Skip to content

Commit a0ca076

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#11911 from Azure/Summary-rules-examples
Summary rules examples
2 parents 46b6f58 + b924dcf commit a0ca076

7 files changed

+186
-0
lines changed

‎Summary rules/DNS/ZscalarDNSEventsIPSummary.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: 260f16fc-4734-4635-babd-ba3c860f328b
2+
displayName: Zscaler Internet Access DNS events IP Summary
3+
description: |
4+
'This summary rule aggregates DNS events from Zscaler Internet Access devices, providing hourly insights into event count by event result details, dns query, source username, source and destination IP addresses .'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: ZscalerDNSEventsSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Zscaler"
13+
| where DeviceProduct == "NSSDNSlog"
14+
| extend DeviceCustomString6 = iff (DeviceCustomString6 matches regex @'^([A-Z_]+)$', DeviceCustomString6, 'NOERROR')
15+
// You can customize the summary table by adding or removing fields based on your requirement.
16+
| summarize Count = count() by SourceIP, SourceUserName, DestinationIP, DnsQuery=DeviceCustomString5, EventResultDetails=DeviceCustomString6, bin(TimeGenerated,1h)
17+
binSize: 60
18+
version: 1.0.0
19+
metadata:
20+
source:
21+
kind: Community
22+
author:
23+
name: Microsoft
24+
support:
25+
tier: Community
26+
categories:
27+
domains: [ "Security - DNS" ]

‎Summary rules/Network/FortinetFortigateNetworkSessionIPSummary.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: 3fdb3c31-d528-4b94-8268-918838cdaee8
2+
displayName: Fortinet Fortigate NetworkSession IP Summary
3+
description: |
4+
'This summary rule aggregates network session logs from Fortinet Fortigate devices, providing hourly insights into session count, data sent and data received by device actions, destination port, protocol, source and destination IP addresses.'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: FortinetFortigateNetworkSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Fortinet"
13+
and DeviceProduct startswith "FortiGate"
14+
and (column_ifexists("DeviceEventCategory","") has "traffic" or AdditionalExtensions has "cat=traffic")
15+
// You can customize the summary table by adding or removing fields based on your requirement.
16+
| summarize Count = count(), SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by SourceIP, DestinationIP, DestinationPort, DeviceAction, Protocol, bin(TimeGenerated,1h)
17+
binSize: 60
18+
version: 1.0.0
19+
metadata:
20+
source:
21+
kind: Community
22+
author:
23+
name: Microsoft
24+
support:
25+
tier: Community
26+
categories:
27+
domains: [ "Security - Network" ]

‎Summary rules/Network/PaloAltoPANOSNetworkSessionIPSummary.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: 29e6b3fb-5942-4a1a-95da-2c0821863e90
2+
displayName: Palo Alto PAN-OS NetworkSession IPSummary
3+
description: |
4+
'This summary rule aggregates network session logs from Palo Alto PAN-OS devices, providing hourly insights into session count, data sent, data received by device actions, destination port, source and destination IP addresses.'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: PaloAltoPANOSNetworkSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Palo Alto Networks" and DeviceProduct == "PAN-OS" and Activity == "TRAFFIC"
13+
// You can customize the summary table by adding or removing fields based on your requirement.
14+
| summarize Count = count(), SentBytes=sum(SentBytes), ReceivedBytes=sum(ReceivedBytes) by SourceIP, DestinationIP, DestinationPort, DeviceAction, bin(TimeGenerated,1h)
15+
binSize: 60
16+
version: 1.0.0
17+
metadata:
18+
source:
19+
kind: Community
20+
author:
21+
name: Microsoft
22+
support:
23+
tier: Community
24+
categories:
25+
domains: [ "Security - Network" ]

