Need to find Top talkers from Azure Firewall network Logs

Question

I want a KQL query and configuration settings which can give me Azure firewall network rule logs with column having details for SentBytes and received bytes details for each packet.

Answer 1

assuming you already configured Azure Firewall

sending logs to Log Analytics Workspace

the following may help to you

AzureDiagnostics
| where ResourceType == "AZUREFIREWALLS" and Category == "AzureFirewallNetworkRule"
| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by SourceIP
| order by TotalSentBytes desc

Answer 2

To get Azure Firewall network rule logs with SentBytes and ReceivedBytes details for each packet, you can use the following KQL query in Azure Log Analytics:

AzureDiagnostics

| where ResourceType == "AZUREFIREWALLS" and Category == "AzureFirewallNetworkRule"

| project TimeGenerated, SourceIP, DestinationIP, Protocol, Action, SentBytes, ReceivedBytes