// Use this run's actual transaction to identify every contributing rule.
let gatewayId = "<gateway-resource-id>";
AGWFirewallLogs
| where TimeGenerated > ago(45m)
| where _ResourceId =~ gatewayId
| project TimeGenerated, TransactionId, RequestUri, Action,
          RuleSetType, RuleSetVersion, RuleId, Message,
          DetailedMessage, DetailedData
| order by TimeGenerated desc