From 6732c9980b125a75631f94f4a4658543d873763c Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Thu, 8 Oct 2026 21:56:43 +0530 Subject: [PATCH 1/4] WAF hunting query added --- .../Data/Solution_AzureWAF.json | 5 +- ...ss Via Double URL Encoded Admin Paths.yaml | 59 +++++ .../Package/3.0.0.zip | Bin 20643 -> 21773 bytes .../Package/createUiDefinition.json | 40 +++- .../Package/mainTemplate.json | 207 +++++++++++++----- 5 files changed, 253 insertions(+), 58 deletions(-) create mode 100644 Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index 17686190a21..c07802586a3 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -6,6 +6,9 @@ "Data Connectors": [ "Data Connectors/template_WAF.json" ], + "Hunting Queries": [ + "Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml" + ], "Analytic Rules": [ "Analytic Rules/MaliciousWAFSessions.yaml", "Analytic Rules/AFD-Premium-WAF-SQLiDetection.yaml", @@ -25,7 +28,7 @@ "Workbooks/WebApplicationFirewallWAFTypeEvents.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Web Application Firewall (WAF)\\", - "Version": "3.0.2", + "Version": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ diff --git a/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml new file mode 100644 index 00000000000..da79661ab75 --- /dev/null +++ b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml @@ -0,0 +1,59 @@ +id: 16a81a04-3d26-4118-8f6d-6dd3389583cc +name: Bypass Attempt via Double URL Encoding +description: | + Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. +description-detailed: | + This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations. +status: Available +requiredDataConnectors: + - connectorId: WAF + dataTypes: + - AGWFirewallLogs + - AzureDiagnostics +tactics: + - DefenseEvasion +relevantTechniques: + - T1027 +query: | + let StartTime = ago(1d); + let EndTime = now(); + let TargetAdminPathRegex = @"^/?(admin|psemhub|bin|config|setup|install|login)"; + let ModernWAF = (AGWFirewallLogs + | where TimeGenerated between (StartTime .. EndTime) + | where Action in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(RequestUri, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action); + let LegacyWAF = (AzureDiagnostics + | where TimeGenerated between (StartTime .. EndTime) + | where Category == "ApplicationGatewayFirewallLog" + | where action_s in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(requestUri_s, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s); + union isfuzzy=true ModernWAF, LegacyWAF + | summarize + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + AttackCount = count(), + SamplePayloads = make_set(requestUri, 5) + by clientIp, hostname, action +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: clientIp + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname +customDetails: + WAFAction: action + TotalAttempts: AttackCount +version: 1.0.0 \ No newline at end of file diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip index ecd54dd4068e81d2876f6f417772bbf4c42e801b..efe3df21174291899ff479038533c9012e795ce4 100644 GIT binary patch literal 21773 zcmY(qV~{9a(*!uS?K`$@+qP|6cWm3XZQHhO+q3uicHbZSucJGnA~Wlt^Hd#qDPRy3 z00008fc+YA9ZqW>jzJgz0BaEd0Q7%vjT}u3oJ~|LgiTB>Y%QEE>}+W*o$PFnwY}`H z*^qvF`FjWX-TX;}G{+@3ibjfqEmti7N>4Ryw*qZ2mTt^bSyHzWv?(mH_jo6Lnm&m` z_j#MB#%qOriC^W6t{p>}26wsHg~WsLs13f{*QtZrKWtcCl>O)P{`l z+G>*(j4okuuAzdx??9UOB^UNKjNdPVEYJ!?Y_K-($asLv-y~x^*#82|?VY6k z_B+q5g)kt4Z60SLGHum*U*mz9dru>0&VIq;h3Yr`J~S=Gm@3g7u}X@S3tUrKNC*{S zlS#bn&L9*YBZ;t?juhPBQTZ?^UJN+vjZzCQZmZ=pZc||ALZed7N)IfKB!RPfdThA= zs65;>0U|!oHyq#E$sLz(ZGA~-Z0&3X0sBwko8uIMRrZNO7?A{JIARV!j7k#OTTmkh z$3QHE)0MCEi_WlBg%9b{#+B=3}+GI>*u|SVAmD8awTMh~C7|2c;2j)C^jk0?# z+`=XZ+vm<#l6~*st+Ja4a-YBEJn7-UzvMjio}V;!j(4-0BUbWv;fa(X8nOl=4vYsY zD?x6hHBAt8>g!r}ke-&ujknFO@1YTw(Ht&V1fz_?qI|UwXslRuRmsM-aYi6yx!Xq( zm4$%?>(6oHT{WLn;8MYoJmt^f&}*^+GbJxXX@{6oUpb;lnoz&)!)i|Z02@^wY;f16 z4O3(`8^}>v7^qReN`uukej?jjEJuvvoMvWrPBE@2C>Gcyvj&w_vs&Ax@E4QKo{jS} zG7!lj@fJ$6;?Q?P2uI`&zC8Gy5}tifv0P6l*jm0EPj{;Y*hPsD0zA|O)4Ft%3{fY+%i3++!7D^uWy*)aMw0NvbGwP%{Z9 z1ZMLluDd%+t<$AGqpDso4*zTBz}Iycg1@x}R=G%-e=z$M8*s;Mnlx7i20w0iP=Q#m z{RbztK)Jo4aR@e@P72b>F7Hraz%8jsGyFqMGMq?OkvV2eE4n>z47_k%+X&2hh#G$! zM4R&%?}QVe6oj69t`%d+{8JK)))@IYac4&(IF3X_sFk;m($pRm z3aC24FJLbT8Zcl*M?%407!>g&C5~Q|iMCq9h8?5JgiyqDlRaExVG3YDmcapvfPF<+Uvm74TzzE~>83`ZVoJ z?y<@b6K&n-lHffZY-S|tJ|bIOHnkYx{eu<7A}!~$N{-D7b#JrOgX!WIhoIZ5SHX95 zsa$fiCn@>Kv3VTOJ!mzJBZH#{gfJTNcSnj9nFL1opJK(kbZ3HdQH!ixtV%=lhOHuP z#fcWiLMofN!2Y#@9%^Jeb&W%~IC0y5ndm3bJ@`tt& zSx9!E1Cn$jB88Ea-c6N;jFj%)t@EmryOx`hqpKg>XbneZP$rqh0vgRALWj-fI0v=~ z62kSA$R^9|I@Q@eHNwcc8O2mLqt$kBqx6=zj02heF2KH4pQ;yK!H+lzTuRN#4K;BbaW#+{xESd0_6JpV@h2vx?Se(ihSkio z@WK-==H=-Zl_r}``|9U$5-3yAtG9OKxYx)W`E%Jeg*;B71 z_HFDz%kt^|nNry70U5G+Rm%&vXw7uNf|z5Zo#G+-Iv>Q>mXV*;!nOi=UYtc(f)PwA zODA6jv-Iu`bS3Y^`*@9PHG>aq^={-^)8g98@qzQB%GwOFs8IwC(H8|(P5eNt3lJ|p zW}FgbkE%AGrDk6mPUDje_QQzIAJLBo!T`6c%ZgBRZv-?&da5Qs zF1v5#u% zf3C^8B691lk5#5b+1#q;ckCYk!H=lTw%fWK_x4vYFn^hjSWQHpeUf` zqaID%UQNfon%*_Fp$K&1&5$KSW|G!1bv-LnVu=2vxmAY4KQKs=yXfGkIhw^kLQY!F z4u!#299dBGzx~35r5?abMP^P3O%Hf@lc+*1_F3hgY_}AO>%h3+#)c>P5Jztmmz28Bs_3^u30oMT7CSQ}uPGR@ zp#a#CHQc`D7h_0JP1&fCIW&*2VKa0b3~1|zx*MY;kSv;sbr&ABIU_=e3Rpi<#vs;6 zh4C1LH37LQ*|BKwn#hEn(lSFSOcKmBhw;el3UStVcj^O|Zc^~Np1~ZO} z&G|Q(7r}_YJRPe%0fMP=l9Oa z#Lu}wJP11-Xqz6jZ?`NpDP$LC&!614=hAaz2_cW=@B4#$0-wXj&Vj@4w$anv60a{} z{r5QAhv5zbjd@q_5Z*+jXIxu5U2a}&G{M}1wPGp#azTWl9vcs zuf}xOPJ^Rt9q1^Z?XI0p47YhIItqK%+1D4hW=q3`xacF0xZ}okm5LX0^A2NwifYed zt~R#ZWuiv+#wSgEn)}nwgG@Ln;OTUnz^OWc>jgdZ=VOUWeJjBO`>x}%U@PiHQq_f| zf7v2p^qH3Yj?JK!%(Jj^WlM>zNl~C-)Jue%OQr(Sq-5C$Xmat%WyrK)-S{d>M}ca# zaVbvevogy$12I9;+L#(8XFew%t#qdQD-Q)nd@P~3Sf=QHvDx#mW1JIUW6GL0I}-gG z>{S$sStTx4`A*Rdxst8+qZ1icM_Bpp(8v=3x3|CMGV^S{cuWRR^x7)3hM!0}ovRyN zO_p>%sg28Y-m7%o?Xpn#GMWhoYIm+iVurdX-YFu}H>M z^GHr?vo76cQiuT~BnZciP)1I|Rhww+G2@7J%{i)yhKAfBmMri#=};pf?1#11H!|A2 z|JM5j&0qK{?;}{!_5_wpn!{FT2M70-_)XDrpC%oCeSOGxLc6}2UG6RhZ<%bVR>|BX z`P_%kG}#{Ls%FgDSSR-KD}ejCD`m3cf3t>H-`$Itnh^v0t^7)L$9L~5$!)C;OsZkQ6k%+uV(z@0#cjIzvTnjRH^WJB=Hmr1jm`W+si1VX!2a%uP#zr(p z_pH5$H%S0!TjC>nRnJDzEwH>-FCgk}>+yGRCCle^on$G!lk9Bv@SZ)5Bni$IACPXMf6L>HvMuhV6l-Z{*raN^+CA7?IxXGlg0#xScL z1mI|Gvx$t{=eS?MOr1BU+24LLtb9cr$GR}2$g{iJY)5{UPOgXVnVp@~42gQSFGiU`&&Y9H;u)I~RfxO*eE>sJ1;y-cN zEsv=;ol#oive0q0!WI-W&7u7sQ9O>3w+JgPg6D~ST|e|`Tx>(#4CB{_gq!Xd#={!R zTpsGy$&0sOouqi0!aQGND4A$NF8d1Hcbh&h`Byh}pQ3 zf3T@7Ef73Pfs}O1=k&{CaW+XiPTRz^TO`2(7wKIBkBNX4#K4X4(KP zQ9v{!eU@EFol!869KAcOGMseCDH?X+{YVM|E3^u?Yxu|CCb_}*gnk1%fY5RP0f}Cm zUM(8AP~%9F4te~wn52r2m7X((gE9R2%xZJ{6Z(tap$1#;`|NY^)elnvI}8$$UfE(_ z8bJkHZM&qYS*Uq!o~(((XtFwwKPMIf`-#N}#=-iqJ3Yw-)0sI+CiN<(3 zyhSLnSlJURYbTYh+ic+OiA__*mYHTA{Zd!RQUP1#BDx*2a(>aFaNT0L>?-D81e8#e zJ+)%!wAvVU+3)74;YV?8e6D9e9Z$eL0cFJ2GO%7J?%9vp9g9*9Xm`HEMY2AwTY+IbqLX};ya<)RL z*}6fBWy{(blD~=_Jwu)xbosw9-~S8q{eNMs;_QtuA=!u_)lw7att=4=m26zXO57-E zs^@K2nYk;}nkhs6pL zvXvNe^*<~d)hqVRObgAb&C5$z(JS(oP1vZ_O2b9Pt76xr1m(nA8(Be(Pr2DaTCu|a z)K>TZ_aHZrZm%fbmJ=VeIVs+jogJjHXdqR42xn^{T3uolEn8aR@@%R#DAcWJ<3hFV zX_h8AaE)WU5A$tCw*O)@K9K%jm`yo;w3&cKEaEK<(ShtM;;9VRP~5?@C>R^%>y;+a zXqaYMqosw6Xv|I~HEgmi1v zB356_XQ(`VWr?KW9o zaN}N6h)98^#>HltF`41Ks$Hz;w4_X>L18{i$92RCi=|GrR;B8bYNtl+3c5QRCC6F_ z6O2CStLSlk)L{CY`f#s;2hhqswKxrlF(wt#ORoy*Yn?SBq$s`+NrVuX!&vWbeOs{= zW+)P9^V%~S6p`Nv;_F{;euB|n?{D&%=FNS=R-c10Apz*|#Oe?l;(iFCSyAL6n;}!r z4tm!^PN^%=fv`t=z#X{N9fE|F0|HgSz1ZP5 znr+Hv?p8^fMb&bi{%S?74wbjERQ+6kM=QA$N2^H+HcpxN)n}Nm?i|_nKO%7_K#tX? z5;f1#N1A^Fjx_ZoYrL1F>Spkc=pN=qxNx=^}zeAN)h|EZn+;pmzFMBX%usTT)OYjd} zmWIBJJo(iPR2UN{^OD(;@L5oNrJ=oi-5ZsX;2M5Y;W4pWEae^1_(0NU zw$DVh<&=|x6O-T?L!OD%p^2wP`rFFbAst6qdo0z#+<x?XG zsR=J&_@hah9cM3TD`^xA-ZgroHrQ^WM7;vUNKF7rfo!F((K%t2kDfXoez}In>59`D zg@cZZ`*%%D4LMP81SO+AM$9?3fXnQLkR&nmp-N^9#nswbD&)-6c714AXpzw%9wGY@ zIf$a;>l-GWRoy0E%NiTPz66VfCji9rrEO|QJ;*KiiQ_q|{2g52W{VJo-X)x26%xxJ z5{cQV>^z+<=%x^Pv>{6?4PpY>dYj`i!bg}Vb&ukY54(wUKZ&?+Qx=0r$u$QgMdn;$ zWJwHkcNC7>L=O#-q&w~HX%MyC;QVRdt2@v`%~7tA8DG-13w=kk^yg*&)gIrz-6DI{ zvgNaB;qzbH?(cG5`e>na-Ql+&x$}_1MgP4_;O!PL&S7P?*B7NTi>rfmkO$l;VqUUe zVq2`2?Pze1bX;AvgsmN=6Sda2St|BP>@kgnbTpd^>IGCHh&*#BeyI%Whljz*0y^HZ*)xvUqE%w zBPX(2`x_^4DBGNHY(o-f;v%@dp|1`ixn9gP38O`I*#2^y9ax9yg4*mEqGKB2j#&&P zSoV&{&*0Sepa>U!5;=!N($cj))Ip+ucP`s(`__VD;3Yi|DgA00X*gC=pgO(B!?hO(W7#E%L z7n^}OX+^*7LN3^#a#1zI;qlcDT3oJ0qW*S7he$7>Cndt{p!AOMxU*Qe!k6f6fP~4U zba`kzI8Yp*m&OR6WUz<{dbe6>SL~YnicSjGp1O~m)7D7|pptPQ$xyMKee_`TM^m<* z%zdhqYX&V)(pjbYx?Aemp__Z%&?%-)Ib}^aL_8ihWef&;461SxBHxKbgH)Xq+Bg+Z zFuOSGeRAeQW#%n;=4E;I>9bh-p`JUH%ALA(zg#=lt=NlnaeYHk?uayJNE&Zwz)9U5 z?(q(X_8wy-n$D^%RP_bMcA2PctEUMwB9hy8^X|z8J6Bk42iWs&;KCvZvg8wX!N_yv z1)2NrZ=a*4#v=Tk_4RM&lz2n-Z}Ivo`gLzq&Vw`ZkK^ncVeH%FV^A*!{9ELU_uugz zp%gK~nu0B!@wdC6j$SUWPiU)KG=f8qkf>MLxDekSqt=wK>7lc=banX|oBeG~jBr7vOYVqIn7cgKMw(WX&I#@UukiXMUylKvWA1-EK=k`}K_ z&Ejg63P>5Df~ma>81RTAt~l0kz(xsiM$Ec!Eag^2l%6FPnHu^uRY^W#JO;$r@HIf5 zSV*QbQUkJ}nk@Nq2ruI+dkUFtc>0E-m)|79Y!PnfbAwf6M)WKU6{B05-4M20Ya#B| z>`k5bC#X)NgL+&@?1zA;aW?0$pAEWiKJef6$o=FE?pFhkPMsw`%`>-z!SL*NHQv3vmnz8KoY@Iz_Q}yU=)B z0%e}Bqg}W{TuP%Kfc}G&cW?&pB7=mj?J+XR*Lb-SYeEV~Oa@{F2ye>clsV3nc-wUS z`0RWkXW}0XQRGn1tC<3!r^+`o%=VwFLZKpB&=V_fax|@k3rtL-Z`lMD;eySinwX&y zpStaQyjdC&3+5s+Ts#eMbNIdeAy#v&h^0VXRS7XuBc2$6Fu#BWTIb?o6ODE72}$ z)~G)3;+QfBWg0+;7>(=^B%#6J?M$*4NhGOqpiYwKY;&yYM`I`*iLr>GfWlBBM>*o` z!-@>cC3DD_xhXHnv1F0{<#f$SLupvANkcWAtGHEG#Gf94Pqyw zrL1;8TK~z!-8A^KMPRMC;0;K8-R#@*LWNmOLSbAEew|iD< zG+9u!Z+_#6d_cI^L$Jg&>Kza?4iPdku((!NM<%8sI+8V(z`lgDc`~+Cf34x>&HUoc zNleQxA^fKhu^mLwqu2M`;n7=(0I-%1+hNJiU?H)pI~kO3EH z*j~RNrcVvu4T5oOtO>G;@nBmzj}+*>E?l#)wHYby#2p8pdrUJAex16;UbJmO9Pj~p*KlaH*Elg;kTndD(U zA(X1aE2jJ-E&iCU!sxR;veYWffHK|Z4)zb#7HCPw!2$wVb=sd3a{~tI8Yiwc7MsC# zTnOs{)2jx~XA|XW=}B|9)!WxyI7EBh-~Jsub#b?Eg^AY(z_oZm)t9lpopl87ICI(9 zrYQC0<#x!E;;g7vM!LCiyCXPLpiQF&F6Qg)A-jnQ%iCmyE?jKSqT~nQkE|W@qfHp9 zZ6K$POhmILEB#pah23ZP(I!M3?K6b*7MU#_y!fTh^DLt!(KK&}-(zI# z!?>r5+PgbKF*Kt}vU!2WIip1+ySsAg2E%e=qvWBu?qanvb_-6Udu#K!R=myNCt==9 zuM36}veZTAngNA-zhXKfPTLhrhyb1>|Bk~n$F5>TU zlVxC*ly+3$e;u$at2o1wR}_+n^onQ2Atp@tBl2f~BV=rN-!L!r!foy#mH1Rk>7O{r zuYj$0N$eg#REf!5QCWk48l(?w_(D<|B~Arn2Vv&TtJ zmk*y(PNObqEk(y+0jndKM@@M1` zC<#W`iy37c=P6jCW3^~%y~xtDv&U=PZ?iMpL)WA;O8O)Iou$`* zEJ~r3s?tbOoUgL?sNH*j)2UC=J=AZ%kHW0`vu1!>uWEXyUK_CxadRSbZ5^>r-9%sc zmbu#E1XUN@+kVG38dh+}#z*n@@xz<+!cNwNNvl z#wPrynBy2GtN=f~I7k%|jMv)2;cHVNd|#lE&bSWC*}UExVD z30e)(Zj}2~ppALoGjegy6FLPLpSxsY8B6?%_@o=8m(UH`bD@f`tLT8sR7sGtrN6OM zu1^K9g^ihrws&HnNsRWyccNX&6(2eIlaBLXiY?3yEp{3f!zlQvG1T9#z?5q5?%fu`QD@cBG@$K`y_hrlMxjQS)_7pk>U7Mpr6t~KM7;D zW4&hIY2!&bt5U4TzbvDP14(*m4?-YF60?#`;;B0f*(~2aYk%UlPPSO=q{&B~V=mSX z2o-X20ySCYyT*4^GPal8_8i1L)XuqM*bWwl*M&NW)*KoF=nfLCjt@i0`OrgU`re^a zr=eZfg_Dn!3SZV}GdDtLGeMGAUDvBh)a*u066b3O`p{@I2TYKOA_hzzhjdsq-lsNb zGg)ASt=LT#=I#WRRNW@3pqRjWJ`}SUpGjoXJ@=E=Ba}{VQ&WTGNaKM(eJX=q4Sg7& zm2>b!epTL#t)E^eCrb|^1R{MHT3cH)U`k)I(oYbvanh~>b-e)oT8UjXJV`AQ1xk5n zeCWUai!<)x(ug-gFH}3N@%SpGO4(*Vk3yRzi06=w-R|XVXq`cg`-sZ(+nYaoKtI`b~y$0}o_vz)tZ^ z#!y({O(v&pmzXMdeAh0)vO;6fCLtskzM!XL(^w^qqi#9%fYpN9A(I)ZRl?R5**=xu zKMa58+l8!N*h0>`EMY6sC5>4z-2>%YZJ%DCN?bE;7^t-s3lUuM_UKK5xYln_*sWx- z-Nw@m+&k(C00H9-!nnef>~5ZL?DPh@oKHe8ETIV~xGy0iD-CTb(stVa0eV&Uv}NauYj#7%4d#C&5tY~t|B+-j%xNPcrOMUlJy8dnoWrU~ZF2a;$ExhqRSixD zCi0=ENj*VYm1?x_KDzMqx5{s(LT{|}q>0u``Rd@IS3pAfQ<3y)$U{G^O#3gJF7Enk z*%v=A?jd*>{Q7%Dbs6BK0o?IM^*yu;NzkR*PVF!RNKN^%^OsaNf?P?pK>q-mEl( zdrANNowhFdcGNMRq$c1K*rHtSR@alEN{$zs|BKs`LA}n{i1`8Pb%eItT~&qIclnWz zWQK6D*{xTDS{r##cYeRl#|?9%sNh5MuoE%loO(AoB#iEmK9L-0Gx5z;n!j1Oyg5s> zS_Xoy73q6qf;AMzqwX#uiMBLcync|9IA@>SImp*e$|=0$Bry0A4`C0XN8J0)Li&Rr zBh*?PM5?5%i`1(pEW6O)C0>x&aTkN^GEnH20ul&yLj}oW%9ac=If0fTJgkRB?ja5DB3f08w3`LyRRIjAZf@{Ym z>mSA0@=rNXs8ara%9ZvZyFvX^?ve|%L4$n79-;_#8+=}Ko1pHWa_;9+4iHVL>>wM# zLil!}{PBbJNl>8Cl|!$F-$2*Oy8mVT4Yc9No*TNi533#LqWn|-9Ou0q9F4>PCB|<6 zQJx(LsS$C9X1C}6-J6k$25mWi{pnN zmBm5V1taI%6ApzH*b{O)kO`{tCdMKgV2^`ZV7%dPRDL4;H>#z4D0+fskn{vg??{fW zrP`Jlg4!)Zy4FuzRs$jw^WNl1y3jAh&Waiy$vwtgGPs5a`M&o z?VO+u2SZCtJl%jpaJCG5kJ(iV+R5+fRqGbNAUAeEPpVXxLTW(s46Qe)2m8{65O_&y zR*WjcC|sP84~{wX3JtvoCKSACdO~}?w-yl4O7N=^eB)@I^TfICy1_@CXdwoExOyvo zGOF^>cR~&h!c@9p(eVY=){0OzIXzxXqB6EkJ;Mt{FIke`Ar1FZcp4R=R zFM@2?V1{p0j76glIPs5I8`)Y_)}~T2!{&MsAC+r!F4pHMtO@{a^=0Tv&wtaj@&mcG z!t9iVV`Etf^_OMpq8#FlzQ8?A%Rd8J&nIWZ<;?bsUC#*Z2?4a$#+nM#SkyYuw`uUf z^qdKrImkc{Lg}=;o~k;hbmT^MMPq}a5T)I`Hp&$ZLNtN=%@&M(lObO(F`sZ*JYV$Z z`v&aF?M#z;Ff!tAY7+^Y#1zb@`O7^5Za+d}#-Pb3QSLnHW(pgttWB{6&!WUfflA=G^V~rakD*Yh`|CyknE3c zl=c!6i!8HP3rtv#E#?nrhmbl0{%RONr;9dYzLLS++QNe%_yr6^08|y0yn10E zfc&gB(v~SccLijChiRVy_cwXiK<3waheiGZy{D;F=6FA6&ta2Np6 zIiD5$$)BL_8tX=Z;=!f}yAhVB{vpZXA_KtkX2D?*N>cWKAFN{OY=-)DqVv;6ng#xZ zvXc%MafVMD-3163q6R6X?TO{RE#a`Y+=`pbDx ztC=jip|-49oXPs6S(pK(nEiFuY1+If?zL*$>fx6BNq6iEsg>g7#ax=hgbM9D+k<#y z#*FRRta589T3Boqt=d@b674F*^skOtsb#e<+Smj3uJbCZJWyGTu;Xm&aY9m9u(!{5 z8Z(-IMUMeiKUID%AW_M7C1CEvAnRj&P=75S_x|bA`iFh8=neEm=tSZ2RjT{(v2n3* zXZd^-zW1qSN9XnD5(#e-KCmm6NW7f=C>)hKQBW{Z26q*owsQ@01E1Y;!j~whoECec z2&+YAE`PTqYDWJRWSqPo8UtxzP0s}GZ)|PgT4nAq-)>ib$}*jg#8%!Ky)>s)S+@dSo)!7;> z`QGBwsedD?R$~%yQ!q@1h2=NSn7?NlXSLID$7eAd6~VrDNSHQ{5Z`wZ`RU0i;frWP z8ZyzQH@q2+LDqK+R7O_Y?4q$fNQgzuGT6svfn!XlDt!%II9Gr5aHxt2&DRENC#btx zjGY#~eonp>|5o?`E^Hx3E_6sFl+s1AV<+yZFKkGl8!wCFvA3w*C8 za_ReS5G#eZ>{zzSgMw<2t7+x*Ne6k)ak_+opNA*#-W$#H|?6(JEMrdO9Xx;FJ0Jf25ISd_!;rZL;Of>hIqlgC3}Ae3g3k35fGZVUv(0Nd0 zbl6ZZG8pdk$<&zlBxUE0(3}Ri@4GkM@DN0)Zx`2Mu;|D6ruW*Q;G%vyUztdikp3Gi6G*SNy}RbBslHoT?V z{iM+1>v$y5dM6O5GF3by(9|oaNkN}n9KR}xqFvwV>MF!bPnj1+sRj%tux9}O{rRs; zYwxuEt~qrc@nvky;dTNhv7z=Y1(AgZY(~HN0e2Og`K{ zI}L3!?_6`)EzL}CJy0yc>EEhuci*{gz9-!)6oAOIh2JYSLpAjGIH&_ltq-MGw|atapSA=}uHY z$QrU&s_kEKpjG3y`sdz6Z&d`ZnBry`shC2v{r(Cf|JeHEy zcG&g;sJ#Pv;n}b5<^IPW3cR9PC*!sh^L*` z9HS-gb{R}&))(FDQIc9SE#?Y8gR3{K%kji%HZS|OPOB3zEjIn=3_MzCxs&g6vmTS{ zQK%1ewxA8pDz>0+s(y|}J~h@nZrGE81o~1SvO>mbj~*z8Ozp4y$JKO!-qVvoyJ(3_ zOIzXgae<9M2M3}9fn+?Q$cb$T7|!S~${w`wx^#DLOnm*b2yrhO_c(yu4>ln-hZE_L z{r;hF_vYzsRNcu^>M$twN&5u1bo(vYT-b6lKCfP5G9JCJXt+4|YAF>##QJ5v;h{6I z0x1$aM^WBxgd4EKt`PtnXBXy%4V>`;sh^zO9rm^qm;1;hU;wLRF+z|7VKQnEZ6Vr* zX|(e^l%WJW`J3V8a&t5#UrdC}~J)M{t6`CxoALY?-Q763p&ZYowgRP_*f)K z8VJ7b;&GG!44g}FbTr@q?peGhp4t=-RFsMqVzkXDq0_^{9O=u_S?imqpEWSt6;y`V z2n98g>(6CQgj7X_YiS+x{1%Oi5oJ`}^TCBCG4Z4sp2MglYu`-7)#Fk1X>Ix1%Ni8R z%dl!7kdvYj7$p?Xkyyk1*Ai4c1kov3srU&`D0ESXzVJ1Ph@>!6QWew`YOFmaMB2Nm zw54-`k$*pQ0)C>ma82`#Io4X`6Sg=QXn@3a_G$27_xgFeF?&TM=|V*~(pn+J;nh)j zOqZ*|sxyP|9^{jKbTO|U(RZ%IS73D)ROL_4QH&MZVIZ%ELinm~)LyCV5RLXic{OM& z)5}FB+q<5vq;%*_UPH2s>=MEqG3-1e&%DRL0om`qF{4g>^+@JaE}TMI#v)YM!7(ct zDNK@&Sk;TCP8J+h4;~BBOckV=Mh!EZgsQIu%dCbkRLNSUX#=x8_~jdUHZiI|s_28YJUaBL3Yrq7k9I3jDeWS5uBSEN&)KuV8MXq;_H* zXIHNlt_masZb}h@Tx`lH9^_o%%61j8Ql$)8p^u6Q$-ItWwRConsg15^+xD!=C>Ai8 zEigQvELZ>FM;!Jkg$Ini2ln~;s$;Nid(QHl~Hpfah!nEj*aTpe^)J&O_Y#5Kkd?YAMtRJ@duK{c8Xc>{}#W(3i0}#9s&ewvvKnOIWtu z8lr5N)Y5hkv5u-kJge}j{53Ny=jT3oD_=m3qE1|NoZEfGDiRmZZhnI+vGjox zwUB|PudY`U@9cvjH?-qkgUX@A%=We>L(U!m!@mnw4DehzN_f-e8%D(l3YI204+jOj z+z8{r@3V|<)E?kHdG^tf{@b0wdiB>BnRT?l2vns>I7rV!l!4an!o^u)6r&1`03 zNv~kZAE%4k;3P8vok4#VKoZ!*3>H(Z;wI zmK%n7>s08WjLbJ`>tNTZGor{*S^}tngYp7_;^&iP8U)!5f4e(4#c*JJY(RSwVF99H z7g8S9XdBzP8d*2#r$?!de$OV{+l6e+=_PtEwM<9-qU0#SZZmG$x+dzRZDajy=kDb?PkL#%DHkOb1=h>B& z;ozh}N^wFamhRNLaAxu~F-vilG&q!{YN%TdDGG}DQu~EV8dHqWTmUxiofyt)`}x}hm-cK%9JU?rD=1TR5Z9Os0b3O$F?XL zTOG%@DtNq4RDn47CZDRwuz6mE89OblOk7E3ZY1AzAfKM)C3MFPDk@C?m+GqPkC0j#MVu#w%L{64b6XQDuu$laEyB61rM4j-KyB z+NAeJ3MM9-lrYEJ_i+Oz|G>WV5qUJ`3o zq`aWIz@QuRuyho$St?bk*Q=wOLgw)-vg7?(3YRThD4!L!F=Ftjpe1F7DIW54W$~0b z@c9bY=PIi`)tInobgY^(WU8&2v@+(cm9@4tq1iH?S;lVvm6ninX@c+mYg6zL8Tvmb zNS|~2pA+okr{yL%w&^@75ZH^5o1z2A%K1Umb_uhOgCQKG*Psw_K5L~YWMZG_Gdpe9 zw}sWMQ%8#aCi!ym`iTnZX8F&))lJj__YRrWx9@iOSEN)uQJ5@lH&*4<5G~yq#ap$L z4p5}$sAw;D>Ihjeci>hFP_k4jVXH6~YAjk^r_5WkY+50tA9TC_IHSGvgjCMb5w_Od zviqN`eH0Gb3yHc9K|#CkHQ`McNVnR5Bpd)f2=x;`e@GmB+h7S zd1ZER+%8e40~lDC4{CPus@75f?uDE1q`|X0*7yMyZ&q)o z#-6OJdZbYp#=U8IwC-{XaNiA5j&pS=2q%o(nZDtbXUa^KL$2^%>8ns z*!V-4JX@HTJKhdrHfft-=aCz37tyO3rS>_9PW|&o2={#Ty^vFUH2uMbVZx6A3!jBb*|jFPrUXJD)1m|%;Ft(K!r&TKtE3qB4n7PzXe*o7)w zN1cAxro=npIjpZRC%E&MI^mOlprq<@2VJ1Og9Y+?BOKi~FOaTGgjGJCj-D$kb`U4~ z1RQ(&HUAGK2?n6jMe?n>8Ol1C%+X4v^6ZL7O_8S`NK8dpoVO~%N4vHn~2LGLiqZRbix60n0~~k1#G#fyx>IhSxQ~6 za4+e%t;agGGiQ+IsmgD&4jJAfJe{>EGfr;gdC?%%e8aE`(+js zwbHIdt>!UqP}>^y7EhYW%b--r!wPaVIV=ooHm}dohwc5+pQ{*AY3P1oV;M!ElFw?n z3I=e&`z@_}xHA<+6*^HwUfu6kwyT1{^XoleX6fRfn%Uk2$~rsD8Q5a)T18aNWXj@U z>$h6Dr)~23rrci&(`MhfVz%4tVuXOVV^fU3*tat_KR>e!krrEO9Hs>u{w*(A z{%}z0@tqL(Q=8V8tCcOp-vMJk40Q^W}jO}A>bH~-Z$eV9QqLRjB&jqB6W^_o?nF)P1pxMpRe8~ zo~}{`O+*}AOGim^s-$5jfEa=ps*EwKUJ&G-St`jR(>GL9+C#QAb^FZm_sH>gQ2BcM z*QCEik1ey|*Qi7oO&&XJdag2Y6G*8~{g=^Plt7DOBH1a3~CMjvr6vWfB2=7{UsX3f5wh{KwST?(?S`-9OaW zy=*v#FSCKTM|A4kdf0#Ce7qT7`wn{nkj1`bRLe)8Z#$--?_7-Q>snQ5N0$BgVI+j~ zK~fD1ImyRCk^Uye26B#tOxKmn)X|gTqxkbh!1jb` zSfmz*lbXBDP-O@1W*c(j=l*%=C)wohz&|bd5g5JUqPuhPuVlJmxuOsgDiP@Yo>CYhFMBSbrfzh3#HpEo0# zt(iH`ANu};`M5V1L}4gV=jcK+%f=^45d$G;!Sf^q0U=DwzX0#2iGV(Ii91$#Qfd9{FG zlq$YX4P2rN#Njs5FYa~T8X;X?orYrW$1B}h)60sqmIKv(PHy!x?;B?B>@?Q}kuF@o zG;_*#?8<%*8>)}Q#KG7Yw;y%<4z`Z4VOLE*IrI~Q9g?U8`uR=@UNw+}FR^h-4@CQX zLM(%K%s@s{A6B{Lh6e@KiKqE54}9*8SF#A=f_C*2^V(H@&qkQJ#M-Xf;hoN+d`*-j zrytIPz9TT3dPYgt6|qdVS)p9lF<1#D$iC_vh$S zk1G)rEfm+)^edE~SOSKcc467$hEXr^F}YXzqc1~o9*qW?kS}qozCU12WT4Rh21tXTulISE>*eSWh*{7>280GGunFcor*L(4g#zy z;SFpeKPc)j>4b}ovE?cSb+igu@uhpSuo_waz9>*pLyjT^`(-!(k*x;LLa#(C-N_S= zgGgeH5>U-%!@^Z~d^O2bbp-BF!~h%Z8|`;G>}@)6y$St8nliV~awQ2nH0>~_wfJJH zr2_#UYmzC`d7B}cd^hg5@bz4+ieA_9*rB&LXEq5ALsmNDMmM9D5mall` z$LCgw74C6eb^8OUGTJ!CsgutA9_yQB-zJpX3};9E#&t(JLtTYRY4boPC!@QOZ~Qo< zVNoJ>6uOjVrah=khM1K#o0)65tY`BYnOMW018lMkqMk5!`Fa0aU;b7qjkRim`#FgM zrxZSUxlIt|bChy&40>l7JO-5}5h)x8Smi~K-sf|HD$NUj=F%-&BWr}JXBcqQPI)_D zidBGK^no*DCy}W!YVL5M7xihhp?Hmm;_dW%!8mj5;KI1r3hNCIT^nV_Ahkdt*dbtt z^uQ5CUkz4o`l=3#eY*e7tkFRoT2Y)mW>mN2TSz%0RobDz0tm0m#BBYbM>PMEv)tXx zT!;&IBy#I|2E5Ez#$>4gKNEfdZjjkN!Oo0WfL)TAeacR=wJ_q8vJ^;mL!WbZq3ki! z$Fu!e!xj^z^imqy@`@ndA6nVyPE+`?eIh37Df+}u(m1Oa`IDlC#X$|Tb__`ZTo(VC z$$?=>j`%Qw(tUJO5&(iGGiv(PeP*23L*oueNUWAv6^I}lS^k|%0zz&1mCBgwcOql- zC;q!(#S>7odz0Asr<*@Skoy0KWHAP3SL;#-sn4BSlfR+03?sgDFpTn6VJ(dOE@-$@ z!y_P~Ch8Q<%_g1yh10o;C2ZL%p=p6)6tpdr-rHhS92&XlFba-3Y;@SSz}TkgEXcma zShEZUSJ zUG|~N6rPu2+Gt!U6KkQ&YW0!e*I3OSJwGu3L4=&6Ku)39ui-YVZ81}#Psv}u25eklmE z_<5YUQ@_}_xYHBz1&YXfHf<`ZH(l;34uT4u=EG8djTHc7!+!JQoGj%=5+fwF^l(_V zrS)Q!Dj}DFG;xv9FdkHrtP@h^P+Ky}jyhnqtKw&~tlhIIA4P@k0(D(nx$6QT=c@k%Td~jpWjF3ROnO*_C{Z&7Jbx33zLaBNzJOOCES#685S91d zr|qWEi5D5PxSY1WJVW!KGgK`2-cysa3wD#Mpf;DRv4>l3)^mA(J!Kb-s!mfyM@DU$ zlF5CllU$w!PoELfGF2N8KOkJm2GK%);nVXx39pwsEN6bNf6xWdqRd+SOf# zT~cOmwz!v@w>Hhw!c@L_&?ooHCW;KVE+2}dF9p1Avx!>o5k6 zu(tT0^RSUo1oPnc6#9eIRRS_Yz#K(Wfe^?>B&BJ3xea?*?xV*}%s##2n<>s*?QLGe zal13#P!B2vN_;L9^K;tu#)p348B1PJtEA%^6Eb-zX7xcRq7?C0i5`VHK?4%I%4(NU zKWM*()OksX^g-}z?iPNJ84f14N*5t#_$i`nZkW3LbM=dk*Wre{*t7wX949$~yVL<` z9G-CU4MUlI>2(p@LYF^g^jCN6mn?`{im1G}v^PaP4_f-Pf#BFmjFDvg*#WO0xfX;rigFs9v%_BR}wD!j!&3{5?N!`}uF_QQE1kIkdx#ua? zE2djiY#A{wSJE4_Rp}ggsjav-}(>oyB*@)=Fihhswk|d%yde^ ze@C{WjIQ>Y5q(jU4vIv5Z2a>k_U$j)qbvH~gUxF*vCST3@PKDCv$)5mi0u2;P}Na^ zSV%^D&(Iy9G}UxKGwqhGTjj=?Ou@VPrY!p^$;^0$({&|^<}+$F@YcTG7;(U$b{ z1uQW({imcfdQ>vn?^Un(j?Z?XGf^`SBb|-&;nG@q!D@|2uE}1>3riqxPR#yHDhlH}ESVw(t)=|7!MVR5tja%fOUl{;ml~_IX$_=2#$oXet1o_w+>xEzXoJve37# zN;~E@pSjA;TBiVA=iuNPeTi|W;K@K1awKpjjI=D-q9xu6w6O{8cE+f;&L?dmjd~3U zm+P4_2UsE>i3&FDIy{xl88&Y9?j3jKMN62-J~22#1$i47*$X z7PXv9c!?BIkDOD)XI$YK*h;_AF1VPWn>-}f)YGdN8fv@CrwYyGL@DRP>?20grq)XU zPUXX-fzF6gL2smTo0*d+hT+Z$6$T%%Q0x7MgmpUCtaa8)W3N6Ic;^ODfeX5^ix&+y z(_7|a&vDO=6JevuCXxcDXEcuBwYND$?VW0*Qno4ht@>96#U4Ydjc|XZRjwShO@@GU zZfQN@Niusa8$c96DtUws=L8W=Uu)RgjoR=@nVZDCk?O}x68a_V!O80hM%q@jI(YGT z=VXLtz^@f&RzDE1!KP4?v?L`=QFn_}WH45i?QA8SZLunQtB!W)&pvyZkX*+CG7ce9 z5Y$R>c8u@@Q5+7Zz3$A3_4ELh<-rvMi!f$uA!UYC3~NeqotI3>&L0@p)&Ym!ytAh) zVV*3{4yWW4d{R@+M6t`dsuX+#r8@KCJ+Bn$jcd!4Su!RE)0AQZwcgMnJoPr&nGY8R z4`XJ$L5jjfh$R7vkW<8n>4w$)Ptw1+%|RBvw7v&v_xc6MYLB_X*nLjCedfAb)TF1JcxV7ytkO literal 20643 zcmV)iK%&1;O9KQH0000806bQfS4Eyfw7?4h01!F=02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH^(~8w9q*;hY=4b0g_5zyBRT?GMHq^N`hcpf6&dQ)@b2V5{92~O1@MivGz>M%rc`^?A+<00bz)}D>Y46|-piG>n)6KK z6p zV~(1I>=KoP4;NBRB?x2UvY_k&@oPFJ6)aQCxY^0%21Hz2hIl38ko|;#Oz0*=^X3ib zt=gtFL4m;O2&f^H^n*-0sH0wu!oElaau0yae86b+3|y+1I3js&EbIw3lFC@&!8>j> zLKcQvg%v(;(RZfovI%cA;t}=~(nnu|-MycY4APos)=tp0$1H z9IrI;oJM+*1(zhnQ5T=B_@P!4;U_`lLwN?2L)2dpDbCR5T^?6_VrV!hEO4I9mFPd{XI~fge*+mssp5`(`UHyjV5Gc3-Q;$33Xw4=;&bCXLvnD(Z-j4V)K4& zr(fG>0!?#oHDRM)YxZkSlEqK2Hjwn$3{DB#n6v%)7*V!Z5t7Q2QlOn>(F3cX=*Hkd zQPs=S?_xB~Injgi&XVRm}6Ot07s3oa- zZ`Z1(yefaK=F{6PcMCl)*n&7^Xs!S)9p|kTF*ZIV!OhwNhh?H6r#B zx$M-&xMDKz6FMpJ7Ex|xlxGQFRR^lZF23Yd*3F4$u9&N)lKID&KM&Fw)qssnG6riz zOP1qzbHEW0msF0m2pf#*dwWWj%d$%Rs|KCL60RC*V((3rVElL=GDE)lz@F%Kfw zm5nfk(JWVpB%Kvm)jDOZzC>^aNrrWvI^T5N6drI`TZm2eBopKw9ltQVbH{r&{Aw=0 z9;dc3hBU!~7K$zKV~fJLbMe(&dnI#j-QJSN6wZ{Kdm%SS0i+vJRttNDbbwEs_s!B= z=9ctt(W1<$wa`7?)YXyVUb_Y@3E9+D-_HAPFJ0N3(k;I}O7>TBGDS7v_Rg48AqG!u$|$K@&83eY$qI({bY>O>Cy3Dq zyOt&}i%It)U8^Px$VeDFemOb-=KELq5LLiS%LfHPAw z4^ywXFBotCU&FX!+ZC{^xyQu>0ZNZ3yt)bui&~tIU-l0R)HauZxamImnuK=Uth0d6 zu{jLP10(#|;~-p3xGoMdO2qC8>Sw<}P&51~xn@CbHc-Qx1GGcg&Cq{Xygh#$yrs=< z@6Fl)_x!g2xGcC$m=-F=Zh&A$8>}Yw#=tTnrIVH8WQN1of>W58fI6G=hcR*v5rlLM zn3Vv=!5gfg%_)X<8iB(4U%LR?MvfEb1I$DS3_~tZ=?<7Xl)}z}c{bTmP|0Bu&>5wn zufte7g0ZA6R_lWMn2UtNo&BKra?7qaKLl9Z_4XD%{FHyFm%z*rr-y`~#V089#ElC}j{i_>Wt z8qnRMAlJn?dFLr4f{uJTwXHjJ#Gxp*nWy)qJCTC{w^Pn#{%ZaPd45$qWRO2i4yFt* zB&j>AOw4iYYO^CpJ#<$cuo~>a7?V6CJl%1Q+w<>BtPHUik>%zC8ILif(`sSE)FI&V$&(m`ylD4BI8&WoesiB%+I}7&)fWw(0&0)h1-CUFFk)Q0d|# ztxxx_I4v$Rai=AY3h8Ud7_QL#C|&k8RwA_FXpz51gj`oQR&n5yaE#99h(Fd2BB93R zL|_@@u7usWWLPPrtaCG>RLLD`9*Q`0C}_d)-wp)qWfog|(0IH(hkc(S=+HIw2s(>( zEjb1wjbUGYOd*o)Mx{r`OUy(dPB2Kh$Ix+h>Xzwy=mWG7j^!_c$Qv^`qNr@>wpCK2 z3pvy*aSF^y8wS!tS7+RIUmnqwD=rbCJCJ2Yg)u&AV|Cv-QPEbn)9XGv-|lX2wQ}h@ z4-3e3?j0-z!@JkVUfDdU5DPAy%d@*^W@IAc5FW0&cf1IS=AT@jPi69 ztC@N3ADlO16N|PmmRR+5(jA5lDR5pa*@J@c#l3*=kl8VuXhv7SSO7hz=-RRP;^|>= zM)9u?i=@DLuE4`$@!NG`F^b^r>BGdtZ=W6xZxa*ALh0uF)5YUs#>SWTg~x{pk1wAd zEN>GYzY17BW|(}nZdjJAjlDKnQljbZuf2Ko^l+IeUF^!x@eHsLZD4(UD19FXbTpgX zIXHL9QIB(?R4{*Oa#gGrUy2i@Xj+QpA^uX1>CZ~kZ?A|ANc=& zP)h>@6aWAK2mttWl~?+*AY0`_002p(0ss*J003=aX>L?yZE$R1bY(7Tb8l|!U3pXE zNV5O`MZE7&;n{e=gawu?U(>;ROVdp+G4!#(OvgSTJY}hDYmp_74rr#A@4i`=E=!hd z%RtXI6ESVqk(HVC%dD)^U;q2R5NiCzH>PBU8$Y4OGzjMYPX`A)Wq*bpJRvjU1pD}p z&?EbXI}>^Sf!0z7N=sK->VZk-w);TKU6R?{#sS&?r|&vHG@7gd!*v44`;~aUU$Pedp*9-nSlWCM8PJ}fxqb&He z)`e?_0W^jJ!4Mj|9y+2zpwDE4j^=aQGB7K0VtM2q+cw($d~~wcpwu2YV{`0bU=H|B zux7iwUYrDp!NZ);cKyJ!oQY(K%4Rud#F+$B$W`NHlZ47(BSUQIhioPxQN3U z`4U62Z+xTx1_?z41r(J}G7HHzG3ckAW{jHM9htwgw|7%6drIUbk`<$^lE|NBd&mJs znPr^06LjQY`ysFlANrDjoy3-R0cK@6#HQWrlOUWg6=meQx2i%(uh)ffyUQ&V9Ku*8 zkUM7irFK_MK_8@AD14_vlN10oR1W-4DA5)7kqNs=rvNiAyr1Mk^Jr9fe!b|S!O$Kef>2(4o( z^W@Z2ng5MDwK2@(CHYKbCApzgT5qehe5Rpi6Mad+D zDiWTJ!}%I2Q_V7+$guZfP7I16PDw--1=2Nl4weYF(=4m4n1-^`3?1wDkZ{MdTTKCb zMN$a-GUnA3fYa1OJpaja&CrM-CHM{SElDwwG~i~ZMLFMT?wH07`+&Fr7hC{Aqp&)w z`Xr&399-d<7nO5rmKl8!R18#SRDSt4VJWR!3n(sRgv-?Bmbvvk5)Qc|V)=9ID_ zT0DdOMTU0rBzhLi-j9}HHkb31#pWyfszmy<@Qj<-X)S1aw$yP&!Sgc5mBVozMsq(} z+h`=#7VRZZVGE{`HG}0=qH!zHmRX5bY$fk_gnPsS+)`7~>NFLtlBsAf&{VWiQ_)II zMcb)@TK%4=xS=OpP-Z^v^>^cK-G~=ynxn|fTeKXsnUL;<1;KgOC*lHEcPo(v6qq~uTwUP zaj~~HjH3l?$_uAbO(x#p4g(w)kjwX23}LMd!kUDzRtjNWv}@uv*06%d+Cb6!xTW;F zt*&C~-JYTLTVtXYLwH#XToJ-m+OH1bCy9`AAY4s~6(GD$uv;^PE6J3AuvQVm?J@|r zt3#L-9re0;d(hIAPOGmf`ao+b1GPsK-02KV(`f5@e_RORWpQyu2v=#pI)tAjYR-Xh zH7Qnr@Hzo-%@D36(;5)g%OI>v2&<(KW<^b6_SJ5mC`KPFOz-tHu)20jQCpo}m$Y!N zqYVlnyev$v2;nO2SBLPE1kpJVt|r9_5MC!9t{K9WWJ*9-tq9>x8H794AFP+qe2Mx zHivMP_Nzm<_e>D3CdCR6?ma(*E6KD5g!^R>?pKE}D>@kUO|w5Xm9aX|6kQ`=Yx=mW zbaeRM(pwPo;6e!ZH-~VQ_Nzm<|4b0BCdCR6?ms_-E6G#};i$2!glh=s+iMGWAyPPj zrDaiGuCOk#=uKr4=jWnh!ywNUmwEBXVAWGn2XoK8vrK5~K&UISm81d8t;8WTt);d3 z34LYmk<7_Safq?_ywk#}blTPu$Fv()xfY?sho6%bO)@8r>3?)$wXpQ(KTsxdh>cr3 zA=wjUNi;-YM(8G%47vyy3#{acNg;CTBxaSm`i{V(DO zY<@W?X)PQWPM)aE<&f12tiWFRsBebGJRI4UKPBmVN(F@zKHxp}ZcX=|saW&{y>>#+ zWmn;bUu8;Ui}O-Vbm9Tn&>PqFnh44qzxl9_E~l1HkC7u#dH^l?=mCraB@Scz{3;8* zJ_W??q3yfSb^uQ!%eH7IAwM*x2>a;b?`OzzXs}6}#g2)n%)a7V;FE-S&ZNn5Y{HvD zM(79b%=&{M4n&W%ha&8ai2meR^wai0J)7l-q`#<-={>&Icf;=J5{6vIwpzjZb-y9l_ zJv4mm8`j=_0iGrvo=^WC63@!>bMi0OXy_lkG~ii=Jn(+$2H56fjz zLb#FVz%a+DL={KaCzR)h$nxG;c;dJ|4KUHa#Kj{y{?oH5=wU!9Sr8jFrtGs;kB$uj>xCJaOlM3QWtCHPFxBq zXp5CuL1DQja_uC^{Rd1!=O5@Cz4gDZA)`ezN4+9z+uOxy*qy zOba|cepu(Rfn-DJ{jx%av!xgK&RIfTjlimoP*%;nuu;qA*y6Ci!f^khhxy`-v*o06 zx2o1%!MQg0>sPcPuyY$%T^FB)D7N9={GoUv<} zxfCuCin{CCOGH2}Z1_{`<;M7VD>i-Tx}2i3+{dJ&>`Vwt7J}$hi~c$JJp?t-<^wMzlr)WFxoBp{ zN2B+YO$~TzvA;(_lLSgOx;dsA)!p5cUmOP)7C4Ody_@WttG#gY`g)A9!?2B+j5LfiI%} zG&%h}-Vef7uf)fneu5spZrtP=D7b%%$Ci@tM>Z1r`2@HXv~zDampk_YpI#g6 z*ucC?KYazG`N^hucw`x}9`peH>UuG>Ai&tA#UJAVLKjScg%nBET}C@2JRe2Tbj*E4w(rdrfMJR z3mA|ubm#HXefz~Ab_`(XDjIUxVu+)=S}gT-Ui>4<%m|BZzlgq0IZi&v#YIj$cNV$1 z>%~E}Mzl7WEFq1DSTSK2#DMrX;9%x^OP?(>n6lh<#^W+>0N#V|@Xm#I3`!@QjlgXm zCebNzy&?4I<|8Ndp945meFDVQ2cZ?PyD|21JYpXB==Lvm=)%wtrf;eB!88lWf@q3; z#)9Vp_!8W*r6&{73zAYJ%8wuvmEm(3I<<)ky-EC(8Y}Z-BC|5;-zL|3zCpyZ)d7|_ z@hmevJK@Js5=$b6Ylk!EJr0cNg65;bf>HiGRv=XOr|$i!!5WU|xmlXL`xi*I^GVLJ z4J>m_j95oDbK0Tv8891SC*+IeIW^P5B-j#J37!}kmPqGGk9l6AQ#24i#mwd#b`zYy z?#@?ftdBdCfasS!%6BsF@Q_yiv8toV4&0j!c7mw?Ef01h?1{0C@nvTh55bCFvlSHh z&d$e44IC#yTh%A1RC=3?gQc|#tY6j2%^!z>E7lcQlykz0^KzkM(NAg*a@{0>8UA9; z!r6s2ajY>w)Ct~L6N@f9GxHSLCmx?PM0wgH{aeNM+uv=!-1ZAhKWq7tbjtQcSk0o) zL$rQGtu~j()A{bCi7uGVE*^a7xh9%I|49-6ZuJSb<}a?Ol9ivi%m2R zZCmp74f;kA7Nu4xizd{?n_P;b6zpI9lw}WAWlHqy_`bx4b-Q!_BfI_nz6lu z!`zT!WI4MTKcG(cxcPJ83q3*F(6e5Kx7sZ9HnM>#G^1S*Aqri?%{TM(yecsrTAWY` z#!f6d5c8gbS=Cpn=V-D=ldgs5eoR!W>|l-<6#RHI{Q(I_`10M%8Z#{3Wef38zgcC1 z1%>cr;*m-0*Dk^tC_Z=MwT;Q#V#r+=WoZDl5{+%CRavA zWRG(Jya~li;$V9CsaB%N@U2$D@88u+E;>TTLde=p;MkqbL+R4%B1&&tF?PiUPF-|i z(06nxf;(4w&G+dKxg>W?8sFijy`l^+1JO$bU z*-sF$)J!-vO{nlD6b zg*4rwtC@5>MXQypa6zB8LYBFpdP5+3SpPibrByTO&?nvz1g>?vW2y^! zt3UL&pyVxiOmX?>^+Q1F=9=CU-v(Ve6~Dx{F!89DuJ7A#9lD5BH5Y_^^c$AknqF zk*#$tU1}QJP_S+-osm1b;awxe)benxlzr~8>s0_VnlpD|8AtQEFV}KvZY08@{1DCV zx7CmY%r@KbwrREU2HUpii!(i2(9cCUitfDCyo{CFU)&01xmCFp;#(og7wc;zyoEKE zr9nWwO+^6rQ!uP~JX-KGwYLDy-V5jk!?51vW#X7ypjtZ!hc#?g&~tHPv4h8w;QQ2q z(b+Sm59yt%z$0?ki|%)`eS+6?7y2r(b42NpFLMkUbmt;);75n}X_>{X^lmNt;5MPJ zWAWo5?=R3HG9RER%h>&z+NONmdxZ`TkVnSEBaT7jOJ{iG-VtP5et_I@w4I1{Q)fHH z9ye|3cxu`7)rYvreS;>QyZ1h8;TNBnl(;cM~YVu^pf9_^KFPG4^tdc$=lwTm)Zl*;N>8um4S~s$6ZD$Az_sUuEqFr*vC#!Ky z6PWZ+fh9A$lgXQIohNtBzxjiUc}MViMMv=TT71n5HN&hG(f1Kg<@<qpW1B^6#l(dg4hPx-qa zvR{ke0+*e;`Hy{MUTXR4S4sM3@^DxM$CBAs^hHz`Vlwt(|KU9z4{5@_e>ZuB60ID5 ze+=doir%Sw!``xjxD^^bU-SA?^(c{L;%L;U!&S)emyCJ8XF!)1tAME`V zV($Ae{od`8r-7C1V=k|vm!;0xRQHa2!ojo>a+qg&1w+?}GeKqG_8If@xSs@Qo@)VH zBYCf{r%YtkUxSgAk7bF{AA*r)Q08P;ddx~x=iW8nfKk~~?ol!6q^djtT|lB}BuG7N zR{0lKzW@A-sI$rw@lmCfpNf}%x#F7%-%_Xp9!Ie*YaD%eQ^1%Z-u-N>@zZ@Ni_8Y) z`R%cK$)8Z5ezmqAbxSb>mhtcQuD-c#oVowsnSKYiM>D>{v|7Mo#Y8%`rlGDY()I%xs|ulqDoi_Q&hL*=kSMLZb&gq{>?BZ|$T=@SxI2uh4z7D%W7O67vo6{hzfW4loUy>Nav> zX{T;=4-XG2X0uYU&4z6snpP7YdyONj)~)rb)uvYVtz{+A4`?~duy>z>FBt~C;2n<1L;rb0kWsy0U3d+c_v zAAux!Lt{98;_@fG1j0XwKXLBmmv>`WihoAy&mk}@FV0kWQ-f)txDLNpQ%-Q>JIX~u zWG&H9(-AHKySxZx8>KgWkc5}?kMGVCe69xXgKju3s1qW5F5UKN_20vy@FAWcY(Gd= zIsqNxJ$-{VM(_5@eH#ta7DbG()kUREoWic-iWq#3?xbHCxbzFrX!x;N8{ECgq7q$)~Q<6?$MELHX28V zX2Yq}%)?r*0)wp9tsS)NW~+Iyz#x;bi_ITrQS3E>2hSXCQRG-L<{tQ%izK82&l!XR zFZQ(rL$9=%Ak5V6j4~`S;Xy)$u$l z+f-Nd{q|`g`>UFvORfe>PSXUDC1+}UiBjzYh-yRfWL@B#-GHmt6#m~>udzrrcreEF zm(+D+fuZ>^;`xxh9D2u-9G-z= z;@|4eAO9vsu&Cx51ih^mSXh&Iw8hRD7Y&jt1Wk1DbH$yhK{S#pFd>yjfpKT4WiSD# zo?}GEo$0tU9e1YV&UD<_5^-m7(OX#DnG(%kJnk$}&m3`QiM%;hC6Q}8;?5d6?rf!T zXCNn02*093#T&7?MYbXMEXfqjyXbTY2y8|08R7etumQcPPkgj#pwqyd>Gp{whuP_t0hy!not*dD3) z@qwDHmJfmt7zV2qZ#xwoO`!R)5gf#zXxIj{2Mw>GJC*6}sJ-c!5}b}uR!``Dt-j;3 z5}qw4uCe-=u6)jozolQ zVs*a>`J3S`7N73M)_uP`4$G9|h@ARi*Rl@}%wDhBG8+}AWggWJ8)mQ7vull>b!4|X z3v`j(H*%M>Qo5voXrd4qz|#eyU7(8JIp$$H2tJhM^nMv%88I4r=&R)MJ&_N1>>s;( z7*Ejd^>(A5>A?CiYsmft-H38bXe7d3{sAL`O}{2MX?3by$LiW<^PpZe8wZCK^RRc+ zGHaECL)$)rPCjZe8rVV01taynN6zN0IOf(^7z!z3Y+Kb@v)6@nyW@c5X><-d=HY=; zGY_0f*FI_<*qz2AF>;*AFG3u=jO>Ys9x<@p4AMp=z-LLE7wo`Rvvtt08Wpp42#ZML zuytTswT5l>4qLrSvu9W8&Bg*981$Sk_gHgvqG`#lCSms`gpC^&Fv&rgkS<|pNfsF+ zirZQt@hqDK=*khiCrj@l*!r7PGKAT;Dj*taR>icPu4Oi?qo!