{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbooks_c9764937_d65f_4a32_84d3_74c6789ee486_name": {
            "defaultValue": "c9764937-d65f-4a32-84d3-74c6789ee486",
            "type": "String"
        },
        "workspaces_cybersecuritysoc_externalid": {
            "defaultValue": "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/microsoft.operationalinsights/workspaces/cybersecuritysoc",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/workbooks",
            "apiVersion": "2018-06-17-preview",
            "name": "[parameters('workbooks_c9764937_d65f_4a32_84d3_74c6789ee486_name')]",
            "location": "eastus",
            "tags": {
                "hidden-title": "Azure Firewall"
            },
            "kind": "shared",
            "identity": {
                "type": "None"
            },
            "properties": {
                "displayName": "Azure Firewall",
                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Azure Firewall Workbook\\r\\n---\\r\\n\"},\"name\":\"text - 23\"},{\"type\":1,\"content\":{\"json\":\"### Change Log\\r\\n|Version|Description|\\r\\n|---|---|\\r\\n|v1.0\\t|Initial Version|\\r\\n|V1.1.0\\t|Split up the data sets, Overview, Application Rule Logs, Network Rule Logs, DNS Proxy Logs. Added in Investigation visibility with Azure Firewall + Azure Graph. Added in visibility to multiple workspaces and filtering to Firewall resources. |\\r\\n|V1.2.0 | Added Azure Firewall Premium features, IDPS/WebTraffic/Overview logging.\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"EditOnly\"},\"name\":\"text - 40\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"20847ce8-91bc-4d8b-b878-a5a41c95c31c\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall Overview\",\"subTarget\":\"AFOverview\",\"preText\":\"Azure Firewall Overview\",\"style\":\"link\"},{\"id\":\"f564709d-1658-46a1-8b44-892210e13017\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall - Application rule log statistics\",\"subTarget\":\"AFAppRule\",\"style\":\"link\"},{\"id\":\"1f6661e2-f873-4d56-879d-4d085d8cf1d4\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall - Network rule log statistics\",\"subTarget\":\"AFNetRule\",\"style\":\"link\"},{\"id\":\"ef1548c5-ef55-4eaa-8a81-b049cb93b56c\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall - DNS Proxy\",\"subTarget\":\"AFDNSProxy\",\"style\":\"link\"},{\"id\":\"18a4a585-2176-4d9f-907c-8e8d5f984efa\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall Premium - IDPS\",\"subTarget\":\"AFIDSIPS\",\"style\":\"link\"},{\"id\":\"97dc7364-961d-4c19-a730-7b9024f46b91\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Azure Firewall - Investigation\",\"subTarget\":\"AFInvestigate\",\"style\":\"link\"}]},\"name\":\"links - 24\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::selected\"],\"parameters\":[{\"id\":\"ab7d6c51-d7df-436c-96a2-429163aa50ec\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1209600000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"add90eb3-ff5f-4b19-9658-ff15c8043af5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspaces\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id, name\\r\\n| order by name desc\",\"crossComponentResources\":[\"value::selected\"],\"value\":[\"/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecuritySoc\",\"/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::100\"]},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"5084e141-6c56-4d7f-bd8a-09f7ef9af1bc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Resource\",\"label\":\"Azure Firewalls\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'Microsoft.Network/azureFirewalls'\\r\\n| project id, name\",\"crossComponentResources\":[\"value::selected\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1\"},{\"type\":1,\"content\":{\"json\":\"# Azure Firewall - overview\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"Main title\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\" \\r\\n| summarize Volume=count() by bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"title\":\"Events, by time\",\"noDataMessage\":\"There are no firewall events being feed within the selected workspaces. If you believe the selection is correct, confirm logging has been enabled for the Azure Firewall and feeding into the selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":4,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"query - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\" \\r\\n| summarize Volume=count() by Resource, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"title\":\"Events, by firewall over time\",\"noDataMessage\":\"There are no firewall events being feed within the selected workspaces. If you believe the selection is correct, confirm logging has been enabled for the Azure Firewall and feeding into the selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":4,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"TopEvent\",\"exportDefaultValue\":\"{\\\"Resource\\\":\\\"*\\\",\\\"ResourceGroup\\\":\\\"*\\\"}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"linechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Resource\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"amount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":true}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"Firewall per Resource Group\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFTI = AzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| summarize Volume=count() by OperationName\\r\\n| project Category=OperationName, Volume;\\r\\nlet AFIDSIPS = AzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| summarize Volume=count() by OperationName\\r\\n| project Category=OperationName, Volume;\\r\\nAzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| summarize Volume=count() by Category\\r\\n| union AFTI, AFIDSIPS\",\"size\":0,\"title\":\"Events, by category\",\"noDataMessage\":\"There are no firewall events being feed within the selected workspaces. If you believe the selection is correct, confirm logging has been enabled for the Azure Firewall and feeding