{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**Cloudflare CCF**](https://aka.ms/sentinel-CloudflareDefinition-parser) which is deployed with the Microsoft Sentinel Solution." }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "2088f290-65ee-4357-badb-55ce732a5004", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Cloudflare Web Traffic Overview", "subTarget": "cloudflare_web_traffic_overview", "style": "link" }, { "id": "25df6ee6-dcf7-4aa2-b90e-50f8a4b6548d", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Cloudflare Security Overview", "subTarget": "cloudflare_security_overview", "style": "link" }, { "id": "a2108bc6-5769-4c86-a5c0-201f531ed929", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Cloudflare Reliability Summary", "subTarget": "cloudflare_reliability_summary", "style": "link" } ] }, "name": "links - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c64d5d3d-90c6-484a-ab88-c70652b75b6e", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 172800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize count() by ClientDeviceType", "size": 0, "title": "Traffic Type", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Traffic Type" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize count() by ClientRequestProtocol", "size": 0, "title": "HTTP Protocols", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "HTTP Protocols" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize count() by HttpRequestMethod", "size": 0, "title": "Request Methods", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Request Methods" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend EdgeResponseContentType = iif(isempty(HttpContentType),\"empty\",HttpContentType )\n| summarize count() by EdgeResponseContentType", "size": 0, "title": "Content Types", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Content Types" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize Count=count() by ClientRequestURI\n| sort by Count | project-rename ClientRequestURI=ClientRequestURI | take 50", "size": 0, "title": "Top Requested URIs", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Top Requested URIs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize Count=count() by SrcIpAddr\n| sort by Count | take 50 | project-rename ClientIP=SrcIpAddr", "size": 0, "title": "Top Traffic IPs", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Top Traffic IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend ClientRequestReferer = iif(isempty(HttpReferrerOriginal),\"empty\",HttpReferrerOriginal )\n| summarize Count=count() by ClientRequestReferer\n| sort by Count | take 50\n", "size": 0, "title": "Top Referer", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Top Referer" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize Count=count() by ClientIPClass | project-rename ClientIPClass=ClientIPClass\n| sort by Count | take 50\n", "size": 0, "title": "Top Traffic Types", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "customWidth": "25", "name": "Top Traffic Types" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| summarize Count=count() by HttpUserAgentOriginal | project-rename ClientRequestUserAgent=HttpUserAgentOriginal\n| sort by Count | take 50", "size": 0, "title": "Top User Agents", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "ClientRequestUserAgent", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "75%" } } ] } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_web_traffic_overview" }, "name": "Top User Agents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let total_number_of_requests =\nCloudflare\n| summarize Count=count()\n| extend title=\"Total Number Of Requests\";\n\nlet threats_stopped =\nCloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat) | summarize Count=count()\n| extend title=\"Stopped Threats\";\n\nlet result_table = union total_number_of_requests, threats_stopped; \nresult_table \n| sort by Count\n\n", "size": 0, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Req_Threats_title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize Count=count() by threat", "size": 0, "title": "Top Threats", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threats" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let total_number_of_requests =\nCloudflare\n| summarize Count=count()\n| extend title=\"Total Number Of Requests\";\n\nlet threats_stopped =\nCloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat) | summarize Count=count()\n| extend title=\"Stopped Threats\";\n\nlet result_table = union total_number_of_requests, threats_stopped; \nresult_table \n| sort by Count\n\n", "size": 0, "title": "Requests vs Threats", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Requests vs Threats" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};", "size": 0, "title": "Threats Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Threats Over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize count() by SrcGeoCountry | project-rename Country=SrcGeoCountry | take 20", "size": 0, "title": "Top Threat Countries", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threat Countries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize count() by SrcIpAddr | project-rename ClientIP=SrcIpAddr", "size": 0, "title": "Top Threat Client IPs", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threat Client IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize Count=count() by ClientRequestURI | project-rename ClientRequestURI=ClientRequestURI", "size": 0, "title": "Top Threat URIs", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threat URIs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize Count=count() by HttpUserAgentOriginal | project-rename ClientRequestUserAgent=HttpUserAgentOriginal", "size": 0, "title": "Top Threat User Agents", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threat User Agents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend threat=case(EdgePathingSrc ==\"user\" and EdgePathingOp == \"ban\" and EdgePathingStatus has \"ip\" ,\"IP Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\",\"Country Block\",EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"zl\", \"Routed by Zone Lockdown\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ua\", \"Blocked User Agent\", EdgePathingSrc==\"user\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"rateLimit\", \"Blocked by Rate Limiting\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Blocked by Filter Based Firewall\", EdgePathingSrc==\"filterBasedFirewall\" and EdgePathingOp==\"chl\", \"Challenged by Filter Based Firewall\", EdgePathingSrc==\"bic\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"unknown\", \"Browser Integrity Check\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ctry\", \"Blocked Hotlink\", EdgePathingSrc==\"hot\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"ip\", \"Blocked Hotlink\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaErr\", \"CAPTCHA Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaFail\", \"CAPTCHA Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"captchaNew\", \"New CAPTCHA\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlErr\", \"Java Script Challenge Error\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlFail\", \"Java Script Challenge Failed\", EdgePathingSrc==\"macro\" and EdgePathingOp==\"chl\" and EdgePathingStatus==\"jschlNew\", \"New Java Script Challenge\", EdgePathingSrc==\"protect\" and EdgePathingOp==\"ban\" and EdgePathingStatus==\"17ddos\", \"L7 DDos Mitigation\",\"\")\n| where isnotempty(threat)\n| summarize Count=count() by EdgePathingStatus | project-rename EdgePathingStatus=EdgePathingStatus", "size": 0, "title": "Top Threat User Agents", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Count", "sortOrderField": 2, "size": "auto" } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_security_overview" }, "customWidth": "33", "name": "Top Threat User Agents - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let 5xx = Cloudflare\n| where tostring(EdgeResponseStatus) startswith \"5\"\n| summarize Count=count()\n| extend title=\"5xx Errors (Edge)\";\n\nlet 4xx = Cloudflare\n| where tostring(EdgeResponseStatus) startswith \"4\"\n| summarize Count=count()\n| extend title=\"4xx Errors (Edge)\";\n\nlet 3xx = Cloudflare\n| where tostring(EdgeResponseStatus) startswith \"3\"\n| summarize Count=count()\n| extend title=\"3xx Errors (Edge)\";\n\nlet result_table = union 5xx, 4xx, 3xx; \nresult_table \n| sort by Count\n\n", "size": 0, "title": "ERRORS Counts (Edge)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_reliability_summary" }, "customWidth": "33", "name": "Errors (Edge)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend response_error_type= case(tostring(EdgeResponseStatus) startswith \"2\" , \"2xx\", tostring(EdgeResponseStatus) startswith \"3\" , \"3xx\", tostring(EdgeResponseStatus) startswith \"4\" , \"4xx\", tostring(EdgeResponseStatus) startswith \"5\" , \"5xx\",\"\")\n| where isnotempty(response_error_type)\n| summarize Count=count() by response_error_type", "size": 0, "title": "Edge Response Error Ratio", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_reliability_summary" }, "customWidth": "33", "name": "Edge Response Error Ratio" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend response_error_type= case(tostring(HttpStatusCode) startswith \"2\" , \"2xx\", tostring(HttpStatusCode) startswith \"3\" , \"3xx\", tostring(HttpStatusCode) startswith \"4\" , \"4xx\", tostring(HttpStatusCode) startswith \"5\" , \"5xx\",\"\")\n| where isnotempty(response_error_type)\n| summarize Count=count() by response_error_type", "size": 0, "title": "Origin Response Error Ratio", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_reliability_summary" }, "customWidth": "33", "name": "Origin Response Error Ratio" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend response_error_type= case(tostring(EdgeResponseStatus) startswith \"2\" , \"2xx\", tostring(EdgeResponseStatus) startswith \"3\" , \"3xx\", tostring(EdgeResponseStatus) startswith \"4\" , \"4xx\", tostring(EdgeResponseStatus) startswith \"5\" , \"5xx\",\"\")\n| where isnotempty(response_error_type)\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by response_error_type;", "size": 0, "title": "Edge Response Status Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_reliability_summary" }, "customWidth": "50", "name": "Edge Response Status Over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Cloudflare\n| extend response_error_type= case(tostring(HttpStatusCode) startswith \"2\" , \"2xx\", tostring(HttpStatusCode) startswith \"3\" , \"3xx\", tostring(HttpStatusCode) startswith \"4\" , \"4xx\", tostring(HttpStatusCode) startswith \"5\" , \"5xx\",\"\")\n| where isnotempty(response_error_type)\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by response_error_type;", "size": 0, "title": "Origin Response Status Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloudflare_reliability_summary" }, "customWidth": "50", "name": "Origin Response Status Over Time" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-CloudflareCCFWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }