Challenge 6 — Count the Scanners¶

Scenario¶

Your WAF detected automated vulnerability scanner traffic coming from the 10.99.1.x IP range. Multiple scanning tools were used, each with a different User-Agent string. They probed paths like /admin, /phpmyadmin/, /.env, /web.config, and other sensitive endpoints.

Your mission: Determine how many distinct scanner tools (unique User-Agent strings) were used in this scan.

Prerequisites¶

• Lab infrastructure deployed
• WAF logs flowing to Log Analytics

Generate Challenge Traffic¶

Script: challenge-traffic.ps1

cd scripts/
.\challenge-traffic.ps1 -TargetUrl "http://<your-appgw-fqdn>" -Challenge 6

Investigation¶

Filter by the scanner IP range, extract the User-Agent strings, and count the distinct values.

AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where clientIp_s startswith "10.99.1."
| extend UA = column_ifexists("userAgent_s", "")
| where UA != ""
| summarize RequestCount = count() by UA
| count

AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where clientIp_s startswith "10.99.1."
| extend UA = column_ifexists("userAgent_s", "")
| where UA != ""
| summarize RequestCount = count() by UA
| order by RequestCount desc

Submit Your Answer¶

How many distinct scanner tools were detected?

{% include "challenges/challenge-ui.html" %}