{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "
Azure CloudNGFW By Palo Alto Networks - Overview
" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a5c18655-3e2d-4d12-8ba4-82e57b296581", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } }, { "id": "32f5a8aa-9c54-4fd1-a2b9-8461b2c57f55", "version": "KqlParameterItem/1.0", "name": "Source_IP", "label": "Source IP", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s in ('TRAFFIC', 'DECRYPTION', 'THREAT')\n| extend SourceIP = tostring(parse_json(Message).src_ip)\n| summarize Count = count()/1000 by SourceIP\n| where SourceIP != \"\"\n| order by Count desc, SourceIP asc\n| project Value = SourceIP, Label = strcat(SourceIP, \" - \", Count, \"k\"), Selected = false\n", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All" }, "timeContext": { "durationMs": 1800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b937ca33-bc62-4183-bc0f-9ad8306dc36a", "version": "KqlParameterItem/1.0", "name": "Destination_IP", "label": "Destination IP", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s in ('TRAFFIC', 'DECRYPTION', 'THREAT')\n| extend DestinationIP = case(ident_s == 'DECRYPTION', tostring(parse_json(Message).dst), tostring(parse_json(Message).dst_ip))\n| summarize Count = count()/1000 by DestinationIP\n| where DestinationIP != \"\"\n| order by Count desc, DestinationIP asc\n| project Value = DestinationIP, Label = strcat(DestinationIP, \" - \", Count, \"k\"), Selected = false", "value": [ "value::all" ], "typeSettings": { "limitSelectTo": 10, "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7f28bae3-a11f-408a-832f-77a0f3e633d7", "version": "KqlParameterItem/1.0", "name": "EventClass", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where isnotempty(message.sub_type)\n| distinct tostring(message.sub_type)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "spyware", "vulnerability" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 35" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\" == \"All\" or message.dst in ({Destination_IP})\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where \"{EventClass:label}\" == \"All\" or \"{EventClass:label}\" == \"All\" or message.sub_type in ({EventClass});\ndata\n| summarize Count = count() by tostring(message.sub_type)\n| join kind = inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by tostring(message.sub_type))\non message_sub_type\n| project-away message_sub_type1, TimeGenerated\n| extend Activities = message_sub_type\n| union (\ndata \n | summarize Count = count() \n | extend jkey = 1\n | join kind=inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1) on jkey\n | extend message_sub_type = 'All', Activities = 'Total' \n)\n| order by Count desc\n| take 10", "size": 4, "title": "Activities, by volume", "timeContextFromParameter": "TimeRange", "exportFieldName": "Activities", "exportParameterName": "activities", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "blueDark", "showIcon": true } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "lightBlue", "showIcon": true } }, { "columnMatch": "Activities", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "jkey", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "TimeGenerated", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "jkey1", "formatter": 5, "formatOptions": { "showIcon": true } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Activities", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false } }, "name": "all activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP})\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where \"{EventClass}\" == \"All\" or message.sub_type in ({EventClass})\n| summarize LogVolume=count() by tostring(message.sub_type), bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})", "size": 0, "aggregation": 3, "title": "Event trend, by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "threat_content_type", "formatter": 1 }, "leftContent": { "columnMatch": "LogVolume", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "Event trend by time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//trend by severity\r\nfluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| where ident_s =~ 'THREAT'\r\n| extend message = parse_json(Message)\r\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \r\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\r\n| where \"{EventClass:lable}\" == \"All\" or ident_s == 'THREAT' and message.sub_type in ({EventClass})\r\n| where \"{EventClass}\" == \"All\" or message.sub_type in ({EventClass})\r\n| summarize count() by bin_at(TimeGenerated, {TimeRange:grain},{TimeRange:start}), tostring(message.severity)\r\n", "size": 0, "title": "Events severity, by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Message.severity", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Message.severity", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "Events severity over time" }, { "type": 1, "content": { "json": "---\r\n### Traffic events summary" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = fluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| where ident_s =~ 'THREAT'\r\n| extend message = parse_json(Message)\r\n| where \"{Destination_IP:label}\" == \"All\" or message.dst in ({Destination_IP}) \r\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP});\r\ndata\r\n| summarize Count = count() by tostring(message.sub_type)\r\n| join kind = inner (data\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by tostring(message.sub_type))\r\n on message_sub_type\r\n| project-away message_sub_type1, TimeGenerated\r\n| extend message_sub_types = message_sub_type\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend message_sub_type = 'All', message_sub_types = 'Total' \r\n)\r\n| order by Count desc\r\n| take 10", "size": 4, "title": "Threat event type summary", "timeContextFromParameter": "TimeRange", "exportFieldName": "message_sub_type", "exportParameterName": "EventClass", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "message_sub_type", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false } }, "customWidth": "100", "name": "Threat event summary" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = fluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| extend message = parse_json(Message)\r\n| where \"{Destination_IP:label}\" == \"All\" or message.dst in ({Destination_IP}) \r\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP});\r\ndata\r\n| summarize Count = count() by tostring(message.action)\r\n| join kind = inner (data\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by tostring(message.action))\r\n on message_action\r\n| project-away message_action1, TimeGenerated\r\n| extend message_actions = message_action\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend message_action = 'All', message_actions = '*' \r\n)\r\n| order by Count desc\r\n| take 10", "size": 4, "title": "Traffic action summary", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blueDark", "showIcon": true } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blueDark", "showIcon": true } }, { "columnMatch": "jkey", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "TimeGenerated", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "jkey1", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "message_actions", "formatter": 5, "formatOptions": { "showIcon": true } } ] }, "tileSettings": { "titleContent": { "columnMatch": "message_action", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9 }, "showBorder": false, "size": "auto" } }, "customWidth": "100", "name": "Traffic activity