$9o6vhl2M4W2%R1;; z-32<1dk&sSGT;>>A3>7y>qU0areTKAF29NW4X7#5wFVha8HU#OgID1x|M6Fs(km9; zC%u@At&z{(p4s7hc-;lV`0mQ-fw&rV!;<#MR~o{>^rFT8BH#A-#U%mH;$Ds7!dIkt z6gm0FtBcP!rxzDjGgDn&U3@${|1dMn`_s=~KKv#X|MBb!ia$TUynr`nAM$Q}pu>$P z=eK9bpU#HpsAK})?d|4h3L}2xnK1O(N14*zVigEKsT!G=AM-*a3l~%hs)XE!>MD@S zu`_h1!G?2pKX|YUU=HNIevr7gXuys{=nmrRitF=!mcK%c%)5g+Q_Vy=;tC zxR|3mhS7M&{a?}I&zK*{2o|fFp%<%+%h8G!t2`olO;)Qt>Jp}|kRMzDdPBz0Nt73sS_&rs^JtWp2xxm?T+jrcj`!ubMH>jR^~j-k~6w-MASNQ z*0;!+R$yv5K7Ngxgj4yHflz)Kgv&NO0zAA>l&1@Ynk>zN%cWGXJnb;Lixkh&{%t`0 z^9DHuSxp_mZFFbU9f#jA6;i)e-?|kA6~h@J_iJXB-h-NFLB6{a({eyhQKe3ec<_n zyk#onJ9Q@&Rj7B6@m45 zluS^GXd?Mi7V`ETOWP|@sXx%vl}0Ct0Fgy3~x>%Ze{xO>P$Yj zo+&A)+4-1RG+5p zV!AX!BhPjyAu5~VmEdG9r7;d9{B~#4BYub>}hRm%tWHOW2hRh}z zGMi;=lzv40b3aQ+k`sWYP=7~)ztGl-Qw!BxmNH^-P?rW!;~6&4-RhDb0@Af0PBoH)&#UEGK`c$)Qy+m@Wz_}B~kiy*Bd(uj_AMb zE;}|S&K{@%*Z*;TcFgis_UJ}k-)ZBnvE9;F$^|j;f8R>*QOZs~z2Pj&JSSN8L0=w# zndpv~;)sLM?a?dF=sV*2#Cot?dZrg`4tBBH6Y&{KGi+ciOg4R+anqN54D>#(F=w)W zfmUMoA~Se9yq}m#Wjv#WO8K2-nTiQ6CE7&06o&%+w!jsrDV9pzm}@O|XbTw%E0qRN zK%4yb#0y1r{||?$!2bqzLAzs(+pOevmC=CY7u=AmQ37<$m6!=Df0oem!vH-D-}t$7 z@hZb0?cBDi4&2E9m$nSFWuPqsZ5dEX+A?@q%OK7)s{$=5!fZ;_QdLd$#q@o7KV%*) z^HXpRMkn)m#S1EvnDn>t)bA%%#^BSR_b`vHoi00PR##m^Z!-Mqi?_L(FUtV7P!3x z{eUwPWs|w<`67(pBGn ziROs%7S2LLYVW|l0@DFao=Bx{7qp)EnS#72Z|7T3^G&DCw1{Rp&G~kMFz70&K{586kHk$^XrDx#UiP9*iu#D2>(-*c-lol?xrPuFOAJwZ`! zclSqRwEW!r6+@TCLfgZ=EqK1?J5lhe*7vWeax3e>?XEGrV7~HN_KV~J1vewc96#X ztc;eS_O~XpDb@G9F3uBK!;VIYtf8WwCC233dyINi=P2KD<2{6Z3v?3DOU7nT zXve_M6MRA4c*oyeF3OI0 z{vdB{xoFF!V9P}tF4}O>hD(HK;f6~{koAF7K*aQjrwjUuY_>_H7;01_AS{raYX=57 zqk4hO!p~(TL5`Fr8xffd^R~Z!+IE2b34BC?!C-%eV*$4I)7ge;3CaVHY z{*t~V@sgld8}Ok+66GTdoq=-T>vX` z0Tk#XT%|W5xACjp4=Zs$Ea^>1rIyp3z}KSE4>6Efx?osQ8qse7jd+{CN|ChqT|VTIglMFlc)Fj_7e8Z!e#FyLD;p^W&9r|J4xF>(z$xGJlkWU7 zjAaWYOtQA1y}Ex78>LpM)yzs2{{s#1!F3)LS#Xfh*6FfKckab(kz1*>XOzMo-G^B- z9lMjKpq?dz=PrqUHA@B=K&SFcd}2+HDbDN$C0p8qpQ7n^fMaNqiR<`KzeEc{0`xhL zUFvv34*vazApM8)bev%ri@N?w2Hu^A0ua@o<430>Sphwsa~HDiwK3to|8Vy!kqSTl zn+0mCnC6j9n zj&MlhvV|mER>H6JU+gFU)VYU+A2cTz1;^}!$o-2BE{tElv1B0VNAT#4=cMH`;B1JD zioRB)<3i=Qx(_ntS3(!I<6!6$7*>&1{uu2&llKoiKwd6kuN?T-eQ++VNk7ZDq+;(^ z=}||CG)mL=Jz5+Dh*IkX?8Km=1Fi> z6}c=+ErW?}wRDiGaP1AIY0V@_K;CmRJ2-_z+A`DjdC_cnN#>0&6qK4Zo%FqNDqEty z!B|MC6s)A~AW4MskH(5JkC;^M6JntZw!>J89ftlz$@|Zp_&CMMoK17 zyS`%{p_A~u`;olmtnAy8P)ThArt{G*+d27sno=>CtsoO!3sQYmB~Yjd;uoEfakrnk zJep5Tfm1F}6>Q^A#X9~nRtRQB#ySMjI;|qA*WVO<6@L|1z~o0Mzsx8|$nJMo4gQ!R zCPbRQs|8gszxnr=pc1)13mr?96+forn=4S{JiJG)sR}LCx4vJAD#y!+caisx8Pa{n zc0uX0o&v7pDkWxUm?H(>ociV1v!~rz6^tiL)YDxeZ;n+-OMCnBTT$pWXn5Fy_x0pep-i&ma<&gaISQ1ev4&i!N9@K?#a)VjTI&bvKJyo){`81L$aZjwsgO9J8)1zYZjGoPA1E zW!vS#&xF1o9f{%<1lf@#l5?$#{z1<9UV^detAG8xSD!`NZMA zWwbpZ4e2n908+pRcEM)l-d>-DsSWR^=vAZ1Z%0&!kd8BXbevI;HOPSmX|#G!K=2jn z091S@tjR8gAs+neX%|MCe?_SeY2e7-J~<(M7(0ZO`G65!^yc8(kwxynE*xx=X;NV?yQ2rFfy)9#gyD^KLsOX5%bJL48N{9jkrjRzj5By*^L7iilvbOkbuy(yH)Yr9Wwutuz{ z-g`E7h?pqEc6#o}!On$3Fax84{7(9y+xzqiW|6x$9T0zFO`!ZP62fZxeQ!Fjv2qso zE2GE3Wz?L}gFE&{RNg6#%9!?YLhe1BlP>hdlf*5$ad>0VC=ur`5ERI(b!Q<00ae5# z=)VC2NmY26q3a$x~kq?QiJW$9QzI%Mfa0SRG&1(xpa7U_@@3F%Z)P(q|Tekg*( zAMbthKj+>%^Wr&kX68BH@60pr=6uoxBasyuOcqlH)dqq}@AUZ@PCxfX;dS$go)sHZ z-iz(-fV#*Dn;L)R#-F6&T{< z_4@40{{Ek+TmiagA!&{wQJ(wv$@)@KfyXP27ntp6YY{P4{%6boP$~)yoWDOmrvCM4 z3)4~!17J1dPj0SLBUB*?vOQ_MB`Bf48~(-@Tu?YigjZ!0iMN!FG&&a;o(tvr@YNR9 zZD5uR3W_M0cZ7Mggt1yjKK~iHU^RV>Y^Bk{yF-4YKO#H-u2s&WJpH?$?@v(#F%{PdtZ0IUnI~x zwZK(zXYXlF%+L{t-9TM9;27oSfgn5QxW@_O_WSH9mp`&r%%4AcY|u5xVB%t=ye}xs znIaPttFb5Wd}8=~(m9tP|G*OkB^XhX6jk~oE;wFOp^z%JMaS=d$M7onMn z|AbWGWMZm*9DSv|5}P8SOo&4?L1D|NKk$8ND=_AFFa|#&Ohi%&F2SCT$H=WlETGfX zXiMswE*cAtc%1TPoJqg-3TvbvFwxjQm7-;%vc$0T^^dIdw2_I6lA$3`7)|1T$n-YU z4fcW;*Q=uG7MRap`owVJNwvD4fQG-?vrv=KAk<6|ylQf9@z`K*zT)mg$R!@max7o9 zY7kPGdDkDrpIRD9mqPc)Lr_uPr+d$AKk~bY`?aq68WY=9OcTdTXMNf0K5u+u0GF(* zzV7THI?>psvDqrdjPW%&c*nf$LK`Vqk*)yek~!K>Bf@_-lYXnUl=ddU7k<$ALd<*m zw{@w79;T>X4y@A)mee-hrM{a3&FLpobcM2k3Wc2bk+STdub$x6mHVVSl8Eqp$F6-Z1#jW|5-sh z_`VxiOaU)?E_;|6s&_(+<)}3z*RSnl6F6V8L8YMC!nmT@pPt1GXQs~6_YD1}&ZZsy zy`yG%rMEG};I%QhrTIul8z92xH$F93&@94`gg(m|D9fxgLCyi@#F+c*Ci@y(82f!= zdmD7*3UV@CRkH~X%KdLycaE!i9WBMPm|4SQY>&+1j>W>3-WepbIuuf^&C2XC#$))n3W4}M{hjM>x{J8$SAkl5J*ZMd?sq^)K z4n-J;t}U(CaYBG?Z0I||YYn;e1i+)cySpQvMf7$L`}6%*4ce??oG7Pz-e7rCdw+a2+flQ9k+GbM-}5!)j;91ohqOUE^?r7L&4Mw;zJWx6ssd7fol5fs@1}t zG-;=&RZbsq_KdN~gtjS~Y22Ep8-jqt>l~KYnQ%2Ul*FzMotvmeK&4jUsq;zkk*-wP z5JdBKl9rKVvml}w8SaRw3yP0ND#zu5i!?2Ba7PRk+-4QBuOI1F)G09d0g5Ih55y#o->px?3blTA!FEA9kWM?Ip-K?OlJ#haGVtCKpqz?p zK}eZX6Jg(H@HT3%U9DDM=Z}%3>q7H_(gx@vlbA%8Hm5ck;$GsF`q3-3U4eLLSz`mF zzLbV7uGi24aZma5i;J&MOZb{a!X!S|ahWq&Z3E)#cz?r$U}!Q3=^M z^@9AJXxWT#-)Ti@F}|=)jf~VsFUblBwhK95*>(Wy#c6mv56&YnPU1Tpv}W z$xx%S-*rUHOc<+@&V06dvZ-L=*b16qi^p>!!gu-sg*^QAC7pq!9hmqgLHlNA*tFyV zb8B$QMt4uXBSc}P3OULk(wQ1bSgPR^m}CZV#>kH`UN$eyMp+$9YYY;Y#KNg6YTawl zd_e}Dook3Q;{=C`SLBG>5=Rw@3NEeusAtNLCRZqEyyA!YF->RNzokiR)`@nPl?tB? z$C)PdmYg+ZTU zb61B_lE!fgJ6R(pLz8Q~?Y*oyb05xCm$P;sGnyXXL_WC-LY!0{_O&9M1OJ75GB#;U zJ8n2fK;rna-iQcGQ0(*y)OC~1Fk^VBQn`(VX|!qB4%m>4`>S)L`gj?QLXNqF!R*~o z)7EG_B?x_q`rAGV(#Vm$G_8&)YqV7Ps%?sku`^r5eUoSso<1Z=Um}UB?PcFspcC7c zd?jt_Z(Z_92=aK#pYE4hzVVD^IA%N$7>i@;_5)C9~Kp<4-X*lGe;8tnAw zoTY+K1zjjUnF@MOMEv%g=%_nf){(~kaw5Gk%TuiT(z29R+8Ylqn@`)$ZR>J0DQ33q z@?`ZowNbn?@Ny|v!ece#irW8xWNk$kf0P2GGtBP6j|B=o`7M@Ix!~s#vYYwZ5|>@( z<^*`+h0_Y84``D<*`>Bg^cY`|zQ8H9rA+e^J{u`JxmJcWD;(n|Y)K>Hw5@+FF(~fI zdc?8VhhQDyFkG%>6bE>WU!J(D_F{FGHn;Fo8kVh|B7jt|J=yEs%AuxWw&B90&%4}( zd872AZL5n+(6M#JA-0QFjIb}bf)49@4s6&hDG^8b^K`QED^|thO8aqd6_iT^1XraC zE-mhs37!&9!_qY*CvA+)O;z4WRz&_Oeef> z8vJMOpPR4VC}vvZ_qa|XTmRwIcp<&~Ycq%!X;A4-eq?Uxk0xe+arg7@zC8JOAkc zhTjhf|18`PAG3uU!QIB3$+qWS0$Sld{8@G7!WL#RdpS9KUrhxqbnH62X=Z&yXMeu4 zmO2n^&GWXe*jZa13l{kJa=~^@a%)2K)6*Y$x0a~A8r4qEvFz-E5ES8`4+OI&{q_Hv zO%$>3p|g>yW=exkO\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -326,6 +326,44 @@ ] } ] + }, + { + "name": "huntingqueries", + "label": "Hunting Queries", + "bladeTitle": "Hunting Queries", + "elements": [ + { + "name": "huntingqueries-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " + } + }, + { + "name": "huntingqueries-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/hunting" + } + } + }, + { + "name": "huntingquery1", + "type": "Microsoft.Common.Section", + "label": "Bypass Attempt via Double URL Encoding", + "elements": [ + { + "name": "huntingquery1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on WAF data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)" + } + } + ] + } + ] } ], "outputs": { diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json index 24b1c4f11c4..6391d385d9a 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json @@ -65,7 +65,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Azure Web Application Firewall (WAF)", - "_solutionVersion": "3.0.2", + "_solutionVersion": "3.0.0", "solutionId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "WAF", @@ -77,6 +77,11 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "16a81a04-3d26-4118-8f6d-6dd3389583cc", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16a81a04-3d26-4118-8f6d-6dd3389583cc')))]" + }, "analyticRuleObject1": { "analyticRuleVersion1": "1.0.6", "_analyticRulecontentId1": "46ac55ae-47b8-414a-8f94-89ccd1962178", @@ -184,7 +189,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Azure Web Application Firewall (WAF) data connector with template version 3.0.2", + "description": "Azure Web Application Firewall (WAF) data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -374,6 +379,91 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Azure WAF - Bypass Via Double URL Encoded Admin Paths_HuntingQueries Hunting Query with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "Azure_Web_Application_Firewall_(WAF)_Hunting_Query_1", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Bypass Attempt via Double URL Encoding", + "category": "Hunting Queries", + "query": "let StartTime = ago(1d);\nlet EndTime = now();\nlet TargetAdminPathRegex = @\"^/?(admin|psemhub|bin|config|setup|install|login)\";\nlet ModernWAF = (AGWFirewallLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where Action in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(RequestUri, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action);\nlet LegacyWAF = (AzureDiagnostics\n| where TimeGenerated between (StartTime .. EndTime)\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(requestUri_s, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s);\nunion isfuzzy=true ModernWAF, LegacyWAF\n| summarize\nFirstSeen = min(TimeGenerated),\nLastSeen = max(TimeGenerated),\nAttackCount = count(),\nSamplePayloads = make_set(requestUri, 5)\nby clientIp, hostname, action\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories." + }, + { + "name": "tactics", + "value": "DefenseEvasion" + }, + { + "name": "techniques", + "value": "T1027" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", + "properties": { + "description": "Azure Web Application Firewall (WAF) Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "source": { + "kind": "Solution", + "name": "Azure Web Application Firewall (WAF)", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "contentKind": "HuntingQuery", + "displayName": "Bypass Attempt via Double URL Encoding", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -383,7 +473,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -425,13 +515,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -487,7 +577,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -535,22 +625,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -606,7 +696,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -651,22 +741,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -722,7 +812,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -769,22 +859,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -840,7 +930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -889,22 +979,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -960,7 +1050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1007,22 +1097,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1078,7 +1168,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1127,22 +1217,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1198,7 +1288,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1248,22 +1338,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1319,7 +1409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1367,22 +1457,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1438,7 +1528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1483,22 +1573,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1554,7 +1644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1642,7 +1732,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1730,7 +1820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallOverview Workbook with template version 3.0.2", + "description": "WebApplicationFirewallOverview Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -1818,7 +1908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -1902,12 +1992,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.2", + "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Azure Web Application Firewall (WAF)", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1937,6 +2027,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" + }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", From 69e8c0659b62fb2c7ccfb40cddd2f6b0009e3de1 Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Fri, 9 Oct 2026 18:55:58 +0530 Subject: [PATCH 2/4] updated readme with version 3.1.0 --- Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md b/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md index d7122cf05c7..2b1518f9e02 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md +++ b/Solutions/Azure Web Application Firewall (WAF)/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------| +| 3.1.0 | 09-10-2026 | New threat hunting query added for Azure WAF | | 3.0.2 | 06-02-2025 | Extracting transactionId_g and hostname_s from the AdditionalFields column using parse_json and Removing the now unavailable details_message_s and details_data_s fields from **Analytic Rules** App Gateway WAF - SQLi Detection and App Gateway WAF - XSS Detection.| | 3.0.1 | 10-06-2024 | Added new **Analytic Rules** [App Gateway WAF - SQLi Detection and App Gateway WAF - XSS Detection] | | 3.0.0 | 21-12-2023 | Added ResourceProvide condition as it is standard for Application Gateway WAF logs | From 1e6ba9bdbe3658313c81548f6a2d658a748abb85 Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Tue, 27 Oct 2026 09:50:02 +0530 Subject: [PATCH 3/4] minor version updated to 3.1.0 and updated releasenote --- .../Data/Solution_AzureWAF.json | 4 +- .../Package/3.0.0.zip | Bin 21773 -> 21773 bytes .../Package/3.1.0.zip | Bin 0 -> 21810 bytes .../Package/mainTemplate.json | 112 +++++++++--------- .../ReleaseNotes.md | 6 +- 5 files changed, 61 insertions(+), 61 deletions(-) create mode 100644 Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index c07802586a3..4f84c9f5784 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -33,5 +33,5 @@ "TemplateSpec": true, "StaticDataConnectorIds": [ "WAF" - ] -} \ No newline at end of file + ] +} diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.0.zip index efe3df21174291899ff479038533c9012e795ce4..edbfaf7b04a4a1f590a4e02c91cd38ef7604a3ac 100644 GIT binary patch delta 49 ycmeBO#n`)wkvG7bnMH(wfq{eJ?h>DkykB{kf%Ilp-YRzxV{%i76PP|8;syYKw-H?c delta 49 ycmeBO#n`)wkvG7bnMH(wfq{eJ;X03vykB{kf%Ilp-YRzxV{%i76PP|8;syYNyAg!| diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..606fe34349bd692208dad3b7d0fdb1086a369e98 GIT binary patch literal 21810 zcmY&;Q;?udv}D`1ZQHhO+qP}nnC_moZQHhO+dKc=y$}2LAtK|jsT=omat^`(0N98E0HFW-YV2fc=whmBDPn47X=mwTX>Uho z?44?6H`8u*^Wh^`GW6Kq_?ErsXcxp!e<&ed-e++FWjK%_n~Pi&P z?hHclF_I{|*+}6H95h`J~S%TtjxgTND4Tcm*YKCITXFR*d-!3Ixl#xP}e zv!Oh-rJ*_{tPEIP<0rC%<#NYLqEexKDqBcdHJgoHnm{r6?Af>g6C*Jl zoO0lLA0F>7BWV!fS5D!{J9MFML%fW1gruR(U!~5V$YM}uyb_IOv@g&}6)6ebZ^!nd zzz6Nj#xdK?zeN>}>Qi`s3g*jHK0W>{hk$2lbC$;iR4jg&2W?abcq)61+i^O(u1xZo z95l0-?3Qq=ehiRIi7(1Vt#``&X^}frSEx*MsB|0N^F?*qjm1IUz*-J8f5gA7q(Y_w z-bm^&YN9bnqwOJ}pA81cef>%V2T2H$z%GFx)Y@YcX7a=>5HjE#fJvz+b5u8tBm!pl zA*s7NORv+TIis##Fp2axcjWIn3?tZD1FKx5Dma+^iVwQuF-w^%1A`woI;cP_+{VXA zFH~u7XdHsgq?d-Yw*PY|IN+Yrq!sz0E)_{Er^FIBrXAbLKAjLro4IeBi_a2tg}7@O5v%BF=Usc!kEdB%!_p{&Uy%e-QQ=m;J}NT@R4Ab8 zq=2Bk6llPp6j{=uT73f&4np|^{J_%c18Ap*fjQn zecQ3o=Dp)qflTDX1(xa!b>*dZ?s)KOHk4VlgW6>);biR?+}se$;AtFDZ2vqnE`D2^ zd^WZXfx#_x+cgf`CVA|*$cbP7P=VF#Q`B;@k=nY$cb(AJr zn2M-v=Ysp!3VUdf?U7H7@fNO9+6qjF1;eCYbkS{CDvw?bCxFR(r6dWZ1y3Z&OrP{< z1JrzWh+OPDws8B8hgWpz*<~9pL{Yz_BMoOr%7@EooH3=#6N-|o^tLa+CfN0K9^|yK z(`C}IBkbh5gj2Xdk3|P=Yn5KUM%Sl-XO)=L;YlZJWw|zH#g}m13h!x=c_<#*M&uwl zfDTAAjfoXUR(dy88?w^6d$-Q3PVQQ6N{+66aAP%{SU{O&7Yk{%LWmqUn-d(_CrF9b z)1sTKa_iJ)`_ze|>t>YF-Hlh=RE+&Dw?jE*n*|%)*OI zxLTBFUR0WHI`3evR6yob21! zgO=mh!=F;z>;W0FeO3PxY1x|XiUl#pL^s7t{B=G^pd+g=tBq|9^1L{UummHNQkF@v z3})ri9qdNYiTCju-D(aW-0IWFy{65*m*)!?K%KK0Vp*dE9A+Q}s+RnLSQjKwe9SZ@ z#t~C(F-ya-G@QXN7aD*OTQFjf2!sJ{UzZc5OrypGVoJO;)9=MF6xj%9hV)cTh+K9J zmvO14xirl`H@)S(E&#k`*Oz7ub#m1m{c_}0FfTg~*WA2s%$ zVy@I!iOrJaWvX6oz6Yb<9B_L0lolBmDaqMfWbWF$PL1D{R)t@#)*fI96x{YbnFve; zvkPu|Sw3ESk^U6SKKHXy6?a3GBF38PAmY<0#ai0CR3tu)y-n9kJAzazlPWpg>hmm= zfcG@{2irhF;cX^hW%sTinOBcG^&6h{Csi4?+{+bKTwhf3a_Y7Pht>FC#0| z0;Q1!rNG-SOjw!$ymVxiwD8QJhd0S8)MDRNp2>DA;e-y13m$BEQheupNoq4pcBWYI zvd9Ukd(0R|E%hJ;!=3tR_@=2u9w}N8o1g>+4? zRMJzOIMzuSqUAQhXOLA}*NJDjV?x{kq4T2kFd~u)O6JH?mo;9cakX0RGhW`?*AMO7 zq|cjgpoeo`fQQxnJGlF|r}=$Fu1I`Hn0+f8xza_sLezpOAXqk z$2q>Fy7Nj7InvffJ3XzlB!JUL(oS^*KUZ=B9s{-@;_0(1bYupHpc>q0eO^8qI*6Zh z!$c4cdeAm~8ozEi8ZyW(t{(jSx98GxWJzJq=X&P~@DJpE|y)7gU1-9OFMi-o?;cg5T!c~X}MIj<)4 z*Up2Z>>cPRpY3j)&WyKzRCN{iY;vzJZq1j5i*V6LAaTb{>ME5k=H?y8@c-7H#a(S| zdC10$?u}2H`8M}wo`;xnQNq*fI)hVp0@n+98qCL&l=@YI2lrhk7M`%lxuO z#ThU!1st10Em`DX<;#_l*pQ(>!)TNUyOc}?Wk}1h6Vm1rP{@+&z`FBSl#T+`Y~xa% zGUQ~Ja|L69WVA6iO3i#uK3eNe_g5YYjrdwYakEa*|6+6e!H#oDf{iO{-t0&YXmC(f zEM}9uT;)GSH{wpU-j7XYTpeNKzeA%)2Hf8Mn#=xU`^9TIfTG`4nKS%E+UZi==w`a4 z`$=O`ru$x{=V70N!k^Vl_&C|lVm53utZQ7l_^R)B|1(Md1FrD@@t)}9*nUTG0DzVU zAOOUFyvNqi(oV(H*1_f<`}rTnbKQOEw#kvk@ZrCb<=$se!oS%pqWvnZRAZTntL~Ya z+-6g{&8!#)Mno8i8>NDrf~!8!*kjHa@0NE|6$=fyLn2k^W7?rkO4JW)V_B=y`! zz&zO=?51wQ)mSI~@+*k@xhrkD5_q$QSKr->n4T2}`>payeaCCDrTxRT@hx=y;3*~#@j?0V9;-R-+RiH@pflLtam z(Rm^hQ~uO{KbM146cgqQzaD}yB#;+umZ21~U4G)JpD11y{&OnhQm8AJ({5^kk0bw? zY0+!6I)@vK@!J?b$0}GN%Nqn65Y+`K`0ISxrhg7|DUv++h3~@6_zcNJ$rNF|g8&?> zV?L3U|D5m(n63NfJp0>Ej#Z$9W76^-D|a-p_^jz}gX`VNjczgpF(R0ggP6)fvKmGt zE1UwL3LpsR=TsMg6n%DAo9iUN+R6R!J+rfue%uzWpckOY)od#CuJsab!*k4iIE7i1 z7hBCeyF}TMi;(`u;8YiBliAj&|3T?s+8kODlWS(R0_@MK_Q0RrVQy4Q3ljVU?3Ty$ zo6Z<*2|4J5S`kaindb0*&lp~(=v#ypSE2LdzOEmJ3~u(JZpQKJL!wO&43lBaWo}Om zo7BZyuud{OEfLVjSJ$@mdG2<8^rYLBm#Pi(wC$Knr3mxAfLww*hfFYxKU+e^}LkQ zk()UA%TIjsAyeeYYUS*#!$@)XFXs50lteG14|=zkmkEhLC&{OFYcF@ch`BO=m>?Cb zhbtVpyaH3@Mhm&WYu=p1TysvUsWeJ;)VDY^0(PZcSJu;W&AAU-Y`>i3Irmp)*#NFk zLe)cj6(2}m6EcvVKU=Ob?KjCO7`5TONpk{Aw2F3W21ne-xWc=JzXCXc(s2O+i65Mw zPa3$;;YpB=JNg?BQb)wdESbRn>WGj0W_xs>KjKDJxJutQpUa;i*h-i&(CDOscB}kA zO1KicIc=p(ja$oniK!{gaOpDFu2Ff_6*LLzO!3U_VU}Y1+C&hLOl_j?ryweH%9F8G zV&SRcwrFuvsZ`w-BX36x`f{3#Osk0Z$|BYZ*g99SwZOHb!%n5MTB~_mk)S+)#FD(R zd2Q>N=D_PNR|m~Nid*wT9Yfj#BEDf@Ew#c7Ouu3SFN}hGgeKz){Tl-NtS$nHf$6!ubC$jQ@Wyi&!LE8e#*mk^{@d|6s6&&Q!E<3(s?kr-oo>Cp)D5G$uP7CQ5K%qfsX~9NtTEAj?5Psxv1!IAcPx zHzqS!M`4S#YS+55ED+FE&sSq_)ETifn`JkN=??b&-IgQWKly*QZ29~@Tef`u*A^|Y z0b0p{=l^VRt7O%=j&Z40wPkGSz%eG+cEXB%mt)j(pOWp4El{8?v!v+i;YDi&z+2wUf14 zkyyBT5u>@utZ1WJ6)P3W?ob8k=BO`}`6)j)ggbsXl-aNz2+}8Lq0WhIFSE~?JK0i zJ`G2;VPctD+6NoedZb3v@@A1@qtc?)nuSHIU1yUVtkHw30NW=15e?x4l(Ps0|{d7=bWplrWg%SnqCqTd_4} zI1*^{+A|syali@UtG|x`;b^bVH^ofz<~~uY@4=X`AoO^0br>y4KLqit81j(qkeOEp zgWDmO^p)5^#G?b?4&3SvVbaP0A+RJeS~OaOUGP|kh#oY$zU@3+dGT$MzDI(7{O}v? zHdQlEs}${`S~+ijwUTy+>RVa5L4Kf^0qRh z%mPpTAVB8NC=~AdzL`?M6F<-y9**-DyhGduPtT;F4ql}K4!zi@RxTmGR{f5HO%dnd zCjfYF`(6XTS#87w>wB#+Kg*Xw$}X@)N%8xH4mQYmwz9I7rz^8Ha**jozpawwo%`tN=055Q0)7TN`M0PFNS9r_V=TuHkXH;k3r! zpyT5DuZgQ8Cku_BWVOeMyTliAo8J(TCWk*%$&R78*|NP3>rexQ9M*KIfFbgA3kl5uq@+Ml!BKVi`sw zu{f8VXR?Rf6d{i`q;7*b7k^hp| zVZD5(c+`x;xe*Lfj}D^oJL?o8kEzPtr2ASYGVW*d1j3vL!G~ucr4{Ypb{Qkb+lDv5 zZ1Ri7RrCA`f(wR+m+4>R=I7_)J=e(b`@I#rKi_n`>ZgAv`GbW2hQJ4hXG68T8{FC& z1If|x`L%KVyxkw1@B6xZ8A3zg=mYK7Uh9i3?)?d zjwrzB-1nda7kLsrheX=awLa8AYH)Wh*KGIJf@0_`GY={ZW5ug2MsYzneTAvPi{7~S zM``^v^ibD~S&}AWV6v==0YfpB)RiSKb2s85h2U^k61A<1wdGxT<){IQi!C&&2S*q^p^ z4VmX;5!XCgkhG&>OL85ukh)x%O9(HMTU$!W4LF9T(x<;v;tUa9$5Y)UWG1v+Ohx@`i~V4>dkbOS z=FD}Ck5}k6twUeB(u59XA6&)a48WM(rp?7_B9y9)$JtX zEvWvphe505Fa5@Kx)(x>Y>Z!d%t!I-+9LT~Fsu2CFR(5`8X$IzsF z4dm{xd2iEe`-ABB#};epS~oXYU)vmER_98e0lyn+pSP(Cq$^2GN(rStrAB$tSL>ie zD?$aH--CVlJX|WHe}IAGlDs(@=cs#HFziInj}%x+*^sK(baxML*JCMh227+0KckL_BiKrk zp0`I17Hc+A*V!as1xF@Q?OEk+u`=-06fpv(Ih=$pSqlO}j2)MARM^+k@YhrE7^bPD zZk95K6>^;A5u)#abM>p@Y=C5+jLtt!U%&qCwb*`~nH72)5gqZH8Jx3kA-69g&fHFd zSET1L8>gP^MPRm#Fcx08mu$wr6hk=Zl8L!Z;=<3k$H-~mvL54Ix5TB(w>fGeVk5P) zZP4<@8P}J;dK}zVp=Nb`)N=^m%ah(VgH_f7kGWb-q2r$D5r4H0PsmDu(~(eh`d6o@ zQM2ldi*wQtlvyw_VkDAh;BOTMUkB3NFk&&4V-=D@M~f469~xtcXpChHMHI#&IjV67 zUv^|zZi!>&v@Jz3&P9{VPrF+#8fv{pbz16)Jmrl>WJ)c})f+t={jtmb>m9E={=ZzV z|JTjO%Fy^CbbJx7O2Az=xjINt)Dqwg15_;r7v)a+Y+rtga$(0QuS+>Fm=&n>3z2CD zc}l^Y%Bk5MYUQ*m(_apxA~pj3@hCo=UxCozDZCF<`5yLd1g`~A;yL9HdU z6_sy?Yu}gzTXU0~)RkWSe;zp+y1#q2g^`_k5ObNF0jc?e=hwOjTk0GO7M)jW?VlFw zO%+!hSlqiI9TP2g5iT-~`2+_{K!lC=Ep0T`l8dN_jpa-vajfEOolP#*UaGkHu)O(j zkyzRrQ{2Eaxt0VSK)v66v3kkv5b%O7bJWWWU) zaWE)~?@=dkgJ7DNY=EetdRK9V1Gae~FaAg+N+PE1#+{%Q;=P=pyvspwIi8?pEFre= z90=XQVP)cA)!WOg)?*e;9uQoDhH+oY^`l08MwAP+W)MBZo;mlS#52BSBbdojIND1% zEfCiO>aV3&dCe-NV}3Fc*PILNi7q4Dgi*d8Vz{&AWqsV7;);b10lbIWGa6m_B+fv( zPAtb;r9vTlP%Y;^$W<>Guul#&=8}D_l{fyftzDWG7Xlo)yfi|h?RlAgwAh=w6yGZ# zf>ySD!jyTUBbd~d9eUM87F&ZER;2sh!v3P(04eJ_T1F(RO~E@i)nTBmw&QMPwd`-f zfv_1eyJ_ZrFjc6Pm^O7@zJA(=LvYmo8rZ|r{O$aqIQD)AxRM~G_BJuNwSnN1U?~;X z605qn*aCS}k{i*^L_a%XcLHY)yk=a-&3dsrU^g{wex0D$iG$@`ka`F7m9uAgunkMK z3*_9Mj$qzktrO=tzx@a|-hhCkbBU1IB)g%Dm$>+Lnx0g1-Ut$3KbN+Rb(5VSe)D_o z!Zcx;qSWr#BQN4NoxFM{Fj59jMl8reI4PL**$8MJL@VGjJW~8Q%Q9XZLHmmEJ3`Jm zhT*8L`74uv>#P$|aj$f&a@qvT# z0@!k!#O?`1jfBz(g)IcANp|0opM)-Fs3*y^YKT+?JnIPA;)VZD6Yn1Ug#N(HSdiJo+krxdj6yT-$?W+0dJ{d|g%Q|X&;1moa zT}ktOfOLiUY88}BF686H>Ij+3ffi6p0vBRSMJBdmuozT8G7wD3s%sR|psoI*U`_#% zieQ|hlu6cpmXb9xTAjAqojf%&W1`OEep3R|?qZcq;O%ThZwiX_X1%zlr&_r!rRG8K z>+ODfZ)3JmDGnDSV}v=$rw0%KxG$c+Bt??0p&>q<(hnX};vEL)P1H=Z{vGAgcM5VA z3(A#)PIoJ-yHh}&wqT7z!=A?o`~u8fMZ7WrgLkQ_s5QUcRh}!$m>r5{hU)*g;U)*z za>tJTbAq9W@^eCdY_FF;EAl;EZew=IHeT$S&_Im2#HOW&W$B#3>9C!C&|Xb@zqJB2 zYsnR5?;c@X6#`cSoe_B_LMu-JYj);~G;J>)3|jO|3bT?FWm zfuvWmy&*&PZ;*p;4ly63Prw)HJQ+=Z&V@NTK0fgAwR?zF5MKdiRyDDwM&Ff|@xDX} z<*fTUSZ}F0Y0hx9J~p0t@@I%L0-QlcoER#a!=%&w&j{AzHpAaYkLaXRQfsX5=Laqc zNx95_j;)Ft$Q4vJK{y`4tQyRPkP?#~GLIg+qT&>aZ~uQs}VBZmQ_)qswJhbC~}4d1}6yAW4(aXi23(+`B2qhG_9dKdwW-oJ6O$TTH@9B2d?v-HG|)^x((4u_pac`HmyESUe0dJ9qfPR#cz&o<K#XZ%{Dn^e*ctJl4Z4SlU=C06I@bv&#r=E25B=}tGb?J0BRAl4gS&( zKQHJUcv+&=r0eL?JJ2?{9UHl+))wDSCh50=lSu^~2&X>iRe_geP7D{F^}@l!bSiJ} z;?2$h14F?0fT%t8i6oqM?Wb}WAvx0L(1tb^JG7w8pv}xfnM4`U{46;v(K;joI1$Rsj8a^bKl`hF}~@U;|`v==JB`pa(I`65g&f3sE&Oaq(k3c2kzDtFoDYCnC{NEEJ%wA*Zy% zQvX50#1RD>J;B7O(bN%Wun3C6K8(JKbs4^1vfyn|{?lBbOzcY9-EF(CQJ38 zYXg)D9H2%biX5PMZOR1H`I@_w3DZLLVZsEqXM7PW7jS{9h9`Z}`ccAvx`zno=x~5M zxj~|E;)+!$EObbF&@a&~N*^95K57T)6G+1kHQzv2#*P)_x5K4Q$7Xr!C?Ja*Kv3cW z1`rc6V(;wUU!HZGdC2I}32@!WAL!}&@f>T(IM&T6`0ii5&S5J^umE_jrUT8>z1Y{9 z3@9S+K!i>5@(=PJN|h(d$LKtUm=r>h4evov}4h)Di4)gv3S zhB|P|g~UL$|0`=mC~~2HWlcVS>`wGw^Ku}zBFxzm7V^Hqt{6E*a1~XQowr5%ZR3jzROfWf| zAp6P(R=h1y8A{^pgnD_8tW+)Ng*eTp7v5)^v$U{=hEM}k=iuu~@KH^`yWS2wr$Gc) zy^oa_wc}7;`?eHxaT?2;4uD7@v9eP2)yd}iBW3HhCFvYiO?mc_MFWua9zjs#BKsi{ z>WK2OGsfJ6T-aQM|Mfd$eHL3gF1d)9tzH0a4nin0kr+xS@WcS4K8?lJyU)ya)lnfoP3QvEji6Bi`t$(%pVuWt z*pV{?Pq^p3w3rClA50EJqBfIiv!=Qe1rReu*D{7*^j9(dZto)NWvdR}o^{>P5&d(X zQ|@AD?wu-;V~J^pq;{0gPeQ|tn(>|4OYW8L2G_d`S7Cc4|_ zK}$fP#N1*xEkX1+Zy91rX+ihKc@46R{`tS{hLP9udofM;o>~Vo@Op7rlSwrde|=K{ zV-ec;1IQJdKDga&8MW`z8zf`GyM`|xOK4#%u zUzA7vVwpXwfcRi2@=R3=Oo!I;$scmLu)E~cGD3Sr1g)~Qq{1)}w+QlY81^?kWrAW2 z)X|5OKQ67Ms?91JyOUqiT&E}=c>Jf$T9^k)svv>xP6L>8lRa58sr<#FT>2;MYzKV9 z=|-D+DBj;DwH%Q}W*Xv8^WhZ|V;HG9x7qj~F>jb`K8%c5QlczCx*<>R*8A!&Q{h%8 zA+V}vA;Dv>4X%gW>(^NlE6X4-+0O2RS&ZTuZ+->GXA;ph?j{iqL{0HQjbDA9_2zJP zu+l=uMuywTSUo_oPF>LMRpiGHD-!oR02rWxtA*8F%hV6U+|evxazGE%m7xfh`rU%K zp(2UaSZZROt{ZEK3FEQH^6BOf+F&S93-{%4(XGdyAH80daqI`Ph=B-*s=`{(BmxLf zkk>@gKEmrQfdu&6P8L<@do9xYI`9A)z*T&v`jv0dXX0fp_?=Im-uj9?eJ^BNwbQ#> z_CB3>_kwI@_UYq;uB#c~dmd$nv#3<}J^o3zYeIL;=>1;gN*~Mj zGP!_H&-~Ryeqqia3=FcYOOK^1kIh=HSh-pe(;BphZ<-nF%bLGv;!6D}vx5B zI#O`MgbC6(TX`ugT)=uGZ0N)&<7a!=aHE*~`0ZYU&oEK?18OBr| zW{d1{)=F8#yv8fYBy|TA7Q*tPo;kRCcuDYbVSYc$ZeM5mEUk~kPQeC~Jeh`cC+>!{ zU;^O7|4I`bn=DV?)tSx=x41^%U7qsU6GMdeEUm2n;{cSn5)<9@jZ`Fkv90+vm}#lW zqOqLwp-|4a*DWF3%-~#0Z+Jt=!^_@a4E{*>b@};EKZNZJImqiy*wsY)JZ}TE%w*dL zJ$d!^-jDOO1(Gwv7ji&=vQ?irrP_7|;BmJQIBsQvl#U_z$hw?3@bv+w^d5a~tOQ%K zKj&orS5ek0PJJy1M#{3&{3MtO_RORICNkZ3U5r3Mw&)oXq01m5cAr3azjH`_BiNJ& zOg8O}s)b{c@tp*dkykT6Z0PnCrW3Uc^|M{z9uTa_UO?x`*Pb~TFJnUWv%}a8?Jp7I zCWUEOmT1Sg6T5&5n@$%A9p?+Aa+7Mf6t7u&klFAX7e0v&uV-Ym43epe5uZN z==-f5CW$xWT)4uEieeS#Hw@7Qg}j*!cDwFtfK05V8BQ3i@(kjdWxf>Bu1KsK<$|vn zTHn@=Zt6iF!)6BNky+9djw45K1~}GvCMQV!c;|=x5BR@WY)Uz#uM@v#FfxigVVk znBntoOmI0)V7^9_HzyWuLpTZf9l&S2Pgsxg1>_?a%fK{IH$-hJ0~1q+we8<7e}FXI z6#PcWl5IXk#u2ccd+XG=a|-~V>4P~^-NVfj67N4YVNnSFY8IXgAeH}U$UaoVakeI|J$kYRGRVA{ckm1eVXiQ%)l<1Wn6LWc*S+>R z`RX^Z5`W_}uI49!P??G16|s_DR(U-9;KIaBStQ-UPJde_USi6EC~7TW2%$68-|O#~ z`%d%bN#}EI`akN#RwvWo-z(}KQxVztKxU0lq|pAA>1>?nm%YTJt=G#l?JqkvERMz71cMOy{OPI!!+X-`ap7DUC^QfBQRDO& z;2t;5{1@r*s8zO<_O`KHbdz>KCs3@bVx9g8+ss=H!|+qcJN}U&ycj{carAc)pq+@a zh*-imO7%Y#Z)wzfuf0dmGw=n*L?$=ddt;e1CrQPppi8;hItQq5IbC~Um6RvYn~u}< zmd4N%@+UA}eZqLoVNyD)j^G`}3Dp2E%dt9!l?&=UW+M8a8$fH$qtn@BLRMNk-nU5} z1obxH4H3ZGKzCb_L`R}C&=jka&Y+me_pLy-l-d%^6FW2AA%aR^ie(R%*I_J=?!}Hy}qPIKi8JTygDNkMIoUbq7c)Bn!`Oywry@TGX>jf--*i1qMe*N@jW^3 zII$Ureno2s(&(mY1NNZ)+0w|T)}GxSX;6SzLke6(z&!E68-A0y;Z^XwoFveHWZG{X zK7wI&C&D?}s|sjqOT62YjGrGOp#uTi4&_zNlm5F3{k1(Mf5!~+*H?{493b8&+iX{NA&9|f5f!M0 zFdd^r+9iI%Fv9)J&FBKzC7SYAM$D{B&z#@BbgIQ4T$w_IqCN1|E{tr#xg{c>THj=I z%Lqc*_ZYhS$R_6s`keUm{`*e9<@UiTw=(b19KS6CC1_O+y5G9%XsYsz4r&*tmE}`D zRw>d3g5QT^6h#0dmr`6k4OqZuI**CBCdFeJrM!uFHFH9UjHnO?#;Qb?hF01a4NOl( z^*%O2LCw_0EBQS^Rq?(u8i!(!MblCw8CCDBf6gfkTv>+qAZmfy4--kv1T-UhQ=YD( zN`)#)B?NLp3?h@H+yydwNWez2lBWO~H5-)x@ezeS3egXtIx(>rM*8GK+z&Jv##KSX z@;-EV_KMsI$Sd#Pm^pIvPGU9Un)Z1I+iRcNX-1I^O zLnX+Cln!sdd!c*2;(&7ftgA?LKHZs}qGQ?Qw$BgH^)xiLXK;*4W~@*XySryhgrMXDh}K(>#fqjQhB4Jis?&@&Vf~9 zbkyt&p+iaf_o3N;wlj8c>(E^yoaik(lE_n~rS5L39bl-7q$!iIeav$g>V=MS$I;DLR50#Q<#_^2xYFP>tnq|c$t*(<8*B{Uia^z$uXYLMWNoum$1OxaJypr7zhZq*;* zz6A}i(t)|%qWKNC7~2eVzz9_3C^<jQ>?5W+;T7YEkAt$p^rI9qf=ii1ukF($ z3Gl~Su+KW}%8z3a(mkWgaZ`#U7sMnYc{zE4sY>a~zVD7i7e|eyKq~*dUT~aVT6|hIJ}=1>kF5Tv3s_D8sPLva8t3immvZ zi)5>qX-%8Pst%*#*X?n8+i9kNe$o_|$)~hI0MDrpKWWiN`7Ml*i|{rC3=N+bXh|2w zED4c??^looqPbzHyZXY)5O#xxpk>5=6YVi_KT2244V#mbJ+ddc{w=qR4m7LP!I_wA z(>KL#(&xgKWv~NPg@F?Wg(WJcFER^tnfQ6WxWI8_cxpy{lVby5VUy6FFz%c>xtZFq z8Dzn)P53RM-rfH$L_6h(QMr)VWrh~f00Zo|$(a2^c9^`&K#5wfzQM4w^?kaH-yG(7! zqc57p);yc1E#&d5it5z$RE|#SV|UWIRbf(3((v+{G*AWa0Fv4zz9^DfqH$_56wxI0 z0XmwbuD5)mackz6JnbZP+Fg>`4KPW)dV6(_R6VsM^=^rW4XdQpQS1Yzz)w~ax6sJ* zP!qS|M5A4_OkKzhN-<-zm!<^b^Bv4$>aw0Z=!pX-*q8pKnu|^O4lVj?$~!EYsURyC zN!z6=wPv$cwgoIP@4v2MU@I|drOV|@;;zOVUR5*{tf-}9!Csu63daFoF=oQGEf>1e z7ELbI^HyxlHS>0sVvUNnuGX|$7Ava+y_Y+YQXb7H1KBgQvqz|i!QsC-+yfpxg9aEw zK)~&HAt|lbNzq_|)O?J+01jRs;ttD%1AYHOE;Hr6yi# zj;gnAu+{TtZcSk2OHFdND)TXBvbD|HVvWl-wSp#5uLtjonroj}HGI7hTLV3ZAX&zj z@o@zP8* zk0pArsZ2EgNBR@Y^%V{88AQ7i?ix9it~QCjVkr5Ej3LS9GL=OHOXnd)U25bJ(xOiO z@3iNdYGxIvGPG*3)X|Yh!`}!mcq-bW`K^YpY?;Xj{WZxg#zz)X$ zQ^#2cMd7Utm=0->SQ?h4B?Y9rVOd#3I+c*6TRJ5c=@3{DSU^A!kWOh~B?P3Dt|g>f z;=|wf&D=Zpn|scjnmKd+J#(J(zRyh0A9Ttup?c~GKH40|5HZ|kI_v(OWv+9$@``cTpowX;B&qDX&ExZY<>ztex( z2QX%moOowT^)r>3kRs~9yuJTAPn{hZwX&T29ky)vyrRJk>NIH@J>_T^W9Yn9kGD11 zIy@v*16iSe=FJ)bWo0*=Bz?yDn8y!vaN?Hv;IaCfyLg{kdQ;zSF~=fI_GN~KOg+cP z)ji10>}bW^9m1MX#v3Qt?oh%vBI5p|A2WTQ2g61udXiO;3*T$LJ319TtuGeiMHYMS zAfm-zCBRK=BU{y+n))froQecAodOP3!dx+Ui6b*vdBQg#INPBEy9&;FWPWfXx_;&v zUe!oFG;Z4Mssy<*_3!Tv64%)jQ|GE20i94aV%uIDiZeqlI)KZSWVEJ}(GS8YlFHet z=k;o>(C<=3F4`5(=9qfW4QgtQebzAMw~yUjaI=HUex4%O{Kv$rrm}(UL#T>T^i{h z{bIHbYF7vVYms#Wma>znuG3@q)O-|6m*d8&ni6kF{^luVCQEP1)nT5p;HKXeC61)4 z%Y4!EU%LOKx!x+HkU2N|7$Wxj5Enp^IrDmKg8Ay(%G)Nhy4%jNOj&pT*u>9mrohfD zK2VI7bFjzZVb71lfkav&Q-o!pjHGNpWA*TTu<4GkJl}kNu0>nx9s+>~k&%{_3Tk|H zgbi#wc*(I{F~LK}E7>EV-pZ$gn}30$n%`-__PbIdbm`eRNBk|&Fvf3_QVSdbnHKUV zK>q?kJ>}-FAR@_eQvF4%WB|N+AzjYLZzE5lkUjupzk)+cA`jDdXt1d8@@=fTG4315 zEZZk={BIaUzGTiUytbuJK8i3IwvO)C&DnBV+dT-&vb|sqkB{vOj}KxDKUhh3! z&y`i{OZZeP(8>{^YDaKov_QC81N0%KTj92m`F1vy)op zJ6~N?wXe6n($IH8K)Sy zn_RQHaCuCM#`GCXrnet4>IPpQJwasxc7jlX6H+?AxeS12<&mECBMMds9-wt|n8;FB zabcmkRqaz}v0GfIri*`r6@TKxZO1#9@Si{c6ICKZ_@Y|`X}lTM8~-LpK#hOOQc<=W zqxc_IX-J6NlDOOejaE&a)*I&ydf8B-mSVyDj|Mt@!aC0| zFLays)QNGG7Yt@rBY3goFZ${i%QT^w3uVm)I$X&A^6w34vKw}I05iOok?&OYjauofkdW9@=zeejPQ@Km7$VPl(2 z^S%G1%?jN8Y=2jTRVGIzgX{f+(Ra?(V4VvPIr_8Vdcm6tuHJ>w?$1_|S7ovuGX$g6 zz8hck2`ozMh)Gx$PW$hfOGJX3WWGly9f0bmpPtP0WYOZGucM_B|5>uFq|1uPsWw%3 zJ5Qc_kyxEJ_6un|>rgt^I8voh$>$D%yOcJTp*aH08~PO;!>H*8$FPF0Z8{+f*zfF# zR5u9uL`Jn|XD*o=M(6i2G%&xoLl>~Wu*|?z3vg`&Tmj?v)(8h8mMLuBNDNbzr;36e ztL*~~VX{VkXcrbH>z_U{k2$^y@wCD`^7TObuuyZ_#aLbuj1Rfg52WhfjF?r2dw751 zue1nwDc&IKpTm}dHO@5nb?N&rqMXo zUeF_oHqF(DKtNv>89j6`Z1X;39jKbt+kK4A@94PM=QUiQoI5thUQ zT6K!8=MH$PYib1m8SP=#a?(S#>MEsIkfAYs)!{YN7FU3i);p}8bY7ZIJUU7f`SX&9 zURAZbAEmSKrc4z=3;%BR74lY7?$Q0$^0@8mas{IhE2z7Su5ey4ot{2?gS!ODtv><9 zh-awBFXS8!wRl1k+rjwGaBaA^fSF)qxpcd8LX-`~+i38#gM%5Ch#L{#5y}IXU++mE zdnPCB%pF!l_0sTYXoUaMU6;unH+#H=UbrrWpn0!0ZJ4Uw^i*fbB$KGGv<@&dpB%qB zXLn=v23{}!dM<>l*OI#O&-xo#mqbz~w*cV_IXiARr^Ix;GTlO%dhMq~;Oso*PEC>$Pn#E43^8r zW{2DGdNy0E`oB^kO4wjWuoASG(9h&qXhJ6H(uTsKmYakaX`@%wGp*v2Qs8W$)}7w8 zFO;#Lxr`_c2c|4TPi???vF`N*39}0QBs!>e$LnxwvD~gtC9L$k--%~wyg?N#$)08xQlQ)GGgT=#cNz;EzsqopvqdI zjt|>3O&CR#@#RZ`hA3nIoRvn5*Py~{a3Z$*6H4E&ds;EkSoanoPu)Su&&WKhQA3qo zEB%I)99o@beUP94S&wWaRiN_BdN{qS7M+~$NbX=iG*xMteoa?rXrKO@L?El`3`tIH z`ruH?Oy*4B>BG)I)!8QMId7NI_YY(Y#LEl{X_i#CU=%o1M>FCVk3avA?9_W5|MGLBCDaP?BXllFm%W~!sz*ML*<7SF9NOWjj z*ZOu0iKUd`(P1YKTT_zaE`oB>(#c$#QBw|$3W&&VvlC{B@3C52P=UD3z_C(n+r*I& zQk&6C6-0$bx%++!