Log Analytics (SQL ) Query to trend the Cloud Armor DENIED Connections

We wanted to construct a Log Analytics ( SQL ) Query to view and count the “enforced security policy” that is blocking ( DENY ) the traffic on monthly basis . Does anyone has the query handy that we can place and test .

jsonPayload.enforcedSecurityPolicy.preconfiguredExprIds

Hari_ry_0-1743509038727.png