Ujio Jul 15th, 2019 65 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
- | json field=_raw "WAFAction" | where %WAFAction != "unknown"
- | json field=_raw "FirewallMatchesRuleIDs" as all_rule_ids
- | parse regex field=all_rule_ids "(?<rule>\w+)" multi
- | count by rule
- | order by _count
RAW Paste Data