You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/web-application-firewall/waf-copilot.md
+26-38Lines changed: 26 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,59 +1,52 @@
1
1
---
2
-
title: Azure Web Application Firewall integration in Microsoft Copilot for Security (preview)
3
-
description: Learn about using Microsoft Copilot for Security to investigate traffic flagged by Azure Web Application Firewall.
2
+
title: Azure Web Application Firewall integration in Microsoft Security Copilot
3
+
description: Learn about using Microsoft Security Copilot to investigate traffic flagged by Azure Web Application Firewall.
4
4
keywords: copilot for security, copilot for security, threat intelligence, intrusion detection and prevention system, plugin, integration, azure web application firewall, copilot, open ai, openai co-pilot
5
5
author: halkazwini
6
6
ms.author: halkazwini
7
-
ms.date: 01/22/2025
8
-
ms.topic: concept-article
9
7
ms.service: azure-web-application-firewall
8
+
ms.date: 06/09/2025
9
+
ms.topic: concept-article
10
10
ms.localizationpriority: high
11
11
ms.collection: Tier1, ce-skilling-ai-copilot
12
12
---
13
13
14
-
# Azure Web Application Firewall integration in Microsoft Copilot for Security (preview)
15
-
16
-
> [!IMPORTANT]
17
-
> Azure Web Application Firewall integration in Microsoft Copilot for Security is currently in PREVIEW.
18
-
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
14
+
# Azure Web Application Firewall integration in Microsoft Security Copilot
19
15
20
-
Microsoft Copilot for Security is a cloud-based AI platform that provides natural language copilot experience. It can help support security professionals in different scenarios, like incident response, threat hunting, and intelligence gathering. For more information, see [What is Microsoft Copilot for Security?](/security-copilot/microsoft-security-copilot)
16
+
Microsoft Security Copilot is a cloud-based AI platform that provides natural language copilot experience. It can help support security professionals in different scenarios, like incident response, threat hunting, and intelligence gathering. For more information, see [What is Microsoft Security Copilot?](/security-copilot/microsoft-security-copilot)
21
17
22
-
Azure Web Application Firewall (WAF) integration in Microsoft Copilot for Security enables deep investigation of Azure WAF events. It can help you investigate WAF logs triggered by Azure WAF in a matter of minutes and provide related attack vectors using natural language responses at machine speed. It provides visibility into your environment’s threat landscape. It allows you to retrieve a list of most frequently triggered WAF rules and identify the top offending IPaddresses in your environment.
18
+
Azure Web Application Firewall (WAF) integration in Microsoft Security Copilot enables deep investigation of Azure WAF events. It can help you investigate WAF logs triggered by Azure WAF in a matter of minutes and provide related attack vectors using natural language responses at machine speed. It provides visibility into your environment’s threat landscape. It allows you to retrieve a list of most frequently triggered WAF rules and identify the top offending IPaddresses in your environment.
23
19
24
-
Microsoft Copilot for Security integration is supported on both Azure WAF on Azure Application Gateway and Azure WAF on Azure Front Door.
20
+
Microsoft Security Copilot integration is supported on both Azure WAF on Azure Application Gateway and Azure WAF on Azure Front Door.
25
21
26
22
## Know before you begin
27
23
28
-
If you're new to Microsoft Copilot for Security, you should familiarize yourself with it by reading these articles:
29
-
-[What is Microsoft Copilot for Security?](/security-copilot/microsoft-security-copilot)
30
-
-[Microsoft Copilot for Security experiences](/security-copilot/experiences-security-copilot)
31
-
-[Get started with Microsoft Copilot for Security](/security-copilot/get-started-security-copilot)
32
-
-[Understand authentication in Microsoft Copilot for Security](/security-copilot/authentication)
33
-
-[Prompting in Microsoft Copilot for Security](/security-copilot/prompting-security-copilot)
24
+
If you're new to Microsoft Security Copilot, you should familiarize yourself with it by reading these articles:
25
+
-[What is Microsoft Security Copilot?](/security-copilot/microsoft-security-copilot)
-[Get started with Microsoft Security Copilot](/security-copilot/get-started-security-copilot)
28
+
-[Understand authentication in Microsoft Security Copilot](/security-copilot/authentication)
29
+
-[Prompting in Microsoft Security Copilot](/security-copilot/prompting-security-copilot)
34
30
35
-
## Microsoft Copilot for Security integration in Azure WAF
31
+
## Microsoft Security Copilot integration in Azure WAF
36
32
37
-
This integration supports the standalone experience and is accessed through [https://securitycopilot.microsoft.com](https://securitycopilot.microsoft.com). This is a chat-like experience that you can use to ask questions and get answers about your data. For more information, see [Microsoft Copilot for Security experiences](/security-copilot/experiences-security-copilot#standalone-and-embedded-experiences).
33
+
This integration supports the standalone experience and is accessed through [https://securitycopilot.microsoft.com](https://securitycopilot.microsoft.com). This is a chat-like experience that you can use to ask questions and get answers about your data. For more information, see [Microsoft Security Copilot experiences](/security-copilot/experiences-security-copilot#standalone-and-embedded-experiences).
38
34
39
35
## Key features
40
36
41
-
The preview standalone experience in Azure WAF can help you with:
42
-
43
37
- Providing a list of top Azure WAF rules triggered in the customer environment and generating deep context with related attack vectors.
44
38
45
39
This capability provides details about Azure WAF rules that are triggered due to a WAF block. It provides an ordered list of rules based on trigger frequency in the desired time period. It does this by analyzing Azure WAF logs and connecting related logs over a specific time period. The result is an easy-to-understand natural language explanation of why a particular request was blocked.
46
40
- Providing a list of malicious IP addresses in the customer environment and generating related threats.
47
41
48
42
This capability provides details about client IP addresses blocked by the Azure WAF. It does this by analyzing Azure WAF logs and connecting related logs over a specific time period. The result is an easy-to-understand natural language explanation of which IP addresses the WAF blocked and the reason for the blocks.
49
43
50
-
- Summarizing SQL injection(SQLi) attacks.
44
+
- Summarizing SQL injection(SQLi) attacks.
51
45
52
46
This Azure WAF skill provides you with insights into why it blocks SQL injection (SQLi) attacks on web applications. It does this by analyzing Azure WAF logs and connecting related logs over a specific time period. The result is an easy-to-understand natural language explanation of why a SQLi request was blocked.
53
-
- Summarizing Cross-site scripting(XSS) attacks.
54
-
55
-
This Azure WAF skill helps you understand why Azure WAF blocked Cross Site Scripting(XSS) attacks to web applications. It does this by analyzing Azure WAF logs and connecting related logs over a specific time period. The result is an easy-to-understand natural language explanation of why an XSS request was blocked.
47
+
- Summarizing Cross-site scripting (XSS) attacks.
56
48
49
+
This Azure WAF skill helps you understand why Azure WAF blocked Cross Site Scripting (XSS) attacks to web applications. It does this by analyzing Azure WAF logs and connecting related logs over a specific time period. The result is an easy-to-understand natural language explanation of why an XSS request was blocked.
57
50
58
51
## Enable the Azure WAF integration in Copilot for Security
59
52
@@ -66,11 +59,11 @@ To enable the integration, follow these steps:
66
59
5. On the Plugins page, set the Azure Web Application Firewall toggle to **On**.
67
60
6. Select the Settings on the Azure Web Application Firewall plugin to configure the Log Analytics workspace for Azure Front Door WAF and/or the Azure Application Gateway WAF.
68
61
7. To start using the skills, use the prompt bar.
69
-
:::image type="content" source="media/waf-copilot/prompt-bar.png" alt-text="Screenshot showing the Microsoft Copilot for Security prompt bar.":::
62
+
:::image type="content" source="media/waf-copilot/prompt-bar.png" alt-text="Screenshot showing the Microsoft Security Copilot prompt bar.":::
70
63
71
64
## Sample Azure WAF prompts
72
65
73
-
You can create your own prompts in Microsoft Copilot for Security to perform analysis on the attacks based on WAF logs. This section shows some ideas and examples.
66
+
You can create your own prompts in Microsoft Security Copilot to perform analysis on the attacks based on WAF logs. This section shows some ideas and examples.
74
67
75
68
### Before you begin
76
69
@@ -110,7 +103,7 @@ The following example prompts might be helpful.
110
103
111
104
## Provide feedback
112
105
113
-
Your feedback on the Azure WAF integration with Microsoft Copilot for Security helps with development. To provide feedback in Copilot, select **How’s this response?** At the bottom of each completed prompt and choose any of the following options:
106
+
Your feedback on the Azure WAF integration with Microsoft Security Copilot helps with development. To provide feedback in Copilot, select **How’s this response?** At the bottom of each completed prompt and choose any of the following options:
114
107
115
108
- Looks right - Select if the results are accurate, based on your assessment.
116
109
- Needs improvement - Select if any detail in the results is incorrect or incomplete, based on your assessment.
@@ -120,18 +113,13 @@ For each feedback item, you can provide more information in the next dialog box
120
113
121
114
## Limitation
122
115
123
-
If you migrate to Azure Log Analytics dedicated tables in the Application Gateway WAF V2 version, the Microsoft Copilot for Security WAF Skills aren't functional. As a temporary workaround, enable Azure Diagnostics as the destination table in addition to the resource-specific table.
116
+
If you migrate to Azure Log Analytics dedicated tables in the Application Gateway WAF V2 version, the Microsoft Security Copilot WAF Skills aren't functional. As a temporary workaround, enable Azure Diagnostics as the destination table in addition to the resource-specific table.
124
117
125
-
## Privacy and data security in Microsoft Copilot for Security
118
+
## Privacy and data security in Microsoft Security Copilot
126
119
127
-
To understand how Microsoft Copilot for Security handles your prompts and the data that’s retrieved from the service(prompt output), see [Privacy and data security in Microsoft Copilot for Security](/security-copilot/privacy-data-security).
120
+
To understand how Microsoft Security Copilot handles your prompts and the data that’s retrieved from the service(prompt output), see [Privacy and data security in Microsoft Security Copilot](/security-copilot/privacy-data-security).
128
121
129
122
## Related content
130
123
131
-
-[What is Microsoft Copilot for Security?](/copilot/security/microsoft-security-copilot)
132
-
133
-
134
-
135
-
136
-
124
+
-[What is Microsoft Security Copilot?](/copilot/security/microsoft-security-copilot)
0 commit comments