summary" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e25d603d-5f93-4330-a519-1781a9d36eb0", "version": "KqlParameterItem/1.0", "name": "DeviceAction", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| extend message = parse_json(Message)\n| where isnotempty(message.sub_type)\n| distinct tostring(message.action)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 35 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ \"THREAT\"\n| extend message = parse_json(Message)\n| where isempty(message.url_idx)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where \"{DeviceAction:label}\" == \"All\" or message.action in ({DeviceAction})\n| summarize EventCount= count() by tostring(message.threat_category), bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})", "size": 0, "title": "Threat category by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "100", "name": "Threat category by time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| where ident_s =~ 'TRAFFIC'\r\n| extend message = parse_json(Message)\r\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \r\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\r\n| summarize DataSentMB=sum(todouble(message.bytes_sent)/1048576), DataRecievedMB=sum(todouble(message.bytes_recv)/1048576) by TimeGenerated\r\n", "size": 0, "title": "Sent and received data, by volume", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "graphSettings": { "type": 0 } }, "customWidth": "100", "name": "Sent and received data by volume" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ \"TRAFFIC\"\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\" == \"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| extend Reason = coalesce(tostring(message.session_end_reason), \"Unknown\")\n| summarize ReasonCount = count() by Reason, bin(TimeGenerated, 1h)\n", "size": 0, "title": "Reasons for session ending, by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "100", "name": "Reasons for session ending" }, { "type": 1, "content": { "json": "---\r\n## Web filter" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| where ident_s == 'THREAT'\r\n| extend message = parse_json(Message)\r\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \r\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\r\n| where isnotempty(message.url_category_list)\r\n| where message.action contains 'block'\r\n| summarize Count=count() by tostring(message.url_filename), tostring(message.proto) \r\n| top 5 by Count desc\r\n", "size": 0, "title": "Top 5 blocked URLs, by application protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "ProtocolCount", "formatter": 4, "formatOptions": { "min": 0, "palette": "purple", "showIcon": true } } ] } }, "customWidth": "33", "name": "Top 5 blocked URLs by application protocol" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action in ('block-url', 'block-continue')\n| summarize Count=count() by tostring(message.url_filename), tostring(message.url_category_list)\n| project-rename CategoryName= message_url_category_list\n| top 5 by Count\n", "size": 0, "title": "Top 5 URL blocked, by category", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CategoryCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "33", "name": "Top 5 URL blocked by category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action in ('block-url', 'block-continue')\n| summarize Count=count() by tostring(message.url_filename)\n| top 5 by Count desc\n", "size": 0, "title": "Top 5 blocked URLs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Top 5 blocked URLs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| summarize Count=count() by tostring(message.url_filename), tostring(message.proto)\n| top 5 by Count desc", "size": 0, "title": "Top 5 URLs, by application protocols", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "ProtocolCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "50", "name": "Top 5 URLs by application protocols" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\" == \"All\" or message.dst in ({Destination_IP})\n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action in ('alert', 'continue')\n| summarize Count=count() by tostring(message.url_filename)\n| top 5 by Count desc\n", "size": 0, "title": "Top 5 allowed URLs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "URLCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "50", "name": "Top 5 allowed URLs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action in ('alert', 'continue')\n| summarize Count=count() by tostring(message.url_filename), tostring(message.url_category_list)\n| project-rename CategoryName= message_url_category_list\n| top 5 by Count desc\n", "size": 0, "title": "Top 5 allowed URLs, by category", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CategoryCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "33", "name": "Top 5 allowed URLs, by category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| summarize ActionCount=count() by tostring(message.action)\n", "size": 0, "title": "URL threat event summary", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ActionCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "message_action", "formatter": 1 }, "leftContent": { "columnMatch": "ActionCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "message_action", "formatter": 1 }, "centerContent": { "columnMatch": "ActionCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "ActionCount", "sizeAggregation": "Sum", "legendMetric": "ActionCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "ActionCount", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "URL threat event summary" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:lable}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:lable}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action !contains 'block'\n| summarize ProtocolCount=count() by tostring(message.proto)\n| top 5 by ProtocolCount desc", "size": 0, "title": "Top 5 allowed URLs, by application protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ProtocolCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "25", "name": "Top 5 allowed URLs by application protocol" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action !contains 'block'\n| summarize ProtocolCount=count() by tostring(message.url_filename), tostring(message.proto)\n| top 5 by ProtocolCount desc", "size": 0, "title": "Top 5 allowed URLs, by application protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ProtocolCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "50", "name": "Top 5 allowed URLs by application protocol" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| where message.action in ('alert', 'continue')\n| summarize IPCount=count() by tostring(message.src_ip)\n| top 5 by IPCount desc\n", "size": 0, "title": "Top 5 allowed web traffic source IP addresses", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IPCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "50", "name": "Top 5 allowed web traffic source IP addresses" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where \"{Destination_IP:label}\"==\"All\" or message.dst in ({Destination_IP}) \n| where \"{Source_IP:label}\" == \"All\" or message.src_ip in ({Source_IP})\n| where isnotempty(message.url_category_list)\n| summarize ActionCount=count() by tostring(message.action), TimeGenerated\n", "size": 0, "title": "Web filter activity, by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "ActionCount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "customWidth": "100", "name": "Web filter activity by time" } ], "fromTemplateId": "sentinel-PaloAltoOverview", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }