When working with Azure Firewall's the easiest way to query traffic is to enable the diagnostic settings on the Firewall and send the data to a Log Analytics Workspace where Kusto Query Language (KQL) can be used to analyse the traffic and rulesets.
Once in the Workspace navigate to General > Logs section then start building out the required queries. Below are some example queries to filter traffic,
Show blocked traffic from a certain IP
AZFWNetworkRule
| where SourceIp == "10.10.10.1"
| where Action == "Deny"Filter traffic by a rule collection group (or rule collection or rule)
AZFWNetworkRule
| where RuleCollectionGroup == "rulecollectionggroup-name"
//| where RuleCollection == "rulecollection-name"
//| where Rule == "allow-smb"
//| where Action == "Deny"
Filter from a source but using an array exclude multiple destinations from the query
AZFWNetworkRule
//| take 100
| where SourceIp == "10.10.10.1"
| where DestinationIp !in ("192.168.1.2", "192.168.1.6", "192.168.1.7")
| where Action == "Deny"
To develop your filters further, see the quick reference on the Kusto Query Language at https://docs.microsoft.com/en-us/azure/data-explorer/kql-quick-reference