diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index b898039052e..4f84c9f5784 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -6,6 +6,9 @@ "Data Connectors": [ "Data Connectors/template_WAF.json" ], + "Hunting Queries": [ + "Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml" + ], "Analytic Rules": [ "Analytic Rules/MaliciousWAFSessions.yaml", "Analytic Rules/AFD-Premium-WAF-SQLiDetection.yaml", @@ -25,28 +28,10 @@ "Workbooks/WebApplicationFirewallWAFTypeEvents.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Web Application Firewall (WAF)\\", + "Version": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ "WAF" - ], - "XDR Detections": [ - "XDR Detections/AFD-Premium-WAF-SQLiDetection.yaml", - "XDR Detections/AFD-Premium-WAF-XSSDetection.yaml", - "XDR Detections/AFD-WAF-Code-Injection.yaml", - "XDR Detections/AFD-WAF-Path-Traversal-Attack.yaml", - "XDR Detections/App-GW-WAF-Code-Injection.yaml", - "XDR Detections/App-GW-WAF-Path-Traversal-Attack.yaml", - "XDR Detections/App-GW-WAF-SQLiDetection.yaml", - "XDR Detections/App-GW-WAF-Scanner-detection.yaml", - "XDR Detections/App-GW-WAF-XSSDetection.yaml", - "XDR Detections/MaliciousWAFSessions.yaml" - ], - "XDR Workbooks": [ - "XDR Workbooks/WebApplicationFirewallFirewallEvents.json", - "XDR Workbooks/WebApplicationFirewallGatewayAccessEvents.json", - "XDR Workbooks/WebApplicationFirewallOverview.json", - "XDR Workbooks/WebApplicationFirewallWAFTypeEvents.json" - ], - "Version": "3.2.2" + ] } diff --git a/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml new file mode 100644 index 00000000000..da79661ab75 --- /dev/null +++ b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml @@ -0,0 +1,59 @@ +id: 16a81a04-3d26-4118-8f6d-6dd3389583cc +name: Bypass Attempt via Double URL Encoding +description: | + Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. +description-detailed: | + This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations. +status: Available +requiredDataConnectors: + - connectorId: WAF + dataTypes: + - AGWFirewallLogs + - AzureDiagnostics +tactics: + - DefenseEvasion +relevantTechniques: + - T1027 +query: | + let StartTime = ago(1d); + let EndTime = now(); + let TargetAdminPathRegex = @"^/?(admin|psemhub|bin|config|setup|install|login)"; + let ModernWAF = (AGWFirewallLogs + | where TimeGenerated between (StartTime .. EndTime) + | where Action in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(RequestUri, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action); + let LegacyWAF = (AzureDiagnostics + | where TimeGenerated between (StartTime .. EndTime) + | where Category == "ApplicationGatewayFirewallLog" + | where action_s in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(requestUri_s, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s); + union isfuzzy=true ModernWAF, LegacyWAF + | summarize + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + AttackCount = count(), + SamplePayloads = make_set(requestUri, 5) + by clientIp, hostname, action +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: clientIp + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname +customDetails: + WAFAction: action + TotalAttempts: AttackCount +version: 1.0.0 \ No newline at end of file diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip index ecd54dd4068..edbfaf7b04a 100644 Binary files a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip and b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip differ diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip new file mode 100644 index 00000000000..1ded8c9537a Binary files /dev/null and b/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip differ diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json index baee3971cb1..172b0817474 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **XDR Detections:** 10, **XDR Workbooks:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,47 +51,6 @@ } ], "steps": [ - { - "name": "contentSelection", - "label": "Content selection", - "elements": [ - { - "name": "DeployAnalyticsRule", - "type": "Microsoft.Common.CheckBox", - "label": "DeployAnalyticsRule", - "defaultValue": true, - "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - }, - { - "name": "DeployWorkbook", - "type": "Microsoft.Common.CheckBox", - "label": "DeployWorkbook", - "defaultValue": true, - "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - }, - { - "name": "DeployDefenderWorkbook", - "type": "Microsoft.Common.CheckBox", - "label": "DeployDefenderWorkbook", - "defaultValue": false, - "toolTip": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - }, - { - "name": "DeployDataConnector", - "type": "Microsoft.Common.CheckBox", - "label": "DeployDataConnector", - "defaultValue": true, - "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - }, - { - "name": "DeployCustomDetection", - "type": "Microsoft.Common.CheckBox", - "label": "DeployCustomDetection", - "defaultValue": false, - "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } - ] - }, { "name": "dataconnectors", "label": "Data Connectors", @@ -367,17 +326,50 @@ ] } ] + }, + { + "name": "huntingqueries", + "label": "Hunting Queries", + "bladeTitle": "Hunting Queries", + "elements": [ + { + "name": "huntingqueries-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " + } + }, + { + "name": "huntingqueries-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/hunting" + } + } + }, + { + "name": "huntingquery1", + "type": "Microsoft.Common.Section", + "label": "Bypass Attempt via Double URL Encoding", + "elements": [ + { + "name": "huntingquery1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on WAF data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)" + } + } + ] + } + ] } ], "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]", - "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", - "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", - "DeployDefenderWorkbook": "[steps('contentSelection').DeployDefenderWorkbook]", - "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", - "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]" + "workspace": "[basics('workspace')]" } } } diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json index dd4d2a9951e..844f11a52f7 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json @@ -59,48 +59,13 @@ "metadata": { "description": "Name for the workbook" } - }, - "DeployAnalyticsRule": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - } - }, - "DeployWorkbook": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - } - }, - "DeployDefenderWorkbook": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - } - }, - "DeployDataConnector": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - } - }, - "DeployCustomDetection": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Azure Web Application Firewall (WAF)", - "_solutionVersion": "3.2.2", + "_solutionVersion": "3.1.0", "solutionId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "WAF", @@ -112,6 +77,11 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "16a81a04-3d26-4118-8f6d-6dd3389583cc", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16a81a04-3d26-4118-8f6d-6dd3389583cc')))]" + }, "analyticRuleObject1": { "analyticRuleVersion1": "1.0.6", "_analyticRulecontentId1": "46ac55ae-47b8-414a-8f94-89ccd1962178", @@ -219,7 +189,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Azure Web Application Firewall (WAF) data connector with template version 3.2.2", + "description": "Azure Web Application Firewall (WAF) data connector with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -321,8 +291,7 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - }, - "condition": "[parameters('DeployDataConnector')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -352,8 +321,7 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" } - }, - "condition": "[parameters('DeployDataConnector')]" + } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -409,8 +377,92 @@ ], "id": "[variables('_uiConfigId1')]" } - }, - "condition": "[parameters('DeployDataConnector')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Azure WAF - Bypass Via Double URL Encoded Admin Paths_HuntingQueries Hunting Query with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "Azure_Web_Application_Firewall_(WAF)_Hunting_Query_1", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Bypass Attempt via Double URL Encoding", + "category": "Hunting Queries", + "query": "let StartTime = ago(1d);\nlet EndTime = now();\nlet TargetAdminPathRegex = @\"^/?(admin|psemhub|bin|config|setup|install|login)\";\nlet ModernWAF = (AGWFirewallLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where Action in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(RequestUri, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action);\nlet LegacyWAF = (AzureDiagnostics\n| where TimeGenerated between (StartTime .. EndTime)\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(requestUri_s, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s);\nunion isfuzzy=true ModernWAF, LegacyWAF\n| summarize\nFirstSeen = min(TimeGenerated),\nLastSeen = max(TimeGenerated),\nAttackCount = count(),\nSamplePayloads = make_set(requestUri, 5)\nby clientIp, hostname, action\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories." + }, + { + "name": "tactics", + "value": "DefenseEvasion" + }, + { + "name": "techniques", + "value": "T1027" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", + "properties": { + "description": "Azure Web Application Firewall (WAF) Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "source": { + "kind": "Solution", + "name": "Azure Web Application Firewall (WAF)", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "contentKind": "HuntingQuery", + "displayName": "Bypass Attempt via Double URL Encoding", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -421,7 +473,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -449,10 +501,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -465,8 +517,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -514,8 +566,7 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -526,7 +577,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -554,10 +605,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -576,8 +627,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -585,8 +636,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -634,8 +685,7 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -646,7 +696,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -674,10 +724,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -693,8 +743,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -702,8 +752,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -751,8 +801,7 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -763,7 +812,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -791,10 +840,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -812,8 +861,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -821,8 +870,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -870,8 +919,7 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -882,7 +930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -910,10 +958,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -933,8 +981,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -942,8 +990,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -991,8 +1039,7 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1003,7 +1050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1031,10 +1078,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1052,8 +1099,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1061,8 +1108,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1110,8 +1157,7 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1122,7 +1168,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1150,10 +1196,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1173,8 +1219,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1182,8 +1228,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1231,8 +1277,7 @@ "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1243,7 +1288,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1271,10 +1316,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1295,8 +1340,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1304,8 +1349,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1353,8 +1398,7 @@ "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1365,7 +1409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1393,10 +1437,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1415,8 +1459,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1424,8 +1468,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1473,8 +1517,7 @@ "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1485,7 +1528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.2.2", + "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1513,10 +1556,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1532,8 +1575,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1541,8 +1584,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1590,8 +1633,7 @@ "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1602,7 +1644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.2.2", + "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1620,7 +1662,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Application gateway firewall events\"\u007d,\"name\":\"text - 10\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":2592000000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where action_s == \\\"Blocked\\\" or action_s == \\\"Detected\\\" \\r\\n| summarize count() by requestUri_s \\r\\n| top 10 by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Blocked URL addresses\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize number = count() by action_s\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"WAF actions\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 11\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\" \\r\\n| summarize number = count() by instanceId_s, TimeGenerated\\r\\n| where instanceId_s has \\\"role\\\"\\r\\n| extend rolenumber = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\", 1, instanceId_s) \\r\\n| project rolenumber , number , TimeGenerated \\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Role use, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\"\u007d,\"customWidth\":\"40\",\"name\":\"query - 8\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize count() by Message\\r\\n| top 10 by count_ \\r\\n\",\"size\":0,\"exportFieldName\":\"Message\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"exportToExcelOptions\":\"visible\",\"title\":\"Event trigger\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":\u007b\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"labelSettings\":[\u007b\"columnId\":\"Message\"\u007d,\u007b\"columnId\":\"count_\",\"label\":\"\"\u007d]\u007d\u007d,\"customWidth\":\"50\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\\\"*\\\"\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Messages, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Message\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"50\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| project Message, TimeGenerated, SourceSystem, hostname_s, ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\\r\\n| sort by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Message, full details\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"\u007d,\"name\":\"query - 11\"\u007d,\u007b\"type\":1,\"content\":\u007b\"json\":\"---\"\u007d,\"name\":\"text - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, ResourceId, Category, Role\\r\\n| project Amount, Message, TimeGenerated, hostName, ResourceId, Category, Role\\r\\n| order by Amount desc\",\"size\":0,\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"\u007b\\\"Message\\\":\\\"*\\\"\u007d\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attacks events, by messages\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":\u007b\"showIcon\":true,\"aggregation\":\"Sum\"\u007d\u007d,\u007b\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"hostName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Category\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Role\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"$gen_group\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Count\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"TenantId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"SourceSystem\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"MG\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ManagementGroupName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleGroup_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"transactionId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"originalHost_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"_schema_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"error_code_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"error_message_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"instanceId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientIp_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientPort_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleSetType_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleSetVersion_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"action_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"site_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_message_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_data_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_file_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_line_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"hostname_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientIP_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientPort_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpMethod_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"requestQuery_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"userAgent_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpStatus_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpVersion_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"receivedBytes_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sentBytes_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"timeTaken_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sslEnabled_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"host_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_clientTrackingId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"tags__type_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"msg_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_originRunId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_actionName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_actionTrackingId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"workflowId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Level\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"OperationName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"status_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"tags_LogicAppsCategory_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_resourceGroupName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_workflowName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_runId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_location_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_triggerName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"SubscriptionId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceGroup\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceProvider\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceType\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"code_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_clientTrackingId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_subscriptionId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_workflowId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"startTime_t\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"endTime_t\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Type\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d],\"filter\":true,\"hierarchySettings\":\u007b\"treeType\":1,\"groupBy\":[\"Message\"],\"expandTopLevel\":false\u007d\u007d\u007d,\"name\":\"query - 16\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nAzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| where SelectedMS.Message == Message or SelectedMS.Message == \\\"*\\\" or Message == Child[0].Message\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"\u007b \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"\u007d\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attack events, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 14\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Message has \\\"SQL Injection\\\" \\r\\n| summarize count() by hostname_s, Message\\r\\n| order by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"SQL injection, by host name\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 15\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallFirewallEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Application gateway firewall events\"},\"name\":\"text - 10\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":2592000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where action_s == \\\"Blocked\\\" or action_s == \\\"Detected\\\" \\r\\n| summarize count() by requestUri_s \\r\\n| top 10 by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Blocked URL addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize number = count() by action_s\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"WAF actions\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\" \\r\\n| summarize number = count() by instanceId_s, TimeGenerated\\r\\n| where instanceId_s has \\\"role\\\"\\r\\n| extend rolenumber = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\", 1, instanceId_s) \\r\\n| project rolenumber , number , TimeGenerated \\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Role use, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\"},\"customWidth\":\"40\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize count() by Message\\r\\n| top 10 by count_ \\r\\n\",\"size\":0,\"exportFieldName\":\"Message\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"exportToExcelOptions\":\"visible\",\"title\":\"Event trigger\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true}}],\"labelSettings\":[{\"columnId\":\"Message\"},{\"columnId\":\"count_\",\"label\":\"\"}]}},\"customWidth\":\"50\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where ('{Selected}' == Message) or '{Selected}'==\\\"*\\\"\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Messages, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Message\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where '{Selected}' == Message or '{Selected}' == \\\"*\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| project Message, TimeGenerated, SourceSystem, hostname_s, ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\\r\\n| sort by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Message, full details\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"query - 11\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, ResourceId, Category, Role\\r\\n| project Amount, Message, TimeGenerated, hostName, ResourceId, Category, Role\\r\\n| order by Amount desc\",\"size\":0,\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"{\\\"Message\\\":\\\"*\\\"}\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attacks events, by messages\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":{\"showIcon\":true,\"aggregation\":\"Sum\"}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"hostName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Category\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Role\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"$gen_group\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Count\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"TenantId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"SourceSystem\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"MG\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ManagementGroupName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleGroup_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"transactionId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"originalHost_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"_schema_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"error_code_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"error_message_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"instanceId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientIp_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientPort_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"requestUri_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleSetType_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleSetVersion_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"action_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"site_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_message_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_data_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_file_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_line_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"hostname_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientIP_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientPort_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpMethod_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"requestQuery_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"userAgent_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpStatus_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpVersion_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"receivedBytes_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"sentBytes_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"timeTaken_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"sslEnabled_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"host_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_clientTrackingId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"tags__type_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"msg_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_originRunId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_actionName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_actionTrackingId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"workflowId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Level\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"OperationName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"status_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"tags_LogicAppsCategory_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_resourceGroupName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_workflowName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_runId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_location_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_triggerName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"SubscriptionId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceGroup\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceProvider\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceType\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"code_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_clientTrackingId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_subscriptionId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_workflowId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"startTime_t\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"endTime_t\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Type\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Message\"],\"expandTopLevel\":false}}},\"name\":\"query - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nAzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| where SelectedMS.Message == Message or SelectedMS.Message == \\\"*\\\" or Message == Child[0].Message\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attack events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"70\",\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Message has \\\"SQL Injection\\\" \\r\\n| summarize count() by hostname_s, Message\\r\\n| order by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"SQL injection, by host name\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"query - 15\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallFirewallEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1631,7 +1673,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallFirewallEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - firewall events; templateRelativePath=WebApplicationFirewallFirewallEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallFirewallEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - firewall events; templateRelativePath=WebApplicationFirewallFirewallEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -1679,8 +1721,7 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1691,7 +1732,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.2.2", + "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1709,7 +1750,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Application gateway access events\\n\"\u007d,\"customWidth\":\"100\",\"name\":\"text - 2\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"parameters\":[\u007b\"id\":\"b3ac8870-500d-4dd8-a570-f49a2c2f1a76\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":86400000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"customWidth\":\"50\",\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let ActivityData = AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\";\\r\\nActivityData\\r\\n| summarize Count = count() by clientIP_s\\r\\n| join kind = inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\\r\\n on clientIP_s\\r\\n | project-away clientIP_s1, TimeGenerated\\r\\n| extend clientIP = clientIP_s\\r\\n| union (\\r\\n ActivityData\\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\\r\\n | extend jkey = 1) on jkey\\r\\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":4,\"title\":\"Top 10 IP's by activity\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":\u007b\"titleContent\":\u007b\"columnMatch\":\"clientIp_s\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3\u007d\u007d\u007d,\"rightContent\":\u007b\"columnMatch\":\"clientIP_s\"\u007d,\"secondaryContent\":\u007b\"columnMatch\":\"Trend\",\"formatter\":9\u007d,\"showBorder\":false\u007d\u007d,\"name\":\"query - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\\r\\n\",\"size\":0,\"title\":\"Activity, by cIient IP address\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 3\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize count() by clientIP_s, TimeGenerated\\r\\n\",\"size\":0,\"title\":\"SSL use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 4\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\\r\\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \\r\\n\",\"size\":0,\"title\":\"Received and sent data, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 5\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize number = count() by userAgent_s\\r\\n| top 10 by number desc nulls last \\r\\n\",\"size\":0,\"title\":\"User agent use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 6\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\\r\\n| order by number desc\",\"size\":0,\"title\":\"URL address use, by client IP address\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"30\",\"name\":\"query - 7\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize Count = count() by httpMethod=httpMethod_s\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"title\":\"HTTP Methods\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"purple\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"35\",\"name\":\"query - 8\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count = count() by requestQuery=requestQuery_s\\r\\n| sort by Count desc\",\"size\":0,\"title\":\"Request queries\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"35\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\\r\\n| order by sentBytes, recBytes\",\"size\":0,\"title\":\"Detailed activity\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"sentB\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"recB\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sentb\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d],\"rowLimit\":1000,\"filter\":true\u007d\u007d,\"name\":\"query - 10\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallGatewayAccessEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Application gateway access events\\n\"},\"customWidth\":\"100\",\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b3ac8870-500d-4dd8-a570-f49a2c2f1a76\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ActivityData = AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\";\\r\\nActivityData\\r\\n| summarize Count = count() by clientIP_s\\r\\n| join kind = inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by clientIP_s)\\r\\n on clientIP_s\\r\\n | project-away clientIP_s1, TimeGenerated\\r\\n| extend clientIP = clientIP_s\\r\\n| union (\\r\\n ActivityData\\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":4,\"title\":\"Top 10 IP's by activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"clientIp_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"rightContent\":{\"columnMatch\":\"clientIP_s\"},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9},\"showBorder\":false}},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\\r\\n\",\"size\":0,\"title\":\"Activity, by cIient IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize count() by clientIP_s, TimeGenerated\\r\\n\",\"size\":0,\"title\":\"SSL use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\\r\\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \\r\\n\",\"size\":0,\"title\":\"Received and sent data, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize number = count() by userAgent_s\\r\\n| top 10 by number desc nulls last \\r\\n\",\"size\":0,\"title\":\"User agent use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\\r\\n| order by number desc\",\"size\":0,\"title\":\"URL address use, by client IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"30\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize Count = count() by httpMethod=httpMethod_s\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"title\":\"HTTP Methods\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"purple\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count = count() by requestQuery=requestQuery_s\\r\\n| sort by Count desc\",\"size\":0,\"title\":\"Request queries\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\\r\\n| order by sentBytes, recBytes\",\"size\":0,\"title\":\"Detailed activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sentB\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}},{\"columnMatch\":\"recB\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}},{\"columnMatch\":\"sentb\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}}],\"rowLimit\":1000,\"filter\":true}},\"name\":\"query - 10\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallGatewayAccessEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1720,7 +1761,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallGatewayAccessEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.2.0; title=Microsoft Web Application Firewall (WAF) - gateway access events; templateRelativePath=WebApplicationFirewallGatewayAccessEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallGatewayAccessEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.2.0; title=Microsoft Web Application Firewall (WAF) - gateway access events; templateRelativePath=WebApplicationFirewallGatewayAccessEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId2')]", "contentId": "[variables('_workbookContentId2')]", "kind": "Workbook", @@ -1768,8 +1809,7 @@ "contentProductId": "[variables('_workbookcontentProductId2')]", "id": "[variables('_workbookcontentProductId2')]", "version": "[variables('workbookVersion2')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1780,7 +1820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallOverview Workbook with template version 3.2.2", + "description": "WebApplicationFirewallOverview Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -1798,7 +1838,7 @@ }, "properties": { "displayName": "[parameters('workbook3-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":2592000000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\u007b\"id\":\"b1a1c99d-4498-4e02-82f0-d52c276d5657\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Events\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count = count() by OperationName\\r\\n| order by Count desc, OperationName asc\\r\\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)\",\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\n| summarize count() by Resource, TimeGenerated\",\"size\":1,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource events, by time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Resource\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"70\",\"name\":\"query - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by Resource\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 4\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by OperationName, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Firewall and access events, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 5\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by OperationName\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by operation\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 6\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallOverview\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":2592000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b1a1c99d-4498-4e02-82f0-d52c276d5657\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Events\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count = count() by OperationName\\r\\n| order by Count desc, OperationName asc\\r\\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\n| summarize count() by Resource, TimeGenerated\",\"size\":1,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource events, by time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Resource\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by Resource\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by OperationName, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Firewall and access events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by OperationName\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by operation\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallOverview\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1809,7 +1849,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId3'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallOverviewWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - overview; templateRelativePath=WebApplicationFirewallOverview.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallOverviewWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - overview; templateRelativePath=WebApplicationFirewallOverview.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId3')]", "contentId": "[variables('_workbookContentId3')]", "kind": "Workbook", @@ -1857,8 +1897,7 @@ "contentProductId": "[variables('_workbookcontentProductId3')]", "id": "[variables('_workbookcontentProductId3')]", "version": "[variables('workbookVersion3')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1869,7 +1908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.2.2", + "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -1887,7 +1926,7 @@ }, "properties": { "displayName": "[parameters('workbook4-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Azure WAF Events\"\u007d,\"name\":\"text - 10\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"\u007bSubscription\u007d\"],\"parameters\":[\u007b\"id\":\"afd56a69-16a5-436d-850e-16c24e839503\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"e38cad87-ff16-40e6-9384-f6fd24fa9d6b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value=strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '\u007bDefaultSubscription_Internal\u007d', true, false)\",\"crossComponentResources\":[\"value::all\"],\"value\":[\"/subscriptions/6b1ceacd-5731-4780-8f96-2078dd96fd96\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"a125fc08-be6d-4b8b-87e2-7e0cd957db47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n|take 1\\r\\n|project id\",\"crossComponentResources\":[\"\u007bSubscription\u007d\"],\"isHiddenWhenLocked\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"65674a40-2869-4867-a24d-f86f05fd0354\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspaces\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id, selected = iff(id =~ '\u007bDefaultWorkspace_Internal\u007d', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":86400000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"604a42a0-deca-4a95-a15f-8977646a7fac\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAFType\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\"\\r\\n| summarize Count=count() by ResourceType\\r\\n| extend ResourceTypeImproved = iif(ResourceType == \\\"APPLICATIONGATEWAYS\\\", \\\"Application Gateway\\\", ResourceType)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"FRONTDOORS\\\", \\\"Azure Front Door\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"PROFILES\\\", \\\"Azure Front Door Premium\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\", \\\"Azure CDN\\\", ResourceTypeImproved)\\r\\n| order by Count desc, ResourceTypeImproved asc\\r\\n| project ResourceTypeImproved\",\"crossComponentResources\":[\"\u007bWorkspaces\u007d\"],\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"]\u007d,\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"WAF Type\"\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"label\":\"WAF Items\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\"))\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Label = strcat(Resource, \\\" - \\\", Count)\",\"crossComponentResources\":[\"\u007bWorkspaces\u007d\"],\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"]\u007d,\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\\r\\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| summarize number = count() by Action\",\"size\":3,\"showAnalytics\":true,\"title\":\"WAF actions filter\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"SelectedAction\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"27\",\"name\":\"query - 11\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where Action == \\\"Block\\\"\\r\\n| where requestUri_s <> \\\"/\\\"\\r\\n| summarize count() by requestUri_s \\r\\n| top 40 by count_ desc \",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 40 Blocked Request URI addresses, filter to single URI address\",\"noDataMessage\":\"The current data has no \\\"Blocked\\\" results\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"requestUri_s\",\"exportParameterName\":\"RequestURI\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":\u007b\"titleContent\":\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":1,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":\u007b\"palette\":\"auto\",\"showIcon\":true\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":5\u007d\u007d\u007d,\"showBorder\":false\u007d,\"graphSettings\":\u007b\"type\":0,\"topContent\":\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":1\u007d,\"centerContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"mapSettings\":\u007b\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":\u007b\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"\u007d\u007d\u007d,\"customWidth\":\"63\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Rule= iif(Rule has \\\"Mandatory rule. Cannot be disabled.\\\", strcat_array(split(Rule, \\\"Mandatory rule. Cannot be disabled. Inbound \\\",1),\\\"\\\"), Rule) // Removes initial component for mandatory rule \\r\\n| extend Rule = iif(Rule has \\\"Total Inbound Score\\\", strcat_array(array_concat(split(Rule, \\\" - SQLI=\\\", 0), parse_json('[\\\") -\\\"]'), split(Rule,\\\"):\\\",1)),\\\"\\\"),Rule) // Removes smaller information if more info is available for anomaly score\\r\\n| summarize count() by Rule\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 50 event triggers, filter by rule name\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Rule\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":\u007b\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"sortBy\":[\u007b\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2\u007d],\"labelSettings\":[\u007b\"columnId\":\"count_\",\"label\":\"\"\u007d]\u007d,\"sortBy\":[\u007b\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2\u007d]\u007d,\"customWidth\":\"30\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize count() by Rule, bin(TimeGenerated, 1h)\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Messages, by time\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Message\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"70\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\" \\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\\r\\n| project Rule, TimeGenerated, SourceSystem, Hostname, ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\\r\\n| sort by TimeGenerated\",\"size\":0,\"showAnalytics\":true,\"title\":\"Message, full details\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"filter\":true\u007d\u007d,\"name\":\"query - 11\"\u007d,\u007b\"type\":1,\"content\":\u007b\"json\":\"---\"\u007d,\"name\":\"text - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\" \\r\\n| summarize Amount = count() by Rule\\r\\n| order by Amount desc\\r\\n\\r\\n\",\"size\":0,\"title\":\"Attacks events, by messages and filterable by rule name\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"\u007b\\\"Rule\\\":\\\"*\\\"\u007d\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":\u007b\"palette\":\"blueDark\",\"showIcon\":true,\"aggregation\":\"Sum\"\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"20\",\"name\":\"query - 16\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\" \\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), ResourceId\\r\\n| project Amount, Rule, TimeGenerated, ResourceId\\r\\n| order by Amount desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Attack events, by time\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushLowerSection\",\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"\u007b \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"\u007d\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"\u007d,\"customWidth\":\"80\",\"name\":\"query - 14\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\" \\r\\n| summarize count() by TrackingID\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID filter\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"TrackingID\",\"exportParameterName\":\"SelectedTrackingID\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"rowLimit\":500,\"filter\":true,\"sortBy\":[\u007b\"itemKey\":\"TrackingID\",\"sortOrder\":2\u007d]\u007d,\"sortBy\":[\u007b\"itemKey\":\"TrackingID\",\"sortOrder\":2\u007d]\u007d,\"customWidth\":\"20\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID Messages\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"rowLimit\":50\u007d\u007d,\"customWidth\":\"80\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize count() by ClientIP\\r\\n| top 10 by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Attacking IP Addresses, filter to single IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"x\",\"exportParameterName\":\"ClientIP\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"ClientIP\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"graphSettings\":\u007b\"type\":0,\"topContent\":\u007b\"columnMatch\":\"ClientIP\",\"formatter\":1\u007d,\"centerContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"chartSettings\":\u007b\"showLegend\":true\u007d,\"mapSettings\":\u007b\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":\u007b\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"\u007d\u007d\u007d,\"customWidth\":\"25\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \\\"*\\\")\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"title\":\"Attack messages of IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"filter\":true\u007d\u007d,\"customWidth\":\"75\",\"showPin\":true,\"name\":\"query - 13\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallWAFTypeEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Azure WAF Events\"},\"name\":\"text - 10\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Subscription}\"],\"parameters\":[{\"id\":\"afd56a69-16a5-436d-850e-16c24e839503\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"e38cad87-ff16-40e6-9384-f6fd24fa9d6b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value=strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::all\"],\"value\":[\"/subscriptions/6b1ceacd-5731-4780-8f96-2078dd96fd96\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"a125fc08-be6d-4b8b-87e2-7e0cd957db47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n|take 1\\r\\n|project id\",\"crossComponentResources\":[\"{Subscription}\"],\"isHiddenWhenLocked\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"65674a40-2869-4867-a24d-f86f05fd0354\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspaces\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id, selected = iff(id =~ '{DefaultWorkspace_Internal}', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000}],\"allowCustom\":true}},{\"id\":\"604a42a0-deca-4a95-a15f-8977646a7fac\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAFType\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\"\\r\\n| summarize Count=count() by ResourceType\\r\\n| extend ResourceTypeImproved = iif(ResourceType == \\\"APPLICATIONGATEWAYS\\\", \\\"Application Gateway\\\", ResourceType)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"FRONTDOORS\\\", \\\"Azure Front Door\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"PROFILES\\\", \\\"Azure Front Door Premium\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\", \\\"Azure CDN\\\", ResourceTypeImproved)\\r\\n| order by Count desc, ResourceTypeImproved asc\\r\\n| project ResourceTypeImproved\",\"crossComponentResources\":[\"{Workspaces}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"WAF Type\"},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"label\":\"WAF Items\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\"))\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Label = strcat(Resource, \\\" - \\\", Count)\",\"crossComponentResources\":[\"{Workspaces}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\\r\\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| summarize number = count() by Action\",\"size\":3,\"showAnalytics\":true,\"title\":\"WAF actions filter\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"SelectedAction\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"27\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where Action == \\\"Block\\\"\\r\\n| where requestUri_s <> \\\"/\\\"\\r\\n| summarize count() by requestUri_s \\r\\n| top 40 by count_ desc \",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 40 Blocked Request URI addresses, filter to single URI address\",\"noDataMessage\":\"The current data has no \\\"Blocked\\\" results\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"requestUri_s\",\"exportParameterName\":\"RequestURI\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"requestUri_s\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":5}}},\"showBorder\":false},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"requestUri_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"63\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Rule= iif(Rule has \\\"Mandatory rule. Cannot be disabled.\\\", strcat_array(split(Rule, \\\"Mandatory rule. Cannot be disabled. Inbound \\\",1),\\\"\\\"), Rule) // Removes initial component for mandatory rule \\r\\n| extend Rule = iif(Rule has \\\"Total Inbound Score\\\", strcat_array(array_concat(split(Rule, \\\" - SQLI=\\\", 0), parse_json('[\\\") -\\\"]'), split(Rule,\\\"):\\\",1)),\\\"\\\"),Rule) // Removes smaller information if more info is available for anomaly score\\r\\n| summarize count() by Rule\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 50 event triggers, filter by rule name\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Rule\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true}}],\"sortBy\":[{\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"\"}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2}]},\"customWidth\":\"30\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize count() by Rule, bin(TimeGenerated, 1h)\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Messages, by time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Message\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"70\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\" \\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\\r\\n| project Rule, TimeGenerated, SourceSystem, Hostname, ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\\r\\n| sort by TimeGenerated\",\"size\":0,\"showAnalytics\":true,\"title\":\"Message, full details\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 11\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\" \\r\\n| summarize Amount = count() by Rule\\r\\n| order by Amount desc\\r\\n\\r\\n\",\"size\":0,\"title\":\"Attacks events, by messages and filterable by rule name\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"{\\\"Rule\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blueDark\",\"showIcon\":true,\"aggregation\":\"Sum\"}}],\"filter\":true}},\"customWidth\":\"20\",\"name\":\"query - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\" \\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), ResourceId\\r\\n| project Amount, Rule, TimeGenerated, ResourceId\\r\\n| order by Amount desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Attack events, by time\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushLowerSection\",\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"80\",\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\" \\r\\n| summarize count() by TrackingID\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID filter\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"TrackingID\",\"exportParameterName\":\"SelectedTrackingID\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"TrackingID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TrackingID\",\"sortOrder\":2}]},\"customWidth\":\"20\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID Messages\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50}},\"customWidth\":\"80\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize count() by ClientIP\\r\\n| top 10 by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Attacking IP Addresses, filter to single IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"x\",\"exportParameterName\":\"ClientIP\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"ClientIP\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"ClientIP\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"25\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where ('{ClientIP}' == ClientIP or '{ClientIP}' == \\\"*\\\")\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"title\":\"Attack messages of IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"75\",\"showPin\":true,\"name\":\"query - 13\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallWAFTypeEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1898,7 +1937,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId4'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallWAFTypeEventsWorkbook; logoFileName=webapplicationfirewall(WAF)_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - Azure WAF; templateRelativePath=WebApplicationFirewallWAFTypeEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallWAFTypeEventsWorkbook; logoFileName=webapplicationfirewall(WAF)_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - Azure WAF; templateRelativePath=WebApplicationFirewallWAFTypeEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId4')]", "contentId": "[variables('_workbookContentId4')]", "kind": "Workbook", @@ -1946,20 +1985,19 @@ "contentProductId": "[variables('_workbookcontentProductId4')]", "id": "[variables('_workbookcontentProductId4')]", "version": "[variables('workbookVersion4')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.2", + "version": "3.1.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Azure Web Application Firewall (WAF)", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, XDR Detections: 10, XDR Workbooks: 4

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1989,6 +2027,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" + }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", @@ -2058,76 +2101,6 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId4')]", "version": "[variables('workbookVersion4')]" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "version": "3.1.0" - }, - { - "kind": "DefenderWorkbook", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "version": "3.2.2" } ] }, @@ -2142,6383 +2115,6 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-16da3a2a-af29-48a-3ddec5f9", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"SQL Injection\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18', 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-16da3a2a-af29-48a0-8606-d467c180fe18')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-16da3a2a-af29-48a-3ddec5f9')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"SQL Injection\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18', 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentKind": "CustomDetection", - "displayName": "Front Door Premium WAF - SQLi Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-16da3a2a-af29-48a0-8606-d467c180fe18','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-16da3a2a-af29-48a0-8606-d467c180fe18','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-b7643904-5081-492-b3c737f9", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"XSS\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-b7643904-5081-4920-917e-a559ddc3448f', 'xdr-b7643904-5081-4920-917e-a559ddc3448f')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b7643904-5081-4920-917e-a559ddc3448f')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-b7643904-5081-492-b3c737f9')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"XSS\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-b7643904-5081-4920-917e-a559ddc3448f', 'xdr-b7643904-5081-4920-917e-a559ddc3448f')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentKind": "CustomDetection", - "displayName": "Front Door Premium WAF - XSS Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7643904-5081-4920-917e-a559ddc3448f','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7643904-5081-4920-917e-a559ddc3448f','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-ded8168e-c806-477-d05893ef", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Injection\" or details_msg_s has \"File Inclusion\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-ded8168e-c806-4772-af30-10576e0a7529', 'xdr-ded8168e-c806-4772-af30-10576e0a7529')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-ded8168e-c806-4772-af30-10576e0a7529')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-ded8168e-c806-477-d05893ef')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Injection\" or details_msg_s has \"File Inclusion\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-ded8168e-c806-4772-af30-10576e0a7529', 'xdr-ded8168e-c806-4772-af30-10576e0a7529')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentKind": "CustomDetection", - "displayName": "AFD WAF - Code Injection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-ded8168e-c806-4772-af30-10576e0a7529','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-ded8168e-c806-4772-af30-10576e0a7529','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-a4d99328-e4e6-493-18e2c809", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Path Traversal Attack\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77', 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-a4d99328-e4e6-493-18e2c809')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Path Traversal Attack\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77', 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentKind": "CustomDetection", - "displayName": "AFD WAF - Path Traversal Attack", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-912a18fc-6165-446-55d2072a", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Injection\" or Message has \"File Inclusion\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee', 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-912a18fc-6165-446-55d2072a')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Injection\" or Message has \"File Inclusion\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee', 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentKind": "CustomDetection", - "displayName": "App GW WAF - Code Injection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-912a18fc-6165-446b-8740-81ae6c3f75ee','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-912a18fc-6165-446b-8740-81ae6c3f75ee','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-b6c3a8a6-d22c-488-88ca0ec3", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Path Traversal Attack\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b', 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-b6c3a8a6-d22c-488-88ca0ec3')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Path Traversal Attack\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b', 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentKind": "CustomDetection", - "displayName": "App GW WAF - Path Traversal Attack", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-bdb2cd63-99f2-472-a7d84b7f", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"SQL Injection\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744', 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-bdb2cd63-99f2-472-a7d84b7f')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"SQL Injection\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744', 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - SQLi Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-9b8dd8fd-f192-42e-446ba077", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - Scanner Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - Scanner Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message contains \"Found User-Agent associated with security scanner\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId), Message = make_set(Message), Detail_Message = make_set(DetailedMessage), Detail_Data = make_set(DetailedData), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a', 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-9b8dd8fd-f192-42e-446ba077')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - Scanner Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - Scanner Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message contains \"Found User-Agent associated with security scanner\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId), Message = make_set(Message), Detail_Message = make_set(DetailedMessage), Detail_Data = make_set(DetailedData), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a', 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - Scanner Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-1c7ff502-2ad4-497-a22808d2", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"XSS\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138', 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-1c7ff502-2ad4-497-a22808d2')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"XSS\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138', 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - XSS Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1c7ff502-2ad4-4970-9d29-9210c6753138','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1c7ff502-2ad4-4970-9d29-9210c6753138','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-46ac55ae-47b8-414-82996ed1", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1190" - } - ] - } - ], - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ] - }, - "severity": "medium", - "title": "A potentially malicious web request was executed against a web server" - } - }, - "schedule": { - "frequency": "P1D" - }, - "displayName": "A potentially malicious web request was executed against a web server", - "queryCondition": { - "queryText": "let queryperiod = 1d;\nlet mode = dynamic(['Blocked', 'Detected']);\nlet successCode = dynamic(['200', '101','204', '400','504','304','401','500']);\nlet sessionBin = 30m;\nAGWFirewallLogs\n| where TimeGenerated > ago(queryperiod)\n| where Action in (mode)\n| sort by Hostname asc, ClientIp asc, TimeGenerated asc\n| extend SessionBlockedStarted = row_window_session(TimeGenerated, queryperiod, 10m, ((ClientIp != prev(ClientIp)) or (Hostname != prev(Hostname))))\n| summarize SessionBlockedEnded = max(TimeGenerated), SessionBlockedCount = count() by Hostname, ClientIp, SessionBlockedStarted\n| extend TimeKey = range(bin(SessionBlockedStarted, sessionBin), bin(SessionBlockedEnded, sessionBin), sessionBin)\n| mv-expand TimeKey to typeof(datetime)\n| join kind = inner(\n AGWAccessLogs\n | where TimeGenerated > ago(queryperiod)\n | where (isempty(HttpStatus) or HttpStatus in (successCode))\n | extend TimeKey = bin(TimeGenerated, sessionBin)\n | extend Hostname = coalesce(Host,OriginalHost)\n | extend ClientIp = tostring(ClientIp)\n) on TimeKey, Hostname, ClientIp\n| where TimeGenerated between (SessionBlockedStarted..SessionBlockedEnded)\n| extend\n OriginalRequestUriWithArgs = column_ifexists(\"OriginalRequestUriWithArgs\", \"\"),\n ServerStatus = column_ifexists(\"ServerStatus\", \"\")\n| summarize\n SuccessfulAccessCount = count(),\n UserAgents = make_set(UserAgent, 250),\n RequestURIs = make_set(RequestUri, 250),\n OriginalRequestURIs = make_set(OriginalRequestUriWithArgs, 250),\n SuccessCodes = make_set(HttpStatus, 250),\n SuccessCodes_BackendServer = make_set(ServerStatus, 250),\n take_any(SessionBlockedEnded, SessionBlockedCount)\n by Hostname, ClientIp, SessionBlockedStarted\n| where SessionBlockedCount > SuccessfulAccessCount\n| extend BlockvsSuccessRatio = SessionBlockedCount/toreal(SuccessfulAccessCount)\n| sort by BlockvsSuccessRatio desc, SessionBlockedStarted asc\n| project-reorder SessionBlockedStarted, SessionBlockedEnded, Hostname, ClientIp, SessionBlockedCount, SuccessfulAccessCount, BlockvsSuccessRatio, SuccessCodes, RequestURIs, OriginalRequestURIs, UserAgents" - }, - "id": "[if(true(), 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178', 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-46ac55ae-47b8-414-82996ed1')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1190" - } - ] - } - ], - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ] - }, - "severity": "medium", - "title": "A potentially malicious web request was executed against a web server" - } - }, - "schedule": { - "frequency": "P1D" - }, - "displayName": "A potentially malicious web request was executed against a web server", - "queryCondition": { - "queryText": "let queryperiod = 1d;\nlet mode = dynamic(['Blocked', 'Detected']);\nlet successCode = dynamic(['200', '101','204', '400','504','304','401','500']);\nlet sessionBin = 30m;\nAGWFirewallLogs\n| where TimeGenerated > ago(queryperiod)\n| where Action in (mode)\n| sort by Hostname asc, ClientIp asc, TimeGenerated asc\n| extend SessionBlockedStarted = row_window_session(TimeGenerated, queryperiod, 10m, ((ClientIp != prev(ClientIp)) or (Hostname != prev(Hostname))))\n| summarize SessionBlockedEnded = max(TimeGenerated), SessionBlockedCount = count() by Hostname, ClientIp, SessionBlockedStarted\n| extend TimeKey = range(bin(SessionBlockedStarted, sessionBin), bin(SessionBlockedEnded, sessionBin), sessionBin)\n| mv-expand TimeKey to typeof(datetime)\n| join kind = inner(\n AGWAccessLogs\n | where TimeGenerated > ago(queryperiod)\n | where (isempty(HttpStatus) or HttpStatus in (successCode))\n | extend TimeKey = bin(TimeGenerated, sessionBin)\n | extend Hostname = coalesce(Host,OriginalHost)\n | extend ClientIp = tostring(ClientIp)\n) on TimeKey, Hostname, ClientIp\n| where TimeGenerated between (SessionBlockedStarted..SessionBlockedEnded)\n| extend\n OriginalRequestUriWithArgs = column_ifexists(\"OriginalRequestUriWithArgs\", \"\"),\n ServerStatus = column_ifexists(\"ServerStatus\", \"\")\n| summarize\n SuccessfulAccessCount = count(),\n UserAgents = make_set(UserAgent, 250),\n RequestURIs = make_set(RequestUri, 250),\n OriginalRequestURIs = make_set(OriginalRequestUriWithArgs, 250),\n SuccessCodes = make_set(HttpStatus, 250),\n SuccessCodes_BackendServer = make_set(ServerStatus, 250),\n take_any(SessionBlockedEnded, SessionBlockedCount)\n by Hostname, ClientIp, SessionBlockedStarted\n| where SessionBlockedCount > SuccessfulAccessCount\n| extend BlockvsSuccessRatio = SessionBlockedCount/toreal(SuccessfulAccessCount)\n| sort by BlockvsSuccessRatio desc, SessionBlockedStarted asc\n| project-reorder SessionBlockedStarted, SessionBlockedEnded, Hostname, ClientIp, SessionBlockedCount, SuccessfulAccessCount, BlockvsSuccessRatio, SuccessCodes, RequestURIs, OriginalRequestURIs, UserAgents" - }, - "id": "[if(true(), 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178', 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentKind": "CustomDetection", - "displayName": "A potentially malicious web request was executed against a web server", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-46ac55ae-47b8-414a-8f94-89ccd1962178','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-46ac55ae-47b8-414a-8f94-89ccd1962178','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-f7a598b02ee52581c4a5db0294684ac3", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "35903b73-960e-5bec-af91-0886b5f6f961", - "name": "Microsoft Web Application Firewall (WAF) - firewall events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway firewall events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where action_s == \"Blocked\" or action_s == \"Detected\" \r\n| summarize count() by requestUri_s \r\n| top 10 by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Blocked URL addresses", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize number = count() by action_s", - "size": 0, - "exportToExcelOptions": "visible", - "title": "WAF actions", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\" \r\n| summarize number = count() by instanceId_s, TimeGenerated\r\n| where instanceId_s has \"role\"\r\n| extend rolenumber = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\", 1, instanceId_s) \r\n| project rolenumber , number , TimeGenerated \r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Role use, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart" - }, - "customWidth": "40", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize count() by Message\r\n| top 10 by count_ \r\n", - "size": 0, - "exportFieldName": "Message", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "exportToExcelOptions": "visible", - "title": "Event trigger", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "labelSettings": [ - { - "columnId": "Message" - }, - { - "columnId": "count_", - "label": "" - } - ] - } - }, - "customWidth": "50", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\"*\"\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Messages, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \"*\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| project Message, TimeGenerated, SourceSystem, hostname_s, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\r\n| sort by TimeGenerated\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table" - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, _ResourceId, Category, Role\r\n| project Amount, Message, TimeGenerated, hostName, _ResourceId, Category, Role\r\n| order by Amount desc", - "size": 0, - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Message\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attacks events, by messages", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "showIcon": true, - "aggregation": "Sum" - } - }, - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TimeGenerated", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Category", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Role", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "$gen_group", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Count", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TenantId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SourceSystem", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "MG", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ManagementGroupName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Computer", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleGroup_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "transactionId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "originalHost_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_schema_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "instanceId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIp_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestUri_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetType_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "action_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "site_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_data_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_file_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_line_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostname_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIP_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpMethod_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestQuery_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "userAgent_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpStatus_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "receivedBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sentBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "timeTaken_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sslEnabled_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "host_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags__type_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "msg_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_originRunId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_actionName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_actionTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "workflowId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Level", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "OperationName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "status_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags_LogicAppsCategory_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_resourceGroupName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_runId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_location_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_triggerName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SubscriptionId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceGroup", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceProvider", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Resource", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceType", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_subscriptionId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "startTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "endTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Type", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true, - "hierarchySettings": { - "treeType": 1, - "groupBy": [ - "Message" - ], - "expandTopLevel": false - }, - "labelSettings": [] - } - }, - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\r\nAzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| where SelectedMS.Message == Message or SelectedMS.Message == \"*\" or Message == Child[0].Message\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attack events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart" - }, - "customWidth": "70", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Message has \"SQL Injection\" \r\n| summarize count() by hostname_s, Message\r\n| order by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "SQL injection, by host name", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - }, - "customWidth": "30", - "name": "query - 15" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallFirewallEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('da2b058d-fac5-5924-9e7f-da781ce9aa5b')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-f7a598b02ee52581c4a5db0294684ac3')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - firewall events", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "35903b73-960e-5bec-af91-0886b5f6f961", - "name": "Microsoft Web Application Firewall (WAF) - firewall events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway firewall events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where action_s == \"Blocked\" or action_s == \"Detected\" \r\n| summarize count() by requestUri_s \r\n| top 10 by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Blocked URL addresses", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize number = count() by action_s", - "size": 0, - "exportToExcelOptions": "visible", - "title": "WAF actions", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\" \r\n| summarize number = count() by instanceId_s, TimeGenerated\r\n| where instanceId_s has \"role\"\r\n| extend rolenumber = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\", 1, instanceId_s) \r\n| project rolenumber , number , TimeGenerated \r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Role use, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart" - }, - "customWidth": "40", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize count() by Message\r\n| top 10 by count_ \r\n", - "size": 0, - "exportFieldName": "Message", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "exportToExcelOptions": "visible", - "title": "Event trigger", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "labelSettings": [ - { - "columnId": "Message" - }, - { - "columnId": "count_", - "label": "" - } - ] - } - }, - "customWidth": "50", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\"*\"\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Messages, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \"*\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| project Message, TimeGenerated, SourceSystem, hostname_s, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\r\n| sort by TimeGenerated\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table" - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, _ResourceId, Category, Role\r\n| project Amount, Message, TimeGenerated, hostName, _ResourceId, Category, Role\r\n| order by Amount desc", - "size": 0, - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Message\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attacks events, by messages", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "showIcon": true, - "aggregation": "Sum" - } - }, - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TimeGenerated", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Category", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Role", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "$gen_group", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Count", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TenantId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SourceSystem", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "MG", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ManagementGroupName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Computer", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleGroup_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "transactionId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "originalHost_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_schema_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "instanceId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIp_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestUri_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetType_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "action_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "site_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_data_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_file_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_line_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostname_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIP_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpMethod_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestQuery_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "userAgent_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpStatus_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "receivedBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sentBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "timeTaken_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sslEnabled_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "host_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags__type_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "msg_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_originRunId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_actionName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_actionTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "workflowId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Level", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "OperationName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "status_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags_LogicAppsCategory_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_resourceGroupName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_runId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_location_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_triggerName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SubscriptionId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceGroup", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceProvider", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Resource", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceType", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_subscriptionId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "startTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "endTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Type", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true, - "hierarchySettings": { - "treeType": 1, - "groupBy": [ - "Message" - ], - "expandTopLevel": false - }, - "labelSettings": [] - } - }, - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\r\nAzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| where SelectedMS.Message == Message or SelectedMS.Message == \"*\" or Message == Child[0].Message\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attack events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart" - }, - "customWidth": "70", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Message has \"SQL Injection\" \r\n| summarize count() by hostname_s, Message\r\n| order by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "SQL injection, by host name", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - }, - "customWidth": "30", - "name": "query - 15" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallFirewallEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - firewall events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','da2b058d-fac5-5924-9e7f-da781ce9aa5b','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','da2b058d-fac5-5924-9e7f-da781ce9aa5b','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-7b8cbc62b0925b2d9084c264aff4e073", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "edc3486c-4f0d-5f04-82a0-0c009c1fc579", - "name": "Microsoft Web Application Firewall (WAF) - gateway access events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway access events\n" - }, - "customWidth": "100", - "name": "text - 2" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "b3ac8870-500d-4dd8-a570-f49a2c2f1a76", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - } - ], - "style": "pills" - }, - "customWidth": "50", - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let ActivityData = AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\";\r\nActivityData\r\n| summarize Count = count() by clientIP_s\r\n| join kind = inner (ActivityData\r\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\r\n on clientIP_s\r\n | project-away clientIP_s1, TimeGenerated\r\n| extend clientIP = clientIP_s\r\n| union (\r\n ActivityData\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (ActivityData\r\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\r\n | extend jkey = 1) on jkey\r\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \r\n)\r\n| order by Count desc\r\n| take 10", - "size": 4, - "title": "Top 10 IP's by activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "clientIp_s", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "rightContent": { - "columnMatch": "clientIP_s" - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9 - }, - "showBorder": false - } - }, - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\r\n", - "size": 0, - "title": "Activity, by cIient IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize count() by clientIP_s, TimeGenerated\r\n", - "size": 0, - "title": "SSL use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\r\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \r\n", - "size": 0, - "title": "Received and sent data, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize number = count() by userAgent_s\r\n| top 10 by number desc nulls last \r\n", - "size": 0, - "title": "User agent use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\r\n| order by number desc", - "size": 0, - "title": "URL address use, by client IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "blue", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "30", - "name": "query - 7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize Count = count() by httpMethod=httpMethod_s\r\n| sort by Count desc\r\n", - "size": 0, - "title": "HTTP Methods", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "purple", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count = count() by requestQuery=requestQuery_s\r\n| sort by Count desc", - "size": 0, - "title": "Request queries", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "turquoise", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\r\n| order by sentBytes, recBytes", - "size": 0, - "title": "Detailed activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "sentB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "recB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "sentb", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - } - ], - "rowLimit": 1000, - "filter": true - } - }, - "name": "query - 10" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallGatewayAccessEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-7b8cbc62b0925b2d9084c264aff4e073')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - gateway access events", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "edc3486c-4f0d-5f04-82a0-0c009c1fc579", - "name": "Microsoft Web Application Firewall (WAF) - gateway access events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway access events\n" - }, - "customWidth": "100", - "name": "text - 2" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "b3ac8870-500d-4dd8-a570-f49a2c2f1a76", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - } - ], - "style": "pills" - }, - "customWidth": "50", - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let ActivityData = AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\";\r\nActivityData\r\n| summarize Count = count() by clientIP_s\r\n| join kind = inner (ActivityData\r\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\r\n on clientIP_s\r\n | project-away clientIP_s1, TimeGenerated\r\n| extend clientIP = clientIP_s\r\n| union (\r\n ActivityData\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (ActivityData\r\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\r\n | extend jkey = 1) on jkey\r\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \r\n)\r\n| order by Count desc\r\n| take 10", - "size": 4, - "title": "Top 10 IP's by activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "clientIp_s", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "rightContent": { - "columnMatch": "clientIP_s" - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9 - }, - "showBorder": false - } - }, - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\r\n", - "size": 0, - "title": "Activity, by cIient IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize count() by clientIP_s, TimeGenerated\r\n", - "size": 0, - "title": "SSL use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\r\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \r\n", - "size": 0, - "title": "Received and sent data, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize number = count() by userAgent_s\r\n| top 10 by number desc nulls last \r\n", - "size": 0, - "title": "User agent use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\r\n| order by number desc", - "size": 0, - "title": "URL address use, by client IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "blue", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "30", - "name": "query - 7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize Count = count() by httpMethod=httpMethod_s\r\n| sort by Count desc\r\n", - "size": 0, - "title": "HTTP Methods", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "purple", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count = count() by requestQuery=requestQuery_s\r\n| sort by Count desc", - "size": 0, - "title": "Request queries", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "turquoise", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\r\n| order by sentBytes, recBytes", - "size": 0, - "title": "Detailed activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "sentB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "recB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "sentb", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - } - ], - "rowLimit": 1000, - "filter": true - } - }, - "name": "query - 10" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallGatewayAccessEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - gateway access events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-9a7c892f5bdc363a0a2fd7f5f5da210f", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "fa791130-bc1f-5b63-97de-4a48eed36574", - "name": "Microsoft Web Application Firewall (WAF) - overview", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - }, - { - "id": "b1a1c99d-4498-4e02-82f0-d52c276d5657", - "version": "KqlParameterItem/1.0", - "name": "Events", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc\r\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\n| where ResourceType == \"APPLICATIONGATEWAYS\" \n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\n| summarize count() by Resource, TimeGenerated", - "size": 1, - "exportToExcelOptions": "visible", - "title": "Resource events, by time", - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Resource", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by Resource\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Resource use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Firewall and access events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Events, by operation", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallOverview", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('b6b63aa4-e7c8-557a-b87a-2566588ed8cf')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-9a7c892f5bdc363a0a2fd7f5f5da210f')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - overview", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "fa791130-bc1f-5b63-97de-4a48eed36574", - "name": "Microsoft Web Application Firewall (WAF) - overview", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - }, - { - "id": "b1a1c99d-4498-4e02-82f0-d52c276d5657", - "version": "KqlParameterItem/1.0", - "name": "Events", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc\r\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\n| where ResourceType == \"APPLICATIONGATEWAYS\" \n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\n| summarize count() by Resource, TimeGenerated", - "size": 1, - "exportToExcelOptions": "visible", - "title": "Resource events, by time", - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Resource", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by Resource\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Resource use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Firewall and access events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Events, by operation", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallOverview", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - overview", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','b6b63aa4-e7c8-557a-b87a-2566588ed8cf','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','b6b63aa4-e7c8-557a-b87a-2566588ed8cf','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-fa49b3ef39b8d9de9077e46789396f9a", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "6a64662b-fe3a-5f28-8a38-71dc7f4279dd", - "name": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Azure WAF Events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "label": "Time Range", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - } - ], - "allowCustom": true - } - }, - { - "id": "604a42a0-deca-4a95-a15f-8977646a7fac", - "version": "KqlParameterItem/1.0", - "name": "WAFType", - "type": 5, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\r\n| summarize Count=count() by ResourceType\r\n| extend ResourceTypeImproved = iif(ResourceType == \"APPLICATIONGATEWAYS\", \"Application Gateway\", ResourceType)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"FRONTDOORS\", \"Azure Front Door\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"PROFILES\", \"Azure Front Door Premium\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"Azure CDN\", ResourceTypeImproved)\r\n| order by Count desc, ResourceTypeImproved asc\r\n| project ResourceTypeImproved", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "label": "WAF Type" - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "label": "WAF Items", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\"))\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Label = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\r\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| summarize number = count() by Action", - "size": 3, - "showAnalytics": true, - "title": "WAF actions filter", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "series", - "exportParameterName": "SelectedAction", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "27", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where Action == \"Block\"\r\n| where requestUri_s <> \"/\"\r\n| summarize count() by requestUri_s \r\n| top 40 by count_ desc ", - "size": 3, - "showAnalytics": true, - "title": "Top 40 Blocked Request URI addresses, filter to single URI address", - "noDataMessage": "The current data has no \"Blocked\" results", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "requestUri_s", - "exportParameterName": "RequestURI", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "requestUri_s", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "auto", - "showIcon": true - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 5 - } - } - }, - "showBorder": false - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "requestUri_s", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "63", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule has \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \",1),\"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule has \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule,\"):\",1)),\"\"),Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Top 50 event triggers, filter by rule name", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "Rule", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ], - "labelSettings": [ - { - "columnId": "count_", - "label": "" - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ] - }, - "customWidth": "30", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by Rule, bin(TimeGenerated, 1h)\r\n", - "size": 0, - "showAnalytics": true, - "title": "Messages, by time", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\r\n| project Rule, TimeGenerated, SourceSystem, Hostname, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\r\n| sort by TimeGenerated", - "size": 0, - "showAnalytics": true, - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - }, - "sortBy": [] - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| summarize Amount = count() by Rule\r\n| order by Amount desc\r\n\r\n", - "size": 0, - "title": "Attacks events, by messages and filterable by rule name", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Rule\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "palette": "blueDark", - "showIcon": true, - "aggregation": "Sum" - } - } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "20", - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\" \r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), _ResourceId\r\n| project Amount, Rule, TimeGenerated, _ResourceId\r\n| order by Amount desc", - "size": 0, - "showAnalytics": true, - "title": "Attack events, by time", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushLowerSection", - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "areachart" - }, - "customWidth": "80", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\" \r\n| summarize count() by TrackingID\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "TrackingID filter", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "TrackingID", - "exportParameterName": "SelectedTrackingID", - "exportDefaultValue": "*", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 500, - "filter": true, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "customWidth": "20", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\"\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "showAnalytics": true, - "title": "TrackingID Messages", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 50 - } - }, - "customWidth": "80", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by ClientIP\r\n| top 10 by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Top 10 Attacking IP Addresses, filter to single IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "x", - "exportParameterName": "ClientIP", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "chartSettings": { - "showLegend": true - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "25", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \"*\")\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "title": "Attack messages of IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - } - }, - "customWidth": "75", - "showPin": true, - "name": "query - 13" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallWAFTypeEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('a374c3f4-babb-5520-8832-366fe8bd6071')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-fa49b3ef39b8d9de9077e46789396f9a')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - Azure WAF", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "6a64662b-fe3a-5f28-8a38-71dc7f4279dd", - "name": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Azure WAF Events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "label": "Time Range", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - } - ], - "allowCustom": true - } - }, - { - "id": "604a42a0-deca-4a95-a15f-8977646a7fac", - "version": "KqlParameterItem/1.0", - "name": "WAFType", - "type": 5, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\r\n| summarize Count=count() by ResourceType\r\n| extend ResourceTypeImproved = iif(ResourceType == \"APPLICATIONGATEWAYS\", \"Application Gateway\", ResourceType)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"FRONTDOORS\", \"Azure Front Door\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"PROFILES\", \"Azure Front Door Premium\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"Azure CDN\", ResourceTypeImproved)\r\n| order by Count desc, ResourceTypeImproved asc\r\n| project ResourceTypeImproved", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "label": "WAF Type" - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "label": "WAF Items", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\"))\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Label = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\r\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| summarize number = count() by Action", - "size": 3, - "showAnalytics": true, - "title": "WAF actions filter", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "series", - "exportParameterName": "SelectedAction", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "27", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where Action == \"Block\"\r\n| where requestUri_s <> \"/\"\r\n| summarize count() by requestUri_s \r\n| top 40 by count_ desc ", - "size": 3, - "showAnalytics": true, - "title": "Top 40 Blocked Request URI addresses, filter to single URI address", - "noDataMessage": "The current data has no \"Blocked\" results", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "requestUri_s", - "exportParameterName": "RequestURI", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "requestUri_s", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "auto", - "showIcon": true - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 5 - } - } - }, - "showBorder": false - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "requestUri_s", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "63", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule has \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \",1),\"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule has \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule,\"):\",1)),\"\"),Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Top 50 event triggers, filter by rule name", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "Rule", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ], - "labelSettings": [ - { - "columnId": "count_", - "label": "" - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ] - }, - "customWidth": "30", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by Rule, bin(TimeGenerated, 1h)\r\n", - "size": 0, - "showAnalytics": true, - "title": "Messages, by time", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\r\n| project Rule, TimeGenerated, SourceSystem, Hostname, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\r\n| sort by TimeGenerated", - "size": 0, - "showAnalytics": true, - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - }, - "sortBy": [] - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| summarize Amount = count() by Rule\r\n| order by Amount desc\r\n\r\n", - "size": 0, - "title": "Attacks events, by messages and filterable by rule name", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Rule\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "palette": "blueDark", - "showIcon": true, - "aggregation": "Sum" - } - } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "20", - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\" \r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), _ResourceId\r\n| project Amount, Rule, TimeGenerated, _ResourceId\r\n| order by Amount desc", - "size": 0, - "showAnalytics": true, - "title": "Attack events, by time", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushLowerSection", - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "areachart" - }, - "customWidth": "80", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\" \r\n| summarize count() by TrackingID\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "TrackingID filter", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "TrackingID", - "exportParameterName": "SelectedTrackingID", - "exportDefaultValue": "*", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 500, - "filter": true, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "customWidth": "20", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\"\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "showAnalytics": true, - "title": "TrackingID Messages", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 50 - } - }, - "customWidth": "80", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by ClientIP\r\n| top 10 by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Top 10 Attacking IP Addresses, filter to single IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "x", - "exportParameterName": "ClientIP", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "chartSettings": { - "showLegend": true - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "25", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \"*\")\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "title": "Attack messages of IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - } - }, - "customWidth": "75", - "showPin": true, - "name": "query - 13" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallWAFTypeEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','a374c3f4-babb-5520-8832-366fe8bd6071','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','a374c3f4-babb-5520-8832-366fe8bd6071','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "pid-8e5ceded-60a4-42bc-a39a-1ba9674c2930-partnercenter", - "properties": { - "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "resources": [] - } - } } ], "outputs": {} diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json b/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json index 21c3117b9d8..ba3d8ae4a25 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json @@ -52,40 +52,5 @@ "metadata": { "description": "Name for the workbook" } - }, - "DeployAnalyticsRule": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - } - }, - "DeployWorkbook": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - } - }, - "DeployDefenderWorkbook": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - } - }, - "DeployDataConnector": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - } - }, - "DeployCustomDetection": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } } } diff --git a/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md b/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md index 6ce5789ccf4..e8387e70583 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md +++ b/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md @@ -1,8 +1,9 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------| +| 3.1.0 | 27-10-2026 | Added a new Threat hunting Query for Azure WAF | | 3.2.2 | 17-04-2026 | Added Defender XDR detections and workbooks for V3.1 packaging. | | 3.0.2 | 06-02-2025 | Extracting transactionId_g and hostname_s from the AdditionalFields column using parse_json and Removing the now unavailable details_message_s and details_data_s fields from **Analytic Rules** App Gateway WAF - SQLi Detection and App Gateway WAF - XSS Detection.| -| 3.0.1 | 10-06-2024 | Added new **Analytic Rules** [App Gateway WAF - SQLi Detection and App Gateway WAF - XSS Detection] | -| 3.0.0 | 21-12-2023 | Added ResourceProvide condition as it is standard for Application Gateway WAF logs | +| 3.0.1 | 10-06-2024 | Added new **Analytic Rules** [App Gateway WAF - SQLi Detection and App Gateway WAF - XSS Detection] | +| 3.0.0 | 21-12-2023 | Added ResourceProvide condition as it is standard for Application Gateway WAF logs | diff --git a/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json b/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json index dfe0af4ca07..eb6d9940ca8 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json +++ b/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json @@ -17,5 +17,5 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" }, - "version": "3.2.2" + "version": "3.1.0" }