into the selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":4,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Category\",\"exportParameterName\":\"SelectedCategory\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Category\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Volume\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"Events by category\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFTI = AzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| summarize Volume=count() by OperationName, bin(TimeGenerated, {TimeRange:grain})\\r\\n| project Category=OperationName, Volume, TimeGenerated;\\r\\nlet AFIDSIPS = AzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| summarize Volume=count() by OperationName, bin(TimeGenerated, {TimeRange:grain})\\r\\n| project Category=OperationName, Volume, TimeGenerated;\\r\\nAzureDiagnostics \\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| summarize Volume=count() by Category, bin(TimeGenerated, {TimeRange:grain})\\r\\n| union AFTI, AFIDSIPS\",\"size\":0,\"title\":\"Events categories, by time\",\"noDataMessage\":\"There are no firewall events being feed within the selected workspaces. If you believe the selection is correct, confirm logging has been enabled for the Azure Firewall and feeding into the selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":4,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"Events categories by time\"},{\"type\":1,\"content\":{\"json\":\"### Firewall Metrics\\r\\nThe data below dosen't read from the Log Analytics workpsace, it's reading directly from the resources which requires resource visibility. \\r\\nClick [here for more information on Azure Metrics](https://docs.microsoft.com/azure/azure-monitor/platform/data-platform-metrics)\\r\\n\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"text - 39\"},{\"type\":10,\"content\":{\"chartId\":\"workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceType\":\"microsoft.network/azurefirewalls\",\"metricScope\":0,\"resourceParameter\":\"Resource\",\"resourceIds\":[\"{Resource}\"],\"timeContextFromParameter\":\"TimeRange\",\"timeContext\":{\"durationMs\":2592000000},\"metrics\":[{\"namespace\":\"microsoft.network/azurefirewalls\",\"metric\":\"microsoft.network/azurefirewalls--Throughput\",\"aggregation\":4,\"splitBy\":null,\"columnName\":\"All Firewall Throughput Average\"}],\"title\":\"Average Throughput of Firewall Traffic\",\"gridSettings\":{\"rowLimit\":10000}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"metric - 25\"},{\"type\":10,\"content\":{\"chartId\":\"workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceType\":\"microsoft.network/azurefirewalls\",\"metricScope\":0,\"resourceParameter\":\"Resource\",\"resourceIds\":[\"{Resource}\"],\"timeContextFromParameter\":\"TimeRange\",\"timeContext\":{\"durationMs\":2592000000},\"metrics\":[{\"namespace\":\"microsoft.network/azurefirewalls\",\"metric\":\"microsoft.network/azurefirewalls--SNATPortUtilization\",\"aggregation\":4,\"splitBy\":null}],\"title\":\"SNAT Port Utilization\",\"gridSettings\":{\"rowLimit\":10000}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"metric - 25 - Copy\"},{\"type\":10,\"content\":{\"chartId\":\"workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceType\":\"microsoft.network/azurefirewalls\",\"metricScope\":0,\"resourceParameter\":\"Resource\",\"resourceIds\":[\"{Resource}\"],\"timeContextFromParameter\":\"TimeRange\",\"timeContext\":{\"durationMs\":2592000000},\"metrics\":[{\"namespace\":\"microsoft.network/azurefirewalls\",\"metric\":\"microsoft.network/azurefirewalls--NetworkRuleHit\",\"aggregation\":1,\"splitBy\":null}],\"title\":\"Network Rule Hitcount (SUM)\",\"gridSettings\":{\"rowLimit\":10000}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"metric - 25 - Copy - Copy\"},{\"type\":10,\"content\":{\"chartId\":\"workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceType\":\"microsoft.network/azurefirewalls\",\"metricScope\":0,\"resourceParameter\":\"Resource\",\"resourceIds\":[\"{Resource}\"],\"timeContextFromParameter\":\"TimeRange\",\"timeContext\":{\"durationMs\":2592000000},\"metrics\":[{\"namespace\":\"microsoft.network/azurefirewalls\",\"metric\":\"microsoft.network/azurefirewalls--ApplicationRuleHit\",\"aggregation\":1,\"splitBy\":null}],\"title\":\"Application Rule Hitcount (SUM)\",\"gridSettings\":{\"rowLimit\":10000}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFOverview\"},\"name\":\"metric - 25 - Copy - Copy - Copy\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n# Azure Firewall - Application rule log statitics\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ActivityData = AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails\\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1\\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" *\\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a\\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b\\r\\n| extend SourcePort = tostring(SourcePortInt)\\r\\n| extend TargetPort = tostring(TargetPortInt)\\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\")\\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)\\r\\n| where Action == \\\"Deny\\\";\\r\\nActivityData\\r\\n| summarize Amount=count() by SourceIP\\r\\n| join kind = inner\\r\\n(\\r\\n    ActivityData\\r\\n    | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP) on SourceIP\\r\\n    | project-away SourceIP1, TimeGenerated\\r\\n    | top 10 by Amount\\r\\n    | sort by Amount\",\"size\":1,\"title\":\"Unique Source IP addresses, filterable by SelectedSourceIP\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"SelectedSourceIP\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Amount\",\"formatter\":12,\"formatOptions\":{\"showIcon\":true}},\"subtitleContent\":{\"columnMatch\":\"SourceIP\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory;\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory;\\r\\nlet AFApp = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where msg_s !contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| where Resource in~ (split(\\\"CH1-FW, CH1-FW-Dev, FW-PREM, SOC-NS-FW\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt: int \\\" \\\" TempDetails \\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt: int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b\\r\\n| parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\\r\\n| parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\\r\\n| extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S), SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt)\\r\\n| extend Action1 = case(Action1 == \\\"denied\\\", \\\"Deny\\\", \\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\", Action1, Action2), Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\", case(Rule2b == \\\"\\\", \\\" default action\\\", Rule2b), Rule1), Rule2a), RuleCollection = case(RuleCollection2b == \\\"\\\", case(RuleCollection2a == \\\"\\\", \\\"No rule matched\\\", RuleCollection2a), RuleCollection2b), FQDN = case(FQDN == \\\"\\\", \\\" default action\\\", FQDN), TargetPort = case(TargetPort == \\\"\\\", \\\" default action\\\", TargetPort);\\r\\nunion AFApp, AFAppUrl, AFAppWOUrl\\r\\n| summarize Count = count(), last_log = datetime_diff(\\\"second\\\",now(), max(TimeGenerated)) by RuleCollection, Rule, WebCategory\\r\\n\\r\\n\\r\\n\",\"size\":1,\"title\":\"Application Rule Usage\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}},{\"columnMatch\":\"last_log\",\"formatter\":8,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":24,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 36\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics | where Category == \\\"AzureFirewallApplicationRule\\\" \\r\\n| where Resource in (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails | parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 | parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * | parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a | parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b | extend SourcePort = tostring(SourcePortInt) | extend TargetPort = tostring(TargetPortInt) | extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") | extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)| where Action == \\\"Deny\\\"\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by FQDN, bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Denied FQDN's over time\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\",\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails \\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b \\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt) \\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)\\r\\n| where Action == \\\"Deny\\\"\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by FQDN\\r\\n| sort by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Denied FQDN's by count\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails \\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b \\r\\n| extend SourcePort = tostring(SourcePortInt)\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"   \\r\\n| extend TargetPort = tostring(TargetPortInt)\\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort) \\r\\n| where Action == \\\"Allow\\\"\\r\\n| summarize count() by FQDN, bin(TimeGenerated,{TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"Allowed FQDN's over time\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\" \\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails | parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 | parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * | parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a | parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b | extend SourcePort = tostring(SourcePortInt) | extend TargetPort = tostring(TargetPortInt) | extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") | extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort) | where Action == \\\"Allow\\\"\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"   \\r\\n| summarize count() by FQDN\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Allowed FQDN's by count\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]},\"sortBy\":[]},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Allow\\\";\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Allow\\\";\\r\\nunion AFAppUrl, AFAppWOUrl\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by WebCategory, bin(TimeGenerated,{TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"Allowed Web Categories over time\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 5 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Allow\\\";\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Allow\\\";\\r\\nunion AFAppUrl, AFAppWOUrl\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by WebCategory\\r\\n\",\"size\":0,\"title\":\"Allowed Web Categories by count\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 5 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Deny\\\";\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Deny\\\";\\r\\nunion AFAppUrl, AFAppWOUrl\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by WebCategory, bin(TimeGenerated,{TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"Denied Web Categories over time\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 5 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Deny\\\";\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory\\r\\n| where Action == \\\"Deny\\\";\\r\\nunion AFAppUrl, AFAppWOUrl\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize count() by WebCategory\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Denied Web Catgories by count\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]},\"sortBy\":[]},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AFAppUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\" and msg_s contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Url:\\\" Url \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory;\\r\\nlet AFAppWOUrl = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where msg_s contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" FQDN \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection:\\\" RuleCollection \\\". Rule:\\\" Rule \\\". Web Category:\\\" WebCategory;\\r\\nlet AFApp = AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where msg_s !contains \\\"Web Category:\\\"\\r\\n| where msg_s !contains \\\". Url\\\"\\r\\n| where Resource in~ (split(\\\"CH1-FW, CH1-FW-Dev, FW-PREM, SOC-NS-FW\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt: int \\\" \\\" TempDetails \\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt: int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b\\r\\n| parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\\r\\n| parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\\r\\n| extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S), SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt)\\r\\n| extend Action1 = case(Action1 == \\\"denied\\\", \\\"Deny\\\", \\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\", Action1, Action2), Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\", case(Rule2b == \\\"\\\", \\\" default action\\\", Rule2b), Rule1), Rule2a), RuleCollection = case(RuleCollection2b == \\\"\\\", case(RuleCollection2a == \\\"\\\", \\\"No rule matched\\\", RuleCollection2a), RuleCollection2b), FQDN = case(FQDN == \\\"\\\", \\\" default action\\\", FQDN), TargetPort = case(TargetPort == \\\"\\\", \\\" default action\\\", TargetPort);\\r\\nunion AFApp, AFAppUrl, AFAppWOUrl\\r\\n| where '{SelectedSourceIP}' == SourceIP or '{SelectedSourceIP}' == \\\"*\\\"  \\r\\n| summarize by TimeGenerated, FQDN, Protocol, Action, SourceIP, SourcePort, TargetPort, SourceHost , DestinationPort , ResourceId , ResourceGroup , RuleCollection, Rule, WebCategory, SubscriptionId\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"All IP addresses events\",\"noDataMessage\":\"There are no Application Rule logs within the selected workspaces. If you believe the selection is correct, confirm Application Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFAppRule\"},\"name\":\"query - 9\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n# Azure Firewall - Network rule log statistics\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination \\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action:\\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", case(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", Protocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),TargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),SourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),NatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)  \\r\\n| summarize count() by Action\",\"size\":3,\"title\":\"Rule actions, filterable by RuleAction\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"RuleAction\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination \\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action: \\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", case(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", Protocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),TargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),SourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort), NatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)  \\r\\n| summarize Count=count() by TargetPort\",\"size\":3,\"title\":\"Target ports, filterable by TargetPort\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"TargetPort\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action:\\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", \\r\\ncase(Action1b == \\\"\\\",Action2,Action1b), Action1a),\\r\\nProtocol = case(Protocol == \\\"\\\", Protocol2, Protocol),\\r\\nSourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),\\r\\nTargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),\\r\\nSourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),\\r\\nTargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),\\r\\nNatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)  \\r\\n| where Action == \\\"DNAT'ed\\\"\\r\\n| summarize Amount=count() by NatDestination\\r\\n\",\"size\":3,\"title\":\"DNAT actions, filterable by NatDestination\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"NatDestination\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action:\\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", \\r\\ncase(Action1b == \\\"\\\",Action2,Action1b), Action1a),\\r\\nProtocol = case(Protocol == \\\"\\\", Protocol2, Protocol),\\r\\nSourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),\\r\\nTargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),\\r\\nSourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),\\r\\nTargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),\\r\\nNatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)\\r\\n//| extend Action = iif(Action contains \\\"DNAT'ed\\\", Action=\\\"Nah\\\", Action)\\r\\n| where '{TargetPort}' == TargetPort or '{TargetPort}' == \\\"*\\\"\\r\\n| where \\\"{RuleAction}\\\" == Action or \\\"{RuleAction}\\\" == \\\"*\\\"\\r\\n| where '{NatDestination}' == NatDestination or '{NatDestination}' == \\\"*\\\" \\r\\n| summarize amount = count() by Action , SourceIP\\r\\n| sort by amount desc\",\"size\":0,\"title\":\"Rule actions, by IP addresses\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":5},{\"columnMatch\":\"amount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumSignificantDigits\":4}}},{\"columnMatch\":\"eventCount\",\"formatter\":3,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Action\"],\"expandTopLevel\":false,\"finalBy\":\"Action\"}}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination \\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action: \\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", \\r\\ncase(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", \\r\\nProtocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),\\r\\nTargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),\\r\\nSourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),\\r\\nTargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort), \\r\\nNatDestination = case(NatDestination == \\\"\\\", \\r\\n\\\"N/A\\\", NatDestination)\\r\\n| where '{TargetPort}' == TargetPort or '{TargetPort}' == \\\"*\\\"\\r\\n| where \\\"{RuleAction}\\\" == Action or \\\"{RuleAction}\\\" == \\\"*\\\"\\r\\n| where '{NatDestination}' == NatDestination or '{NatDestination}' == \\\"*\\\"   \\r\\n| summarize AMOUNT=count() by TargetPort, SourceIP\\r\\n| sort by AMOUNT desc\",\"size\":0,\"title\":\"Target ports, by Source IP\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TargetPort\",\"formatter\":5},{\"columnMatch\":\"AMOUNT\",\"formatter\":3,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}],\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"TargetPort\"],\"finalBy\":\"TargetPort\"}}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to \\\" TargetIP \\\":\\\" TargetPortInt:int * \\r\\n| parse msg_s with * \\\". Action: \\\" Action1a \\r\\n| parse msg_s with * \\\"was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from \\\" SourceIP2 \\\" to \\\" TargetIP2 \\\". Action:\\\" Action2 \\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\r\\n| extend Action = case(Action1a == \\\"\\\", \\r\\ncase(Action1b == \\\"\\\",Action2,Action1b), Action1a),\\r\\nProtocol = case(Protocol == \\\"\\\", Protocol2, Protocol),\\r\\nSourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),\\r\\nTargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),\\r\\nSourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),\\r\\nTargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),\\r\\nNatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)  \\r\\n| where Action == \\\"DNAT'ed\\\"\\r\\n| where '{TargetPort}' == TargetPort or '{TargetPort}' == \\\"*\\\"\\r\\n| where \\\"{RuleAction}\\\" == Action or \\\"{RuleAction}\\\" == \\\"*\\\"\\r\\n| where '{NatDestination}' == NatDestination or '{NatDestination}' == \\\"*\\\"\\r\\n| summarize Amount=count() by NatDestination, TimeGenerated\\r\\n\",\"size\":0,\"title\":\"DNAT'ed over time\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from\\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to\\\" TargetIP \\\":\\\" TargetPortInt:int *\\r\\n| parse msg_s with * \\\". Action: \\\" Action1a\\r\\n| parse msg_s with * \\\" was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from\\\" SourceIP2 \\\" to\\\" TargetIP2 \\\". Action:\\\" Action2\\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt)\\r\\n| extend Action = case(Action1a == \\\"\\\", case(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", Protocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),TargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),SourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),NatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)\\r\\n| where '{TargetPort}' == TargetPort or '{TargetPort}' == \\\"*\\\"\\r\\n| where \\\"{RuleAction}\\\" == Action or \\\"{RuleAction}\\\" == \\\"*\\\"\\r\\n| where '{NatDestination}' == NatDestination or '{NatDestination}' == \\\"*\\\"\\r\\n| summarize count() by Action, bin(TimeGenerated, {TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"Actions, by time\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"ActionsByTimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from\\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to\\\" TargetIP \\\":\\\" TargetPortInt:int *\\r\\n| parse msg_s with * \\\". Action: \\\" Action1a\\r\\n| parse msg_s with * \\\" was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from\\\" SourceIP2 \\\" to\\\" TargetIP2 \\\". Action:\\\" Action2\\r\\n| parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\\r\\n| parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\\r\\n| extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S),SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt)\\r\\n| extend Action = case(Action1a == \\\"\\\", case(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", Protocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),TargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),SourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),NatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)\\r\\n| where '{TargetPort}' == TargetPort or '{TargetPort}' == \\\"*\\\"\\r\\n| where \\\"{RuleAction}\\\" == Action or \\\"{RuleAction}\\\" == \\\"*\\\"\\r\\n| where '{NatDestination}' == NatDestination or '{NatDestination}' == \\\"*\\\"\\r\\n| summarize by TimeGenerated,Protocol, Action, SourcePort, TargetPort, SourceHost , DestinationHost , DestinationPort , NatDestination, ResourceId , ResourceGroup , SubscriptionId\",\"size\":0,\"showAnalytics\":true,\"title\":\"All IP addresses events\",\"noDataMessage\":\"There are no Network Rule logs within the selected workspaces. If you believe the selection is correct, confirm Network Rule logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"ActionsByTimeBrush\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFNetRule\"},\"name\":\"query - 22\"},{\"type\":1,\"content\":{\"json\":\"# Azure Firewall -DNS Proxy\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"text - 41\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallDnsProxy\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with \\\"DNS Request: \\\" ClientIP \\\":\\\" ClientPort \\\" - \\\" QueryID \\\" \\\" Request_Type \\\" \\\" Request_Class \\\" \\\" Request_Name \\\". \\\" Request_Protocol \\\" \\\" Request_Size \\\" \\\" EDNSO_DO \\\" \\\" EDNS0_Buffersize \\\" \\\" Responce_Code \\\" \\\" Responce_Flags \\\" \\\" Responce_Size \\\" \\\" Response_Duration\\r\\n| project-away msg_s\\r\\n| summarize count() by Resource, bin(TimeGenerated,{TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"DNSProxy Traffic by count per Firewall\",\"noDataMessage\":\"There are no DNS Proxy logs within the selected workspaces. If you believe the selection is correct, confirm DNS Proxy logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"DNSTimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"linechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"query - 30 