aiFObserve
Distributed, Contextual Visibility & Governance for Enterprise AI Traffic. No Agents, No APIs, No
Azure Application Gateway WAF Capture Guide For Unified aiFObserve
Best Capture Source
Enable diagnostic logging for Application Gateway WAF. Send logs to Log Analytics, Event Hub, or storage, then export the WAF log records for conversion.
Basic Logging
- TimeGenerated
- ResourceId
- OperationName
- clientIp
- clientPort
- hostname
- requestUri
- httpMethod
- httpStatus
- action
- ruleId
- ruleGroup
- ruleSetType
- ruleSetVersion
- message
- details
- transactionId
Extended Logging
- subscription ID and resource group from ResourceId
- listener, backend pool, and backend setting fields where present
- policy name and policy mode
- matched variable, selector, match value, and file name fields in details
- request body inspection result
- geolocation enrichment from SIEM or Log Analytics, if available
- user-agent, host, and X-Forwarded-For from access logs or app logs
User And App Identity
Best identity signals:
- authenticated identity from upstream App Service, API Management, Entra ID, or reverse proxy logs joined by transaction/request ID
- host and URI
- transactionId
- subscription/resource identifiers
Application Gateway WAF logs rarely contain user identity by themselves. If the same SIEM export includes application gateway access logs or application logs, preserve the shared request ID so the OTLP/SIEM converter can carry that evidence forward.
AI Provider And Location Evidence
Keep subscription, resource group, Azure region, host, backend target, and request URI. These support data residency and boundary reporting.