---
title: "Azure WAF EventHub"
slug: "azure-waf-eventhub"
updated: 2025-11-11T13:56:34Z
published: 2025-11-11T13:56:34Z
canonical: "docs.databee.buzz/azure-waf-eventhub"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure WAF EventHub

Azure Web Application Firewall (WAF) provides protection for your web applications and APIs from common exploits and vulnerabilities. Web applications increasingly encounter malicious attacks that exploit commonly known vulnerabilities. For more details refer to [Microsoft’s official documentation](https://learn.microsoft.com/en-us/azure/web-application-firewall/).

**Integration Method**: EventHub

To ingest Azure WAF events via API, refer to the guide, [Azure WAF](/user-manual/docs/azure-waf).

**Tables**: HTTP Activity (4002), Web Resources Activity (6001)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Firewall | To monitor, analyse, and troubleshoot security incidents. |
| Access | Access Control mechanisms, which determine who or what can interact with web applications. |

> [!NOTE]
> **Note:**
> 
> EventHub doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service.

## Prerequisites

- The user should have access to the Azure portal.
- The user should have access to the Application gateway to create a diagnostic setting.
- The user should have access to the Event Hub.
- The user should have access to the DataBee console.

## Configuration Overview

1. [Create an Event Hub](/user-manual/docs/azure-waf-eventhub#create-eventhub) in the Azure Portal.
2. [Create a diagnostic setting](/user-manual/docs/azure-waf-eventhub#create-diagnostic-settings-in-application-gateway) in the Application Gateway.
3. Get the Event Hub namespace, Event Hub name and [connection string](/user-manual/docs/azure-waf-eventhub#get-the-connection-string).
4. Add the [Azure WAF](/user-manual/docs/azure-waf-eventhub#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **Azure WAF Parameter** |
| --- | --- |
| Event Hub Namespace URL | [Event Hub Namespace](/docs/azure-waf-eventhub#event_hub_namespace) |
| Event Hub Name | Event Hub Name |
| Consumer Group | $Default |
| Connection String | Connection String |

## Azure Configuration

### Create EventHub

Sign in to the Azure portal and navigate to Marketplace to create an EventHub. If you have already configured EventHub, then skip to step 6.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-jdvmxwul.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)

1. Provide basic information to create an event hub namespace.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-1xrnr19k.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Provide project details which include subscription details.
  2. Enter a valid event hub namespace name. Copy it and save it for later use.
  3. Select the region for your Event Hub namespace.

> [!NOTE]
> **Note:**
> 
> Choose the same region where your Databee cluster is deployed to minimize latency when receiving logs from the Event Hub.
  4. Select the **Pricing Tier**. For this guide, the **Standard** tier will be used.

> [!NOTE]
> **Note:**
> 
> The **Standard** tier is the minimum requirement, as it’s needed to enable **Apache Kafka** support.
  5. Provide Throughput Units. For this guide, we will be using one (1) Throughput Unit (TU). A higher number may be required if you know the amount of data sent from Azure. [More about Throughput Units](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-scalability#throughput-units).
  6. Enable the **Auto-Inflate** option to prevent issues when traffic exceeds the assigned Throughput Unit (TU) capacity. Auto-Inflate automatically increases the number of TUs for your **Standard Tier Event Hubs Namespace** as traffic grows, up to a specified maximum limit.

> [!NOTE]
> **Note:**
> 
> Once Auto-Inflate is enabled, it does not automatically scale down. You’ll need to manually reduce the TUs if required.
  7. Click on **Next: Advanced >** button.
2. Provide Advance Security Details. Click on **Next: Networking >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-4eq4bmoo.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
3. Select **Public access** as a ‘Connectivity method’. Click **Next: Tags >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-m87qrclc.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
4. Add Tags relevant to your organization for viewing consolidated billing.