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallDnsProxy\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with \\\"DNS Request: \\\" ClientIP \\\":\\\" ClientPort \\\" - \\\" QueryID \\\" \\\" Request_Type \\\" \\\" Request_Class \\\" \\\" Request_Name \\\". \\\" Request_Protocol \\\" \\\" Request_Size \\\" \\\" EDNSO_DO \\\" \\\" EDNS0_Buffersize \\\" \\\" Responce_Code \\\" \\\" Responce_Flags \\\" \\\" Responce_Size \\\" \\\" Response_Duration\\r\\n| project-away msg_s\\r\\n| summarize count() by Request_Name\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"DNSProxy count by Request Name, filterable by Request_Name\",\"noDataMessage\":\"There are no DNS Proxy logs within the selected workspaces. If you believe the selection is correct, confirm DNS Proxy logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"DNSTimeBrush\",\"exportFieldName\":\"Request_Name\",\"exportParameterName\":\"DNSRequestName\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"query - 30 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallDnsProxy\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with \\\"DNS Request: \\\" ClientIP \\\":\\\" ClientPort \\\" - \\\" QueryID \\\" \\\" Request_Type \\\" \\\" Request_Class \\\" \\\" Request_Name \\\". \\\" Request_Protocol \\\" \\\" Request_Size \\\" \\\" EDNSO_DO \\\" \\\" EDNS0_Buffersize \\\" \\\" Responce_Code \\\" \\\" Responce_Flags \\\" \\\" Responce_Size \\\" \\\" Response_Duration\\r\\n| project-away msg_s\\r\\n| where '{DNSRequestName}' == Request_Name or '{DNSRequestName}' == \\\"*\\\"\\r\\n| summarize count() by ClientIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"DNSProxy Request count by ClientIP, filterable by ClientIP\",\"noDataMessage\":\"There are no DNS Proxy logs within the selected workspaces. If you believe the selection is correct, confirm DNS Proxy logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"DNSTimeBrush\",\"exportFieldName\":\"ClientIP\",\"exportParameterName\":\"DNSClientIP\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"query - 30 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallDnsProxy\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with \\\"DNS Request: \\\" ClientIP \\\":\\\" ClientPort \\\" - \\\" QueryID \\\" \\\" Request_Type \\\" \\\" Request_Class \\\" \\\" Request_Name \\\". \\\" Request_Protocol \\\" \\\" Request_Size \\\" \\\" EDNSO_DO \\\" \\\" EDNS0_Buffersize \\\" \\\" Responce_Code \\\" \\\" Responce_Flags \\\" \\\" Responce_Size \\\" \\\" Response_Duration\\r\\n| project-away msg_s\\r\\n| where '{DNSClientIP}' == ClientIP or '{DNSClientIP}' == \\\"*\\\"\\r\\n| where '{DNSRequestName}' == Request_Name or '{DNSRequestName}' == \\\"*\\\"\\r\\n| summarize count() by ClientIP, bin(TimeGenerated, {TimeRange:grain})\\r\\n\",\"size\":0,\"title\":\"DNS Proxy Request over time by ClientIP\",\"noDataMessage\":\"There are no DNS Proxy logs within the selected workspaces. If you believe the selection is correct, confirm DNS Proxy logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"DNSTimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"linechart\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"query - 30 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallDnsProxy\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with \\\"DNS Request: \\\" ClientIP \\\":\\\" ClientPort \\\" - \\\" QueryID \\\" \\\" Request_Type \\\" \\\" Request_Class \\\" \\\" Request_Name \\\". \\\" Request_Protocol \\\" \\\" Request_Size \\\" \\\" EDNSO_DO \\\" \\\" EDNS0_Buffersize \\\" \\\" Responce_Code \\\" \\\" Responce_Flags \\\" \\\" Responce_Size \\\" \\\" Response_Duration\\r\\n| project-away msg_s\\r\\n| where '{DNSClientIP}' == ClientIP or '{DNSClientIP}' == \\\"*\\\"\\r\\n| where '{DNSRequestName}' == Request_Name or '{DNSRequestName}' == \\\"*\\\"\\r\\n| summarize by TimeGenerated, ResourceId, ClientIP, ClientPort, QueryID, Request_Type, Request_Class, Request_Name, Request_Protocol, Request_Size, EDNSO_DO, EDNS0_Buffersize, Responce_Code, Responce_Flags, Responce_Size, Response_Duration, SubscriptionId\",\"size\":0,\"showAnalytics\":true,\"title\":\"DNS Proxy Information\",\"noDataMessage\":\"There are no DNS Proxy logs within the selected workspaces. If you believe the selection is correct, confirm DNS Proxy logs are enabled for the Azure Firewall and feeding into this selected workspace. Reference Docs: https://docs.microsoft.com/azure/firewall/\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"DNSTimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFDNSProxy\"},\"name\":\"query - 30\"},{\"type\":1,\"content\":{\"json\":\"# Azure Firewall Premium - IDPS\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"text - 42\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| summarize count() by Action\",\"size\":0,\"title\":\"IDPS Actions Count, filterable by Action\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"noDataMessageStyle\":2,\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"IDSIPSAction\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 44\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"IDPS Protocol Count, filterable by Protocol\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"IDSIPSProtocol\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| summarize count() by SignatureID\\r\\n\",\"size\":0,\"title\":\"IDPS SignatureID Count, filterable by SignatureID\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"IDSIPSSignatureID\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| summarize count() by SourceIP, DestIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"IDPS SourceIP Count, filterable by SourceIP\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"IDSIPSSourceIP\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":5}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"SourceIP\"],\"expandTopLevel\":false}}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n//| project-away Category, ResourceId, msg_s, SubscriptionId, ResourceProvider, ResourceType, OperationName, Type\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| summarize count() by Action\",\"size\":0,\"title\":\"Filtered