$fXcA1e@P1a*?CH*$)P}ss#_0L~WmL3*PW!1zQ}a!&LjxsY7%@ zCflkMz`I?qa1xuCDSh?^V?DK@?(%pfy=U@AXj8R`qKq3s-M@Z z?#L%M&=f6rSbADx{dlu6>AvCcGpOGU+(64#4!f*b3zQdgN zZm0A8SC%dFN9~Hm+rglkSRL<3@qE{6r*4CZd8QEEaM)KwyI?Gwr+&DUZweKNzN!~BZwF5d;wKm^$T1`YpywSzG4-p7cct9(;NB7gFbRS}| zk2#;hrf;55i{1NLfsXSXdzO$rm;$tyP}cK9#WN_p8mF7lm_WuDoziGE!i8(g!D#S@ zpitHe24oGr5L1LCK|~g6mzvUWqpNWiM7p5^%)o&h@=W#c_u3xHW-vA#`)@ug@T}h| zBXYKjoOBE|BMHE~i0YS;jSk>g6zow^GYVtGnbq-06Gr4TT^ZS50tJQ1K9@th0^}}LVg{W5n=aGdNRMa(T>hV0Bjd@d#i2j z|4W1M&WBZ=#%>K)s3TkakC{vDOGX*TnDETvvo2#_5no8O+m_LBoumGf_eRZ8M7db( zzq0_4?_%;6D~oDm5AaAv+hbQt3PA%q6G}tx@BIOWFqPe{2N4Cw00PyrqC=e(JAf{1 z68+WPo>cxQ!mp5Yi0<%%?5@0ceG3P_?3QnuzT^ZZgQ*YKiv;hutr zZB=biO!pQ`pgr{?aD>_X)zxN|M6tUFQAKZRSi^GGKJ=iZzEPt69H@9td|UvpTI}Mg>wY$IcOG(Q>D4tQGKp~$^Su{T z)T2_Iqf2%7iStnUz)T4l{^)tsky=REv#P-Z!TLCniu>tW+ikJorFNy~y!3q^;HF4t z5z0TGPk%G6w?b%>7%cNeJ_;|Sk2nMxh<`rXub$Aka>FB=bXC`z7+jAq{fYDk6+moEaV3@9f*OI%o+>$eHJ{E z91{soA#QR-=e?e~2&Ku*$C|2q72Av-l+*`UnrHy~{B#{i`HgteI@YL%6)!m$F7asB zy@7s@R_n6rg>VWfA76QsD$^A$ZuW}xRE8@SS3ZspNJq^J-gv21I~~V+ACA2XApB5E zeMj{YdkdPhjMiKV8YkoS{@&aW6H=TH_8|Wr4InN3mcN~Af9n7qh-qmNc_h#=zxfMe z5{Ai*5GKeY&su4E73j7BXL{`xuijBpWZ8o2w8}O^Z@FwP<0UowXCvp-or zB;L4I@UdnQKM&%qv0$;6-=iD({4A+|Mfn1(XcE*$Gd}3{qg3y~mI?28eL_+d2xuNa zsWA;ru5yj^k_BvCr7E-}$9dTTkqma8<1jmFeu7kNUYbeV>)xKc|h+-p;lbzWDsrIliQ{sppC4{Pfc$Xu!n#+hfJ zzm__56;s-Z^;}r<6DL?5-oT(aehKev7`$*wl)t^=T>T_}dy(2cxI=f-ck#I?TdhR9 z-P0vquAiB(+cVpwo~j{A17E?w{#o75(qU%OR@56_P}yL#XkQ6aL@Y!T@0gV&h?RMX zK?&0L_1p)?B|NwLjZvF+ieg{B%ar6m!`ip@* Date: Thu, 29 Oct 2026 12:26:56 +0530 Subject: [PATCH 4/4] regenerated solution package 3.1.0 --- .../Data/Solution_AzureWAF.json | 4 +- .../Package/3.1.0.zip | Bin 21810 -> 21774 bytes .../Package/createUiDefinition.json | 52 +- .../Package/mainTemplate.json | 6737 +---------------- .../Package/testParameters.json | 35 - .../SolutionMetadata.json | 2 +- 6 files changed, 87 insertions(+), 6743 deletions(-) diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index c07802586a3..4f84c9f5784 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -33,5 +33,5 @@ "TemplateSpec": true, "StaticDataConnectorIds": [ "WAF" - ] -} \ No newline at end of file + ] +} diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.1.0.zip index 606fe34349bd692208dad3b7d0fdb1086a369e98..1ded8c9537a81b6d09efb00964254336d7d5cfd8 100644 GIT binary patch delta 18350 zcmZs@V{{;06D>T!#OB1dZQHhOJCmd*wr$(yOl;duCbs>}^WFRYyMMZS^;%tPSDiY$ z`qVz%4HY0U6(I16GGO3n-@bi=`nGGVR}cRH2mSA?2U5{=C6@>bPYCR@r!c+(OBo(L zmL&q~S_Rc_#VBUl_2c0hS=7VsYkVpdh5nL~#+YIi&|@(wH&s_!Q-#?STsHf{0UY58 zlm=RxG-|}X@V15~Cfhd;24COv=Kw`tY4f&wgyfPOj?$}`nCHZPtd^UgiLeX2Jpl}Q zu7&J$Pl;ITWNVE|R-j4xVT90Sygk%?*_6GtP6FXe2=8rM#%#&|as|KscQS|cudN}X_%%8{p=uwj!)e>hJ*J8W-f0wH5m86lG~V*tnJj-Gh!bH|CKjB3 zpN2+E^R?`-c+L+bY##bkFqGqvC`Ew3RTi(2ytG8-vd%331IYY55rWR+yY`=~kF*#d zp;rqr=X&qlK^7*v@{`XqIBhTCix&aikbTQqL3Pmf4z1`l35>ewyZsEQ{{D8EC{xzx z=yqFpM*H^-GPEIen!0L*7g|%*W3v5+%1PjU{&zBQtY{4U256=*e_qH*redg0mdU$6 zgt3Zr)j|WmBZ(E;0!0&Z#Iifh&?PF!s*tBmb{J1yd1Mk3p9w2O!RGkIQS@?T> zI5B$IhXX%t5;{x8T5dQ;A{r}z*R~bv(rr3-Io^ga@8@_dcDj($xkAt5*0%$Z)ol~R zCxmyBYStuLj3J0>7QC7ITJ+umKh0$0@4{rOI}^V=WP|bplAZj;69w2-RZXU^MxY?U zkaWqnm_jQHesn3_=%x*SGjldq#rlHBXl9M-QUUy_YE>=k7KUT&P&ZvROz3sUg!Jd+ zFUX3utYcBYUp7hDC*F!V@u#DFy_9pX-hT2|6ZmDJrpl4FOxaq?m*Df=PV;tXh@Xa^ zbg%GmQj&ZhL!ZU0IoW(86fOj1gi*E{X>{TA3Q?DvY~YGFzFN#W793YoYmn@%>GEg- zZwG$gR@AbIEI*FHuD>4zI1V-D+JP=mK{cbim7U5QQ?Za8yudCqVRR@c8+YM<3JZfN zwTiZD`Nv-+Kf(FNet&J+X~#YlT*xDwe5bdl}AajWe3@;CpxBlHYPe=giCVbVA#YtUYtmAqRPWSFEb}N z`l3TGHzqRLa9g)xKiC)Nv(aQ%ECI($)Y`3U27<&$zO;r?oTZKNY z*J=5_XbR$8Tg@t=zUWelU0F^lQr$_(zDYIGjS2Zapo+@=$EN-7rCG_qrY7-Ld&|Oz z*@X*MUErGT!hKj!>^`cD_ND)4XMI`_ zV=7=Cf^BBld- zNuq7GCRY1GoFqA@lgsh{Ah}d=+Liq;yqgw1!Hqjj{$d5%S|{serWD4r>JG8PlhSgP zMuquo9TyQxY}R_!I+g18>YZA(OR1h5)Bx8?2n(Dc{FC@$c~pP;jOK8+k{86%F0EuW zsVNo>%42uA6Gnp==@0*?BuWIV0irLz>Ae(tQ(S4Z1?OcQ%BXJ{5*uGPAi=m_w-1S& z%a`Kg8;{{6h~Mc*63szk715d4@`AM*^X6 zq;i_H+JqhO#Ahg8bh+LvmYjLnfn&ahbI6mgj-T*GGQDYphIa?CcN%kC~Np|%)T7n0dbCwy~{na^J z6Sm2r5-Il|gU(>2<;_e9%rw+7rd4*7Y3wMLba5)egCB6|b3FIq`?#?&)7VHptRC4q z^Mv$#DD#IjSrr&u9La50+QsTeqn2wMWbvdR$hEonYdG^@eK3^?@v5&$Z9wvSQSo&s zL^|qv9>Im7_R3vpY<7xk*aL%S-%gQIU_$FXSC8!_x67V)Nd|6Ql4~4U9zm}*p&mU% z2g`4(xK@vGOsrtyH!Teo+coFIzCzESBJu7*PiGVA^zRvg!lXXjBH>pC z#xkKrN%eJ?Wp0P-yrE1%89c?KnRWW3oN6?ExA39Gti55vlb zF{g)Z#Gtld2w4%KnK3-AjfNN9{T?&78{WDIMa+Im{C>fHB4X&VH(;$ik|yl3d=qx5 z{w0vq35%8ZEXsb-1`B&v{C zKy{~~UVUuY5en~qA%IvKMb!pA8k@qBKhnfUL1c#N?L0f-l%HC^Kef_oCJH@$_>mNM zXvO&o`i!q2xRv_uvWFYe@H=M6BgG2f${_flc(=p;tzE6|z^?suG{uv3A~JtGdQUw> z;Ump~n~m^&8~3z@ZGoz!!^<&ESOFDtx-{;}ko<=0g~DmR4!E)yaFKJb1H;ni!Ebp^ z-$%(7tZ{bkKG%tqh1x!VHkC~E;p|JQ!-WTqveP_`d6LXlKB=5-4_^?up-vxW@)o+= zI0bkv4RU?ouT8#QKjgl;YaqzJpb);G2_RxQ&~5K}x7G*2v-JJm9er)#UmWi~0Z6k=g=zZj?fdCz2L7B}yxiXg%!pF4U{rLh-1To0I`f?Z?sBnhbFD8xilzNq;mm?OI2A)O$a|kB!;;>96-(WPiI@I8&)(Kg_^={Q>Nz zMqGxkGZrb@w7&7ODyAPw$z*P ztwYpsDJdc0KHwpNKwNYRfWyR^#BSJjst{~cIj^4Ka`!YXBdO3LRev?4N0OWPCndsS zuk@Pvurpb-!jI&+51qv<)Os&STIrxii1b&k22)&u(Oi4*6-W71p*z}RYB2&Qh9MeW zYdhU9H!LG*rgGgZlN%F&q;!Ra_wPKO#kdezM+N)iR`F{apr317&nKZtC1Xn>QZ#}< zV;Vwd8vI}uG}E3yi&~ZNy#h9}(qP%8X}h|Nz3k5gn_JA*ZZK{NbrJyqS^xNDXHL30^|f~XHvVWJuHe-H z4K!Q$q)WU%c=Z`XL%ys1{3BqoO;kyOysUJYW9H*2yt(~5u)nz3BQoxWS7hj|R8mA> zqftlZ)7;o~k5(K*s9P_m@QJ-M8~hD? zg=U^^$)x&2HiX_=!>{I1jY!t=GgG^`TCD+HjxlKgIhN8!>B;sr_ zUe`k-U>TJeGwX-i{?58Tyu;Rdh^IY|$J^}*n>)pT2@eYU0a<$7wi4opo8l`F^XWp+ zecn@ckPsbWz&n0wBiEH3 z4UM;Qdkmi)VJX_hBW&A5KcNq)UK{J{iO zT#Z*a#|d?CTs`m)aYtdMT$ejY41kN=^QQo0aiBu-^yxBY4Ojo=2QPG@4IDfLUj3wTBvYhL?Aabf~ z_-BZ(ekDP5dKCQZDWQrOWwXWAjg~z-ZW>IURMjy!MCe;m?oB>|l{`3>>}VVYX**a# z(pS)lTA1=DDt_n)a~C1M(U=+JobCz`MKpV}7b|f2GpCaf1dJ9^6n6g(Js9MGN#zQL zvN6=W1aB633=9YD+Y5h*ND`#`_FdiQ;fmG@{?2#cs{f9LH&f>TbXy03o$~D!7E8GR zMFWcs5#sT9D>ufFnKU7Az!7;6OH;=CVpqy~!B+aZfB~{>&s4grpw=&S3a$=di4`)< z;vsZPUlA5$>^PyN#J-uwyqixYw#XuLvl7}ZljAIjm$;{zZsr&D1tSMxaazRsIbi;D zHi?m9VU6*Jf}Z%(0>N2)|9dbh-sE9|XO#CYACJD=sehWA3?V^8fI`NHB1;I|yqURc z;!OX*ui=AVvuZ4ty~<~<54O2L98*1&7ZAC+cf<(_=xZSEb!eA2C%(l9yuT~&aogmr z@tfKv`Qr!}a?@5FFmBdf z$`B}SGa*y{!(6xD&E1tWAH3cF#O#X%jc)pcfRLJ^K<9(h{!Hi>kG&)JbswRqDa4(G zu3rCLMIrgEVfU%hnYpT@>*%lPh+?&8x_lGLQxf(>dd0>Xo$KQDzXjQbS*3*nnX6skQ1cvY{dDVVL-5?nukR(KZp;y zicT@z?2lmtI;#cT3dip;#E(bA83e={0K1FLPDyW&VE7a9+ir?Jou<~J3`F*DJRUB> zIe$h*V)=1WI;`dkRuuVPy87T~*lfKzKi|UK7`n)Ykp18@x$sCp_ANzmI_nx5g`DIE zHmrh4e_sx+8Wt8TvCN*Li*crj%5aOt=H2W{COx+S@e#6wD|4tKi_0;zyrIXjh2E?o>E9D_)u`JgMCLUo~m5a>j_-;G7!M^ zRpEE-)0_lioE-Mk%ddbn6IDsLID=;llA$e&lPtwj-H$Rry`0g%RC$x;YLOb=y^)r8 z-KH=0H}{)E;BR|%Y8XLz3xPC4kQxp1ZG`iv8diMj0z-6sPHB)ko42Py&$zJ~Qe&kP# zs4F>fAMsXK6n-k|>Th{bdlxG+B-Kd-Ge_s@B;C{Xb99WQZ(L48ZxD}R6d!tDjicVR{U*tpAXDb6 z?q%1g4~E81m|vXhyoblz#C!e^56E!LrDkM0AM5aeN20eYpeXGyg_jVB;u-es8r>w< zm?;4eEQf!OCE=%q7!jc7ycxh#o;l@^-uMKUeyBj8`m(}W6qGx(JKSNI7LHbfte@kK za6YKK$AT7WhmmBu_Y$lxp9~c+{D7^8=QlbXK1B=RhYa=&yLda0%jt;#AFSyQQ4~y( z>iTyhSS3v(VPa7x!0mvGzIVxwxM$`i0USUvU1miapd#t&$dJKZCbW0nr-WlluRMx` zZ_MJwJ1inf6&W{BKWWYqjWG*;Rq3jTO3h&|A6`n=bynh&a`5VHyKFE|+CZ79NUITp zbBRwIo^Alu(L&OI`^>~z!)y6EWawpXL)tot+!%L58cu&EOh zgR-3`xz_&{Q<)oM2>weBYr!~VLSA?qI*z+b%36MC9~y^!YJKZW)4oXba&23Cv~61f zhu@%L%blAcP zy;6bUjPcWi&NpDM>J-EW>hU#uj#1m1%cBPb3s-Y>tmO9D`|MpqDIq<;Mh zKZZh4St;`!X7Ubti{R5y5ASdH8LpqP@p~hB5G_mou6fcgb*DWJP=KauqfQn38;n|U zVP207ryRWm;rD_kkx-@t3MH%Q&f)6D)~8IU^HMSaN_|y9dWrwuJKi9R{YvrH9wWOOuFsuPcK@iDi-4KM|V&^is8{Ug#LYcK_J z)>9{f6L3lJ*yKcpj>9T_*XcMK#avQF&gke8`Y_K|KS2^l?8mz8KaxgMa+l=U{(hOt zmjqLFGaiOQktXCMTWZq(w&1pTeXA27Y@ZCa*~(CiI^$cc9|Xh-c=;fktqZ&oe^;`0 zmS6Sk$KBSNC50)n!*QdzmQXYaTCY zDIO;WDX!LIKRa3MbXqlSvVp1#9xriR9SAFMT;+91l~d<$tRFWA1Dl1APiJNIL27=; zWrz{dp0)}aQ&qcNPfd8BTpBKg`%?{&i_NuK>=GF%?0SO-{cnCje zdc`KRPZQK_`lv39 z+bG?nxCN@jL?nHw8fjfsRspg9p_+bUb3F+_UO}0Q6Bhjss{hY5)9;Nwc^N`{yTnEmuk}bCdrWncW6|*wAZDs+-Z@9!Z19v*Px?hdEkZ zhV~Bq9c{~twZZcWeVP4KvTi#>*(C76Q0l|q+K93&$&vp?6bJu@duc~EpMD-B0D<)5 z6{_mUKb&yds~^W{fOJovQwPREX4jS~i!Q4WeJW)pw{P`Ub1LN^g@SxBTZhv$H+@Wz+X;sX8OZn>1uaQWmW6m!jU>v)#`?j3S2IjfRtG)*(4A%LzAHC~Ct;W; z6hH5sqfu_iqo<$5Xw3==socQ(%(N-MFUWz#ZiyBBCGt%Ca#7241L=g)K}W`#zIU7O z{6XxTpuQ=BlD$yukyVC@|GSa&hpMB2)G2t9;B|N(I?r2O$vroATcXwa<9K{|g?2FCBvaBTT4Zrz6zC1rnt* zr@C@}o>TI(ezief_SksgaW{OoU^-s`$xvgvv$&laJmpVh`1MT&O zQsW9|RFgsE(Bie;oL7KG$*&51wfKt6U4G6R@wt9Y5>^dz7$6$a8-Rkj3tj&k^H}Y9 zy)R(pI^HUM>m!Z`(j(1)CnmYffC7IA#yvwo2=Z(UIrx4x!z7ljlGCo{=dhl1fxlv3lmEQ8a6C3-rXltyL|U17ok$Z~ZZZut1! z0Dv3b2aTLv-WYihF1;c&D-q8=+df$k*md)hvVeLoeb&pGLexTrLiE2mMYJ?e?y(;< zQZ@-&7mQlqDEuGA3-h{Ai2kGaY*gaTO%pH%QEV9gu&G!5u>Yc`Vi1X0(Aft&OV@?e z{*%a$kK<$WzJ(7->GU7}i9T8L0Z5yw`v3SZ+LO?aPXh**&%vU z4Oo%DdBynmpvS4^2!jn#lQhrukAp*$>&dSi?uuRTf6WO+MElXOl>>ucs6+uWOV;8t zHV9&d7;2#~cYu?_{aq(VhkA9%`hMo7ob7wEyi$BwTUnkYxhJgqdszYCX6~B17PGxM z7nA!hJ>1_PTpKo5ZdgtSKy8hN8P1>oWyksR^hQkXzwEFYR%m9jH5^dD=|(K*{DTbW zrExJXEE^Bhs;g_>R3`UD<+fsdU1?|pqYI?JgS&;6T`sQOU_Fjb@UnwA^d&eHb{pvN zwSy4YDF+>UNOQ36f&pU;{Q+N3m6d(=1}hhl>!1J+YeU#FV9&qMOUJ)c;73}0|)mxfMDU6$&#eDTHEIHU8Ca^2M>1r;*R(eNK z!c@Mpv{qOgv2m>}s-SZrKeHSVuu#0 zzd#v0`}H^Kikc)^dx@D+8iWu91F_I?$8FMb8zr%7)LbGAGU#tF+;I|%dH42;uREULJ-BL!G=a)qip+e>g@JRO3I>o- z$B@Myi?@Q8b3!MZ%RxW8E-lJj4X?Z?wgUe-Qrlu)bmYu;H?aB&oi957Dx5w?ThA z68hFooC8Ug;AJ9BTkx}o_Y(q%)ST#t+l}wN7r=4o)tq=+uqFLgFe~XbU$(5g<*IG9 zt-9Xag#0{@3@rXzIQ*$tqTX!EU&dZkjXOP%*k-HD7GLXh@0{$cfHbS zkd>}^4fz;NC{VaMQ(5h;!GcYvXVa7+S8dazlQCyKhUsW18Mdcw5KgOuQ!