in Azure WAF/Alert - Process Azure FrontDoor Alerts/ProcessAFDAlerts.cs [113:162]
private static async Task UpdateLinkedWafPolicy(AlertInfo alertInfo, ILogger log, IEnumerable<Row> logs = null, bool deleteRules = false)
{
// 1. Create an instance of FrontdoorManagementClient
var frontdoorClient =
new FrontDoorManagementClient(
SdkContext.AzureCredentialsFactory.FromServicePrincipal(ClientId, ClientSecret, TenantId, AzureEnvironment.AzureGlobalCloud));
frontdoorClient.SubscriptionId = WafPolicySubscriptionId;
// 2. Use it to get the WAF Policy
WebApplicationFirewallPolicy wafPolicy;
try
{
wafPolicy = await frontdoorClient.Policies.GetAsync(WafPolicyResourceGroupName, WafPolicyName);
if (wafPolicy == null)
{
Console.WriteLine("Does not exist");
throw new Exception("Waf policy does not exist");
}
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
throw;
}
// 3. Add or remove the rate limit rules from the WAF policy
if (deleteRules)
{
DeleteRulesFromWafPolicy(wafPolicy, alertInfo);
}
else
{
UpdateWafWithRulesToStopAttack(wafPolicy, alertInfo, logs);
}
// 4. Update/Deploy the WAF policy
try
{
await frontdoorClient.Policies.CreateOrUpdateAsync(WafPolicyResourceGroupName, WafPolicyName,
wafPolicy);
}
catch (Exception e)
{
log.LogError("Failed to update waf policy", e);
throw;
}
}