‎Summary rules/Network/ZscalarNetworkSessionIPSummary.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: 6457ab65-69ea-4444-981d-1ecaf414fda7
2+
displayName: Zscaler Internet Access NetworkSession IP Summary
3+
description: |
4+
'This summary rule aggregates network session logs from Zscaler Internet Access devices, providing hourly insights into session count, data sent, data received by device actions, destination port, protocol, source and destination IP addresses.'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: ZscalerNetworkSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Zscaler"
13+
| where DeviceProduct == "NSSFWlog"
14+
// You can customize the summary table by adding or removing fields based on your requirement.
15+
| summarize Count = count(), SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by SourceIP, DestinationIP, DestinationPort, DeviceAction, Protocol, bin(TimeGenerated,1h)
16+
binSize: 60
17+
version: 1.0.0
18+
metadata:
19+
source:
20+
kind: Community
21+
author:
22+
name: Microsoft
23+
support:
24+
tier: Community
25+
categories:
26+
domains: [ "Security - Network" ]

‎Summary rules/WebSession/FortinetFortigateWebSessionIPSummary.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: 9862489b-230a-4b70-b45a-8a2771360a86
2+
displayName: Fortinet Fortigate WebSession IP Summary
3+
description: |
4+
'This summary rule aggregates web session logs from Fortinet Fortigate devices, providing hourly insights into session count, data sent and data received by device actions, destination hostname, source and destination IP addresses.'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: FortinetFortigateWebSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Fortinet"
13+
and DeviceProduct startswith "Fortigate"
14+
and Activity has_all ('webfilter', 'utm')
15+
// You can customize the summary table by adding or removing fields based on your requirement.
16+
| summarize Count = count(), SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by SourceIP, DestinationIP, DestinationPort, DestinationHostName, DeviceAction, bin(TimeGenerated,1h)
17+
binSize: 60
18+
version: 1.0.0
19+
metadata:
20+
source:
21+
kind: Community
22+
author:
23+
name: Microsoft
24+
support:
25+
tier: Community
26+
categories:
27+
domains: [ "Security - Network" ]

‎Summary rules/WebSession/PaloAltoPANOSWebSessionIPSummary.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
id: 1ccf0f4e-4f5d-4a46-819b-5ba857394f2a
2+
displayName: Palo Alto PAN-OS WebSession IPSummary
3+
description: |
4+
'This summary rule aggregates web session logs from Palo Alto PAN-OS devices, providing hourly insights into session count, data sent, data received by device actions, sourceUserName, destination hostname, source and destination IP addresses.'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: PaloAltoPANOSWebSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Palo Alto Networks"
13+
and DeviceProduct == "PAN-OS"
14+
and Activity == "THREAT"
15+
and DeviceEventClassID == "url"
16+
// You can customize the summary table by adding or removing fields based on your requirement.
17+
| summarize Count = count(), SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by SourceIP, SourceUserName, DestinationIP, DestinationHostName, DeviceAction, bin(TimeGenerated,1h)
18+
binSize: 60
19+
version: 1.0.0
20+
metadata:
21+
source:
22+
kind: Community
23+
author:
24+
name: Microsoft
25+
support:
26+
tier: Community
27+
categories:
28+
domains: [ "Security - Network" ]

‎Summary rules/WebSession/ZscalarWebSessionIPSummary.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: b45e1d40-58c0-4f6c-83f0-1019c9237cb4
2+
displayName: Zscaler Internet Access WebSession IP Summary
3+
description: |
4+
'This summary rule aggregates web session logs from Zscaler Internet Access devices, providing hourly insights into session count, data sent and data received by device action, destination hostname, source and destination IP addresses .'
5+
requiredDataConnectors:
6+
- connectorId: CefAma
7+
dataTypes:
8+
- CommonSecurityLog
9+
destinationTable: ZscalerWebSessionSummary_CL
10+
query: |
11+
CommonSecurityLog
12+
| where DeviceVendor == "Zscaler"
13+
| where DeviceProduct == "NSSWeblog"
14+
// You can customize the summary table by adding or removing fields based on your requirement.
15+
| summarize Count = count(), SentBytes = sum(SentBytes), ReceivedBytes = sum(ReceivedBytes) by SourceIP, DestinationIP, DestinationHostName, DeviceAction, bin(TimeGenerated,1h)
16+
binSize: 60
17+
version: 1.0.0
18+
metadata:
19+
source:
20+
kind: Community
21+
author:
22+
name: Microsoft
23+
support:
24+
tier: Community
25+
categories:
26+
domains: [ "Security - Network" ]

0 commit comments

Comments
 (0)