_sourceCategory=cloudflare
| json field=_raw "WAFAction" | where %WAFAction != "unknown"
| json field=_raw "FirewallMatchesRuleIDs" as all_rule_ids
| parse regex field=all_rule_ids "(?<rule>\w+)" multi
| count by rule
| order by _count
//https://www.dropbox.com/s/0prrpi1id3r1oj3/Screen%20Recording%202019-07-15%20at%2008.37.47.mov?dl=0