IDPS Actions by Count\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"]},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 44 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n//| project-away Category, ResourceId, msg_s, SubscriptionId, ResourceProvider, ResourceType, OperationName, Type\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Filtered IDPS Protocols by Count\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"]},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n//| project-away Category, ResourceId, msg_s, SubscriptionId, ResourceProvider, ResourceType, OperationName, Type\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| summarize count() by SignatureID\",\"size\":0,\"title\":\"Filtered IDPS SignatureIDs by Count\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"]},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| summarize count() by SourceIP, DestIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Filtered SourceIP, filterable by DestIP\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestIP\",\"exportParameterName\":\"IDSIPSDestIP\",\"exportDefaultValue\":\"*\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":5}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"SourceIP\"],\"expandTopLevel\":false}}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, SignatureID, Message, Resource\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| where '{IDSIPSDestIP}' == DestIP or '{IDSIPSDestIP}' == \\\"*\\\"\\r\\n| summarize count() by Resource, bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Azure Firewall IDPS count over time\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"AFIDSIPSBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":5}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"SourceIP\"],\"expandTopLevel\":false}}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, SignatureID, Message, Priority, Classification, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, Resource\\r\\n| where '{IDSIPSAction}' == Action or '{IDSIPSAction}' == \\\"*\\\"\\r\\n| where '{IDSIPSProtocol}' == Protocol or '{IDSIPSProtocol}' == \\\"*\\\"\\r\\n| where '{IDSIPSSignatureID}' == SignatureID or '{IDSIPSSignatureID}' == \\\"*\\\"\\r\\n| where '{IDSIPSSourceIP}' == SourceIP or '{IDSIPSSourceIP}' == \\\"*\\\"\\r\\n| where '{IDSIPSDestIP}' == DestIP or '{IDSIPSDestIP}' == \\\"*\\\"\",\"size\":0,\"showAnalytics\":true,\"title\":\"Azure Firewall IDPS count over time\",\"noDataMessage\":\"This feature is in Azure Firewall Premium; For more information go to https://docs.microsoft.com/azure/firewall/premium-features\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"AFIDSIPSBrush\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFIDSIPS\"},\"name\":\"query - 45 - Copy\"},{\"type\":1,\"content\":{\"json\":\"# Azure Firewall - Investigation\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"text - 43\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics \\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails \\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b \\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt) \\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)\\r\\n| where Action == \\\"Deny\\\" or Action == \\\"Allow\\\"\\r\\n| summarize count() by FQDN, Action\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"FQDN Traffic by Count, filterable by FQDN\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"FQDN\",\"exportParameterName\":\"FullName\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"minimumIntegerDigits\":1,\"maximumFractionDigits\":1,\"maximumSignificantDigits\":4}}}],\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Action\"],\"expandTopLevel\":true}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 29 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where msg_s contains \\\"{FullName:label}\\\" or '{FullName}' == \\\"*\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails\\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b \\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt) \\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)\\r\\n| where Action == \\\"Deny\\\" or Action == \\\"Allow\\\"\\r\\n| where SourceIP <> \\\"\\\"\\r\\n| summarize count() by SourceIP, SubscriptionId\\r\\n| sort by count_\",\"size\":0,\"title\":\"SourceIP Address, filterable\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"SourceIP\",\"parameterName\":\"InvestigateIP\",\"parameterType\":1,\"defaultValue\":\"privateIPAddress\"},{\"fieldName\":\"SourceIP\",\"parameterName\":\"InvestigateIPWC\",\"parameterType\":1,\"defaultValue\":\"*\"},{\"fieldName\":\"SubscriptionId\",\"parameterName\":\"SelectedSubscriptionId\",\"parameterType\":1,\"defaultValue\":\"-\"}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SubscriptionId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"whiteBlack\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumSignificantDigits\":4}}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SourceIP\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"10\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 33\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Resources\\r\\n| where type =~ 'microsoft.network/networkinterfaces'\\r\\n| where properties contains \\\"{InvestigateIP}\\\"\\r\\n| where properties contains '{SelectedSubscriptionId}'\\r\\n| extend NSG = properties['networkSecurityGroup']['id']\\r\\n| parse NSG with \\\"/subscriptions/\\\" NetworkSecurityGroup_Sub \\\"/resourceGroups/\\\" NetworkSecurityGroup_rg \\\"/providers/Microsoft.Network/networkSecurityGroups/\\\" NetworkSecurityGroup_Name\\r\\n| project id, PrivateIPAddress = tostring(properties['ipConfigurations'][0]['properties']['privateIPAddress']),  PublicIPAddress = tostring(properties['ipConfigurations'][0]['properties']['publicIPAddress']['id']), VirtualMachine = tostring(properties['virtualMachine']['id']), subnet = tostring(properties['ipConfigurations'][0]['properties']['subnet']['id']), NetworkSecurityGroup = NetworkSecurityGroup_Name, properties, subscriptionId, tenantId\",\"size\":0,\"title\":\"SourceIPAddress