

Close the Loop on Edge Abuse

If Front Door or Application Gateway WAF logs show the same IPs probing for hours, we can wire Log Analytics detections into automated blocklist updates — with managed identities, clear thresholds, and portal-visible evidence.

Start a Project More Case Studies