Click **Next: Review + create >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-8ef8egv1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
5. EventHub Namespace

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-vb5nmed8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
6. Navigate to **Entities** > **Event Hubs**. Click on **+ Event Hub** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-v173w8ua.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
7. Enter basic details to create an Event Hub.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-ak2ng255.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Enter valid Event Hub name. Save it for later use.
  2. Specify the Partition count.

> [!NOTE]
> **Note:**
> 
> Partitions enable parallel processing, helping your applications scale. It is recommended to set this between 10-15 for better scalability.
  3. Select Cleanup policy.
  4. Specify the **Retention Period** for the logs.

> [!NOTE]
> **Note:**
> 
> A longer retention period ensures that more logs are retained in Event Hub, reducing the risk of data loss. It is recommended setting the retention period to the maximum allowed value.
  5. Click on **Next: Capture >** button.
8. Turn Capture to **Off** and click **Next: Review + create >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-y1ihsaex.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
9. Create Event Hub.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-fqkdndab.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D) ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-rkwwrz91.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)

### Create Diagnostic settings in application gateway

This step is needed to send the Azure WAF logs to Event Hub.

1. Sign in to the Azure Portal and open your Application Gateway. If you haven’t configured your application gateway, follow [this guide](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal) to create one.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-9v9ghoxv.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
2. Create **Diagnostic settings**.

> [!NOTE]
> **Note:**
> 
> To create a Diagnostic Setting, the user must have at least the Monitoring Contributor role, which provides the necessary permissions to configure diagnostic settings.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-is6qujof.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Open the **Monitoring** section.
  2. Click on **Diagnostic settings**.
  3. Click on **Add diagnostic setting** button.
3. Enter Diagnostic setting details.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-nu41qga9.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Enter Diagnostic setting name.
  2. Select Log categories, **Application Gateway Access Log** and **Application Gateway Firewall Log**.
4. Add destination details

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-m9kgbl58.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Select **Stream to an event hub** option.
  2. Select **Subscription**.
  3. Select [**Event hub namespace**](/docs/azure-waf-eventhub#event_hub_namespace).
  4. Select **Event hub name** (required in our case, to capture logs in one event hub only).
  5. Select **Event hub policy name**.
  6. Click on **Save** button.

### Get the connection string

1. Navigate to Event Hub.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-eewgm2j2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
2. Navigate to **Settings** > **Shared access policies**. Click on the **+ Add** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-y2pt8viy.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
3. Add SAS Policy.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-1srta945.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Enter valid ‘Policy name’.
  2. Select **Listen** option.
  3. Click on **Create** button.
4. Click on the Share policy you created. Copy the **Primary connection string** for later use.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-tyujuboj.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data Management** > **Data Feeds** and click the **Add New Data Feed** button.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-ccfad2t0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
2. Search for **Azure WAF** and click on it as shown below.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-yzabnzkk.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
3. Click on the **Azure Event Hub** collection method.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-w63tyez9.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
4. In configuration, enter the feed contact information.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-wskpgh7y.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
5. Enter Azure Event Hub connection details

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-b7p4aokm.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
  1. Replace <Namespace> placeholder with [Event Hub namespace](/docs/azure-waf-eventhub#event_hub_namespace).
  2. Enter the Consumer Group, otherwise please keep the default value: “**$Default**”
  3. Enter Event Hub name.
  4. Select **PLAIN** as Authorization Method. Enter Event Hub Connection String.
6. Click on **Test Connection** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-waf-eventhub-doc-standard-image-ygu87rg4.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A38Z&se=2026-10-30T13%3A22%3A38Z&sr=c&sp=r&sig=jh8sLocVVdfOY4uDIkVJsl3zK%2F16a37EYejwUU4v2%2F0%3D)
7. Click on **Submit** button.

## Troubleshooting Tips

- If you are facing an error while testing the connection, then make sure the Event hub namespace, event hub name is the desired one. Make sure the connection string has Listen Claims.

#