Resource Lookup\",\"exportFieldName\":\"id\",\"exportParameterName\":\"Testid\",\"exportDefaultValue\":\"*\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"value::selected\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"properties\",\"formatter\":5}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SourceIP\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"60\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 33 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallApplicationRule\\\"\\r\\n| where msg_s contains \\\"{FullName:label}\\\" or '{FullName}' == \\\"*\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePortInt:int \\\" \\\" TempDetails\\r\\n| where msg_s contains \\\"{InvestigateIPWC:label}\\\" or '{InvestigateIPWC}' == \\\"*\\\"\\r\\n| parse TempDetails with \\\"was \\\" Action1 \\\". Reason: \\\" Rule1 \\r\\n| parse TempDetails with \\\"to \\\" FQDN \\\":\\\" TargetPortInt:int \\\". Action: \\\" Action2 \\\".\\\" * \\r\\n| parse TempDetails with * \\\". Rule Collection: \\\" RuleCollection2a \\\". Rule:\\\" Rule2a \\r\\n| parse TempDetails with * \\\"Deny.\\\" RuleCollection2b \\\". Proceeding with\\\" Rule2b\\r\\n| parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\\r\\n| parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\\r\\n| extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S),SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\\r\\n| extend SourcePort = tostring(SourcePortInt) \\r\\n| extend TargetPort = tostring(TargetPortInt)\\r\\n| extend Action1 = case(Action1 == \\\"denied\\\",\\\"Deny\\\",\\\"Unknown Action\\\") \\r\\n| extend Action = case(Action2 == \\\"\\\",Action1,Action2),Rule = case(Rule2a == \\\"\\\", case(Rule1 == \\\"\\\",case(Rule2b == \\\"\\\",\\\"N/A\\\", Rule2b),Rule1),Rule2a),  RuleCollection = case(RuleCollection2b == \\\"\\\",case(RuleCollection2a == \\\"\\\",\\\"No rule matched\\\",RuleCollection2a), RuleCollection2b),FQDN = case(FQDN == \\\"\\\", \\\"N/A\\\", FQDN),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort)\\r\\n| summarize by TimeGenerated, FQDN, Protocol, Action, SourceIP, SourcePort, TargetPort, SourceHost , DestinationPort , ResourceId , ResourceGroup , RuleCollection, Rule, SubscriptionId\\r\\n\\r\\n\",\"size\":0,\"title\":\"FQDN Lookup logs\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 33\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName == \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where Resource in~ (split(\\\"{Resource:label}\\\", \\\", \\\"))\\r\\n| parse msg_s with Protocol \\\" request from\\\" SourceIP \\\":\\\" SourcePortInt:int \\\" to\\\" TargetIP \\\":\\\" TargetPortInt:int *\\r\\n| where msg_s contains \\\"{InvestigateIPWC:label}\\\" or '{InvestigateIPWC}' == \\\"*\\\"\\r\\n| parse msg_s with * \\\". Action: \\\" Action1a\\r\\n| parse msg_s with * \\\" was \\\" Action1b \\\" to \\\" NatDestination\\r\\n| parse msg_s with Protocol2 \\\" request from\\\" SourceIP2 \\\" to\\\" TargetIP2 \\\". Action:\\\" Action2\\r\\n| parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\\r\\n| parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\\r\\n| extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S),SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\\r\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt)\\r\\n| extend Action = case(Action1a == \\\"\\\", case(Action1b == \\\"\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\"\\\", Protocol2, Protocol),SourceIP = case(SourceIP == \\\"\\\", SourceIP2, SourceIP),TargetIP = case(TargetIP == \\\"\\\", TargetIP2, TargetIP),SourcePort = case(SourcePort == \\\"\\\", \\\"N/A\\\", SourcePort),TargetPort = case(TargetPort == \\\"\\\", \\\"N/A\\\", TargetPort),NatDestination = case(NatDestination == \\\"\\\", \\\"N/A\\\", NatDestination)\\r\\n| summarize by TimeGenerated,Protocol, Action, SourcePort, TargetPort, SourceHost , DestinationHost , DestinationPort , NatDestination, ResourceId , ResourceGroup , SubscriptionId\",\"size\":0,\"title\":\"Azure Firewall Threat Intel\",\"noDataMessage\":\"There is no Azure Firewall Threat Intel for your filtered results\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 29\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//reference list posted here : https://docs.microsoft.com/azure/data-explorer/kusto/query/ipv4-lookup-plugin\\r\\nlet geoData = externaldata\\r\\n(network:string,geoname_id:string,continent_code:string,continent_name:string,\\r\\ncountry_iso_code:string,country_name:string,is_anonymous_proxy:string,is_satellite_provider:string)\\r\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"] with (ignoreFirstRecord=true, format=\\\"csv\\\");\\r\\nAzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| where msg_s contains \\\"{InvestigateIPWC:label}\\\" or '{InvestigateIPWC}' == \\\"*\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| project TimeGenerated, SignatureID, Message, Priority, Classification, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, Resource\\r\\n| evaluate ipv4_lookup (geoData, DestIP,  network, false)\\r\\n\",\"size\":0,\"title\":\"Azure Firewall Premium - IDPS\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspaces}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60ch\"}},{\"columnMatch\":\"Message\",\"formatter\":5},{\"columnMatch\":\"country_name\",\"formatter\":5},{\"columnMatch\":\"-- Group By --\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60ch\"}}],\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Message\",\"country_name\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"AFInvestigate\"},\"name\":\"query - 58\"}],\"isLocked\":true,\"fallbackResourceIds\":[\"/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourcegroups/soc/providers/microsoft.operationalinsights/workspaces/cybersecuritysoc\"],\"fromTemplateId\":\"sentinel-UserWorkbook\"}",
                "version": "Notebook/1.0",
                "category": "sentinel",
                "sourceId": "[parameters('workspaces_cybersecuritysoc_externalid')]",
                "tags": []
            }
        }
    ]
}