Want to get the top 10 countries for the most requests received to application gateway

Rajith pathiraja 21 Reputation points
2023-01-06T02:37:50.67+00:00

hi,

Im designing a security dashboard for quick reference for my azure application gateway. i want to have check the top 10 received requests by sorted by the country of traffic origin.
How can i write a query for that ?

i tried below but want working ?

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess"
| extend clientIP_geo = geoip(clientIP_s)
| summarize AggregatedValue = count() by clientIP_s, country = clientIP_geo.Country
| top 10 by AggregatedValue

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions
Azure Web Application Firewall
{count} votes

Accepted answer
  1. GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
    2023-01-07T09:01:20.547+00:00

    Hello @Rajith pathiraja ,

    I understand that you want to get the top 10 countries for the most requests received by your Application gateway.

    However, this is not possible as of today.

    If you look into the Application gateway Access log or Firewall Log values, you will only find "clientIP" as below:

    277068-image.png

    277027-image.png

    Refer : https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics#access-log

    So, there is no way to summarize the logs by country information.

    Summarizing logs by country information is only possible where the logs have a value called "clientCountry". For example Application Insights logs called "AppRequests".
    Refer : https://learn.microsoft.com/en-us/azure/azure-monitor/app/convert-classic-resource#appavailabilityresults
    You can find a value called "client_CountryOrRegion" in this log to summarize your logs by this function/value and can render the data using a area/bar/column/pie/scatter/table/time/treemap chart as below:

    277133-image.png

    For Application gateway, you can only get Top 10 Client IPs as shown in my previous screenshot and mentioned in the below doc:
    https://learn.microsoft.com/en-us/azure/application-gateway/monitor-application-gateway#sample-kusto-queries

    Kindly let us know if the above helps or you need further assistance on this issue.


    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.