@~~N-B>yM6zzHisXxRb^+dgnatdwo2aCP z;0%V6k|qF<%=HfT2f?`ZUw_f(2|?%IU~xGG8uv4{+fso5rW8bS5Is*W+YKw6FZX?& zkX-wW(f@{A+G}T=a&I<|_3jXn0?BH!O_GO_siSD?_n<&lW{Oy#+GIImGB(&&B&#Yc z%hM~&-<-aA7ZM(K#;gABKU?<-+x0S(_$#n4*=9g}ZVXObidCVn<)@<~(&frB`Htx$ z5jbT2jC-+9%^V+Ok4tEXsvk{a-2hZUZF>#v*04uhgNLp_r?uoqN)C&}B21S#U8pTA z5&Po8yGR1ai|=LIR`cDbN46#i2%@y?0Vp--9tWS0f&l5LK*3}bIZFoCfzKzokzx->wp6O?I%Um$L#XwPs+~<%gyO+T*uKuZG;E! zUj@X`a|&9;+3rQ( z4P)E{v2z>4YRMl%-ebYWh86E%?zor-#Vdu7=~I~)8wM>N@7{@^q*|8X4aDZJb{Vqw zf}CIZCTBhvA$}X#8)vkC(5rSW(o1xywp5?1D00b9*nPQfvqWHOZeMoI-fxy=>ccj<#o$&M8 z`0wi^36-pzIRU>ifX#g zvoTgQW(wKxgY#fPC@qW|(2*!J--L#!ZgikK1Sw3#8YmRbqe$S=3Yj1Z4EaD31^!Yv zEVOJcXReS(e11FvRivhXa=52V-Th6?@l(`09?#VO-0sCz0^QJAUW63s2FI28T=Bi--o(x7}D0ey?sH+y zgp-tjUaLpx;uO!rFyah$0K>W>(;kq#&b(dUhcJ!01IUK)W&P4kV7Ltj??P8X#u2$z zsS#AWq0{K;eotfI6bOn5k85}EH?d$hkW9(JRP-=%3fJItybZvqDM@3n9cH5_iKe3z zNM|`FLiC!zqIS{)hVf2ggxo<_G&r1ttECNIGLU`IEg=mVa5)?@pvtYhu71<(`42SU zj1VKZ{^J6Qh&W6xhCE${X>?QB!EI<)sIg6COZ%`DXiLZ0LpW~5S@+%mdiUV~XN+<_ zhfmm>l9+m&tw$P46|TS#8 z{Z0V2UvxJT&()3c86U&9MlkjGCqH-H)NAY^kw2}qdQ||^1+*&Ev`5EH5JIS7%LG;^ zR`!AXq%JyvGuOLwe0R{5NADo0VzGN$Q&(a(9bH<+P>M_H8*O%?j-%%h6w?9ml*hVD zjNIKe>(LZ2u<&-rmE4l0H(T%?TDy5wK_bQ2dEUQySd)xp+Zn)M?Cs7dpb;6LdzaFP zMRQ=V0d0Cxu>pOZ{q1n*Rd?0PTZ~YzM%G@u2fROMaagPhs^WcfACECV< z9vl*%d!W#4ujXEz-iS%DM=2!q-T8a##m2g)`RSX1i2Yb-pu_Aeva?yav?OTAX{zVJ z28wC=g2>d02Sve$qHQTuTwqO1DS0I-maA7;f1%7#Oas1O;lQ_@*99j^p&#`pFd)lu zGH~+%S%<_S;{cB<2ipTxM}HDPPQtQP)0o?;V!qxTNQFk6w9(_iA%c3yr8DqPbZfA) zX9_C+b6c$M%r5^Jd>?=J?Dx#D?%~xwr8fN%iKr_J(`!>2yu+sN@>k6jGuRP!Cgo><$0Kqm-o|00`4-3Xn zQSmG;N?FOw^!vnkprY(~Q7i_{F{6sLU=)Vo-qMt-un?;R-%0EQy&DdirU7(f5RVj7 zO`RHDjJglpj3h`lLA4`D&X};JNG)e3IARheF3c+ea}Y`(Y-wafIpol7K`n_UQ(qZS zqGzDNOtjb?==Mv_1IV9#(S79-Y&6Da6#Z z9VH%CWTb01WsSG`*_F$boNp!kQ-A>$C4_ysZQ_m}H$vYKd;o}jFHTix*X-Ab$)tmNk|$`UQK`HA{8^SuW+7zZhSDkN$rsWB%lykSHNs^l&= zOqk&`&T3K5KB=585)-q9@$&6aJx}6iYw5uU(uL(8Gjd<7`#*e2vf1N`hM|Fn9Rl@H z$y0^Hx6q*5f(F&2WJ=LA)d1Gw%N&C)#V!RZ!_!pqpMQfDG#Z~Qz2-?T|9A%B)oU0^8F3fLB8mYPm_jer&eCji%x|f?eR=Rl2-1z-F%xG#UCPDH7Mc~T zP1Lk5?4z8T)uL5_#9&P+643Ka8O4R%OFY@`Vm9j3Axn%=F(H{35$yJ^PI9%;m2I2e z6&b}sX43`6CuilFuaf8_8p%2y$949dAjXPhMoI}Wy+uy9i6AuMQIiSifx<-91Ls!&XJ z8nzuS;dO9cEkA|VZ~-U&&a(KkQbB!K15Gtp%tGl0G2lwop9U4dW%ag`zP2j zjGrhD_+6;CWvzqOaT=fh8N$2A^=T#_6Bne6^wVo`-!*32FDW-6cHyl-8-1DcbK}^t zwRpyGhI+VQs~4|}*;n35nH$kRjS`$i-~Pt2b^G4ma?4iP8K z`sg1;@d{zyrXbMc%qfPOw%-4+bR%tLpnOX6dRv|8yr^HdCbcE0Y^~>^vitf!8s^a8V1@sII2oXa5 zG=pxBLi`%Su#)kzO?~Oh)>*ep`#X<*3pgM0bQvt{;r^B^j=AS+6b&*%LYfG90kvl4 ze}hj{Mh1RX!|&5=0Q9(tm!{LM1}`~UB}~FzX4xN-OFZLJJoe#&A!E>>T3mW9GF<0l z z!(d)F2$&H|!>0W*-uUzAt}dm`Vczg1$_(yBoxFmfRgH@W0;WnpZN73jDRaB$oVwY5 zQFV}H3$aV($i^6%OXcHpx(@WgJMnyLj@|tR%jkK9UD9eYXQ$1f2ieTB37HpJXn9TQ zcg3GUiM@PS0MBENPJ#yAHfik|hLnE2!!l>GzD9z^Z^_#=tAyoYojqp%H#$@I;P8`V zQ}@Am<86#|J?IW9aa8lirZ|$5Ev!( zo6-6*>1d}9(2)Z}zjQhKJpT+E{ulrSYrhUk^0-Kdgz%@~XX^gu=>00;xJc9|#2g0K zZ(59|H0_`we&m?sKRxBryMf(hSWk-mCi8rR@Qwxl)27ZSP1i8l0Maj9!PuqyC!`vk z)``kkNvDIBke)=@?lAE(;4BxU!pv9MR^ibZvSjJXqaCPftzF7qV=3NPvb;uDxN6

JC&OJLzV8`Ixd%$S-6f z-|r`iys#U5%G6_skID&Gvn1VRuzd+;3a7ibRPh(hdmZQY3`Bd-ksaGbdlm@RqhMzV3k8vlUG)$mh_!A2JNi{O2A|+ zc0@A(+7$y$X~xP`7+LRFC8)T->y*1CR36t|job$4T@Y3)N8#d%r==>`3X~qV?5d;v zBA;j8!*o|J`NhOxh_#z;q7b()mv0aEcumwn+$w7~=sI=D>o#;grP4kF)oFNg2j!Ws zxf60kh+){@ki3dlz8^gPjox-=5r2Fo110h4+EU3Wx|CjQYU#EFh%k*C5)t-tN*U^K z^K}Bm)rY5SFINU0izI|aiG0**nSh;mD64!=Pg_=+`vkJwA;6?=31h`vlG=0 zS^D87u3ai;t(~drTDWeDQ#eGfQOKL0Vg9`B{YM*x(v?Zh39gKro zyL$fAI$FN6dRM!DW+;29Z4MVF*&As5r+nM3*pRDNweu`BT`-~2Iz+9e89|^@jQ#L{ z4v=ZM{;|4QX@(M;K;I*e@Wn-KuObEA{NxZmie$N6!RlBTLX#onTE*trTE1)TQsvfh z;a)l0cfqv80o!y`bWfQDQiH`cXb{$BY)asYT?2Iy`L?pHG|hG)h1CvwDFWaqe<>-R z2)rH(dkuiSCqd>!+KuJrVD-98558i~=jbLdIfYk4^5Nwv&|Zd(i)DVn`tl>Crap6y zce33^wkrpeE&MG_B@ocf^?CPfZ(1BY9G-8ydy-kl&Gl*X`U;%;I9WY>%lv$K863WA z+;4n3BNt$FhBXi`_`{v)pARIk__%a+52;>lnu9^svxdMpV(llw?R)&e7 z81!K!eq}>=M^ODtMJgVEOj*)04atjL%x1*rF+ci66hpiu;*6PpG8rTa&JQj$>Ovj^ z9lJW!#GmfH44>)ddTkn>YW=x>IxxQ1HA?el@51N#luC)QCg)_>^#^QUEgN&UA9(4_ zjmt%oQsf@OPv^Y+EdX5o!Z%FCEqA(d;cqv1Ehv-L6$(`8G^>)~>a z2j-mLZ7`p02!3q`o%szYG9JhU^YNDvUq>70zWvT%Mc>KJkQqdKrckh{aH`es8u4h3 zv&Nq`*D31_Rs|Ai7txF-*HLWrv%-3?G=D@1ggKHt{Oh=HK2=dg5=2DeK({{D*S;Gv zTf|_WFG=WA2W`K$wNQdC=W$Rg%ZuKcmu%BdFN{6tN`j2WWIPTKpZ@go=I%Kg%y8*Z z3Ahi2ZMUa=Oc;%6LDl0uK z+vz`)BsL$*_0cg*U%J1LGo&RtF7kB3K~0y&A3~S)x%}0sLPhn127k3x^*X*eg|2_P zyQbBQ@iULbWAAf0&*rH^3s|P26X_52_!u1^OEe_Wr8D1P5GNmC_an-&Ii0mw)pdDdLCaQ;hC(v^8&2IBaBp?wzqK#WLLIfdYIdh)Xd+? zve03;8zrWM>jIn~@@T8|A?`3U?^g<-_>-P(^$}p37y_n!? z@epkSl~a+i0Aap4pC`6O<{##C;U&XNYXXH66Pa5jQ*DyLIzVQ7&nj#2g8H z){>C1>q+B0VAuPE{fV;FlKNqBZ7*z6aVXMu!tU$OSs;d#URvepA7Mna6KPiR8 zkxmEgZ>Gj@pp+G!C)oI&JtQXnwdioiV^T?0N~x%%^cx0;HKLeY2GMUGed9VBOKZM_FZe=3P${LTi?B-ZZ;OQi>m z%&DygM9O*0FWu9`zX=c_7z(UTHhw|d0Qb#b_z~UI+D~^JkQ?}T+&c)y*S-^qKjiFd z0L)OvE|pkQ0|Km^YZZ(K#dA-3k~ljQ?Q55gsJsxbJ{v#7)LDhSGI2h%tTi)NGjCZ5 z;{X|2^vn}79gXLahv;Tj zztv?K8+1GCBC6&TKlPd}=7`D(F(tR_0<|~HYz4*QF7fh6;Cj_?whFbRWmekKhdq6c zx<6uI`)?9u>ck|ahT;-FknJ5?r+O&g)Y>DRoLqu&{2!A|?DVZH|^J+PzBQsz^r0vpSj3ULZ2$)re=l3{52N3>{2kr|p zhob{EvB8MMry>8)BJI)8!sog?(_xdasdY;O~*h*S(QZiGx~SkcqM0t%SF| zV~w}U!irlSn*U7sd6!C~`1{h1m*wH3mdM(R^BF@pRoAL9cmt!1Ek^qn41fjpi9-g_vsfA<0wM#R$3g=^?QNnjdp&yZ|k8*k|c z9YF52MPIVB!S@_VFXJ|ok>I~?IQ{(_lHg)4#n+ot9k$Y2bWX~_kmg)0t*?t8@)N4` zIi+s=JKI(gqt9jb_rz!m@?fBkZ6q@zX`3z0;aM=E4u{>0CNY_;o}vEbmCElWqQQx# z>1-og1l_aDR=Hf1u4jC1l^BZrpx*Ar%DmFWFCH#<@r6#*m4OytqM3E%l_{{x1@_qQ zp74ses1xdhUfNJV3i@2w$?M~Wu~S(W^p|eCA~#ey{;Ydta$0IW3K`(3oF+;LIvVV% zC~hH3&*=HwPEDF*plj;AAcjI~w;|NmMJ}z_mWARbynqFjk2{c48^)~>ue!fQCbJ>F znzY)%AhGE~|GM3;y%qJIAP2j6Hfivx1^(W3NV6IdHEWT~^xCx$Ni6<3cml37fMi!B zdft!|l@zRoDaH1ecoiseG-?j;+(ClMw7@LuE;9aF9gGP0co9QCyx@HCE$<%4-NMv^ za^g_47j{9Vf#|m4`n0CA;rk4gpu_IgyLmr!c~FKqVj+&0pW>pis@(`zL|fU;>+!4B z;zTAOb1QZv=65eH3zAl2SgzOf`~iz9=rn3?1nTLOAD{V}2Lq%Y(6~!o{*zdO2G(Cp z2MvR^UlcxJSNaIXCF?`HsFpORPB zCwSEVB;;^8(+ZNN7uQHV)RK(Ls}~y-Q;|zNA9?V6*aAo-=M3ptcf?&tL}WpO!i#h* zNWxcCw__gMIyVf8?85&q;szc0xu|tVk7mTfz+>X0E#bNOw_s9#YL!||t5o6tbC=wj z87Z#7vG{U-|E7O>FocGO^mg(sQabPbh)o*~9yS@sv^@s`DO}{Z6Kso}zDIez z2Xse9NOd*J4iM`BVVGo!V8WaQMU=R=rVdvVE%YhE5(sl-A@F3OE8c=RpA?Lda8Mm0 zi1yI2jer2+*91X9Ldkf`g5y#a7{U^G%LvaLdx9KqN?aa)34*T3Epf4hFr72oi8E%l z6FK{geVbrx#5y;Qcn-pr<=mkKB`&kIj2A8gxUhkw;ot%gChy@}_Fq^hdP3&JHi)g8 zg!Xui$it5#I2u2F=FN^B+a|i_xGUO<9dI@SMCDp1v=dCFS3RsAR=!2-XzTf;k8a2) zG|Q*q)zid(`rPzSzeS$lv6sZco_R|yus6*@myGd!i|As+dxydE%^wWp;ZUXiB)&Dr zaC31o>+|r z!U4s~EnVOg5NXHEkczJP@e=s2?12Krd27;FE%u+tGO#2IbBc&4Y?P2KKqpau~3R6j) z11|NkB`ftmoTLm)cTJDDCN8~0pOP9RhzZF%GFmq%xxdgB0GS&YOaj_zsIM`goBnCW zG5FknI&C0Hk3T1@)hYo@{i%GfB3hbb{R^IupO>%+*+!A768E=wA7NDTYdC6BKZTbm z->qaQ>NjFVu9y(5jJJMR2@A*Duy^_G&r7&_$uQ~M!uLMbQIQfpXlTF?QlMYBj!G+&G?lTL|y5(X3;K377ME2EVMlB#F?8yjz`{ocO-tH3yWY%cv(K_RUA7Y{X&S#h>ZDNqSV8d#UrcrB;#i`j=YeFSX81|MV}l?$IS-cmcBXaApij--{=RJ^Jnle;*qBH8cFp z@IBl=8y_|Pf)8i(Nb1uPKl;UX?rf8P(ghexzGuG>{|P-Hph#@mY~EmMO^PH=Wi*e^ z{474_Tj?UI0``HX%co@?q9qCRIyDq2}p z=Rg%YKKa14$arVL@Fo2*Uv!`aDWq5}BiYC|xG1k1!D|_(#jJ%P5S5_OPYW1-!UX-g zAg&p16$~nErCHpoT<$^X`*VU_n_sMpN6x}aK$WfdpC}thpMnfWPXh0gen6?q&b4Ly zEB$nmgNQcFa5!cDROdYNJ99Qc)YX+~aq->-1dc6#|M&M9rHgdgB~4dd@=3Dpw?gOJLf2bg#|z1t$vWLC zT`s#07wRlUXIn=HTTAy^r39|8lZDV(rh_fly_V=)ag%Jao)Wi9rW1I`9_7o>)kO0} znv@xWA%r9bVOMEg9+Bvp~9@igbM|r0dB@*PjK_jZ~x? zTOr*@M!NAVkZz_T-P{W4W-`*vXMuDp73tPiNVk%aZaoX6+o?#mw?ev|jCA{1Al*qt zy0aD1on)jt&jRUgD$?D5t&r{}Bi(%#NLMTA(n)1I@uZR>pHwzSJlz$zj!AkwaXMnO z-AaHy7al|M;a~sd;a~sd{|8V@0Rj{N6aWAK2ms+?U6ZF&LJ8qwU0ngH RwC_!m@>DtobW{KU005hs#Vr5; delta 18371 zcmYg%V{m3&&~0oxnb@{%+qP{dPi)(n*mg3pZQJ(5y7PYbepUC^Ij442SMzlBTD{{c zfg3A<;T2^-!O(z!fS`a*g|r&rpWvYXJ@ulKWBZ+wVc`h@o1AHk?|_vok3P#%fz1|C zofjG9TB}q%4X@PXcH6RT7Ns}{VxmaAC{@%HJdKH_9t*B`_q?O(SXk&CQt3ipvrY{% z;(mBrLlcwT`!9nZ@PY+^qMvYS`(KDu@;r_r2Ly!I+3^-6Z-Yl+zL+# zMC(**jVe|^v-DFRAH@^N$eT$F7XoO5n{JenWRJa(Y%A{Fmwr&7Hu# zzcjC{A)@#l9zLP!fQ!RH``q8|iY^2NOh3*veR){tOcuz7}Z$ackvmqDULdHDCK ztZN}aPd=x^%#r|C;Um+s*LZafFBt2mDSnPks8o(G2tFX{546ya%VoR4Iozda^57?d zD-Y8XG&2=*gv|~TXsoWqL{|P&!Vhq^-mA;(Pd^1tfikXX>sze+(Zu4DmWM5#PZtlS z=@it6P)-hVDl6$~7_pp43XmF*5U{^ce?_z7y4P zBr#x3f>$yT&em3=43&24q#HmAl58EV`*_F)6#FOI1&hY>vurCHPTNc)f`OsvQExK_ z)s*0N$~|YMNdlPp*(zgxAfmN#M0Y9xeJL8$teO`jqpguQTsO$+HA#dFmSxXL3$!f~ z&_TYB5%7=xL~)}kCK`DuWg|Cn3YQ-Q7DHyJku@sWS%;Alh@UL+Hz|qU#_tU7&(9N* zfzDEYJ8Zl?_#@`ZfntJGaUQO4uGLrX$9>8Wq+=0 zrsrC6AGX+kxF~Y&ugtT7++c)jhWIPrQM@N)p}oGh++sRzl2fqi!h4hE1efTP?9~mA zc#iQzc8z`naRX)I0s<1>xjz1C;=zU|K|AdjY&=LGk)X0>g8s`Teu|sz(S3o48#R$? z1HXK30AsMV2veZ(NhRG@#ep?K;)4@oO_CY9m66n>mL`S(KM>{I$$5J}bRVR2GPt{B7ScF>3 zT=kL?>{xZ3I(KRkWjTudjT6$GlAkM5T^~}EnXqA)e=oi$Ga<>s11&M6x(4C{PgkT< zSqPgo;@vt{mebN@m27~{mZ+7Q*2u8z=~|<+C-EW{X|nzI|CIyyUpavP}GMj z!M@^cd9wYJ|EJ8B@BdR~%lChk(H0+|lNxyXPZ{?rHr?wO*BUiDwifXswk7Usaj{EP zCad!&r7kH+YUnn0ihbHI3yS>}lEi=hRwvwFIZSpW&jFyJ)LM}4KQp7)TTmFSxUMZ+ zwg>BEDOH_o7cEv;>2TFB5?O>NCIr2biafUe zg?u?!=Y-lKLyHrNkVT0=IF0r0Hnf-6V27iCx2!#3z>ox-Ain^71&Ky`eZMGYS~mBI z+x!m3M1)|+lWW50Nc*8kX2ns5?1s#}I~m;%xn-`z2O=IFfp-vAcZiZ!4gf@;Qm7cw z7!mftW1XV`j`fzCDx zY0fs2R2r&6^~vPas0pd)Pq=~~|*knfQ!IsKQ)~(Aq(nE^2OR6BXCv#TrhHR_ zRT7?fgD$9)bxmyXR8$lRw#_e?(pWHU*rOChCjpVtzYu;WoTEjDO%PxNQ@W=ktPwJZ zL#}TyWtCzxvSc@1>J`gg%vtO%QlwIXLziXY&m(^W>IW)KNmKbL>;Yr~R#cw_Lgqv4 zXA(Ra7|);gCS_!J#$Pn}ESy$LzmMqrpc%6}W@6g&D##&8$?!~}&m`(GB-5hz$HMfy_!)Xl048G9gYhW zyg}UtPtT;F4_>7L4*{NS)vA_IU#fq`A*M)j2oivNw*9U_U#&M{f(^XaSe_Khpyd|W zqof6VL-IviC7gLeq|IqJMdk3NaEbDT7n{^)Y9kAo2(-y_6C9=OrAm9?3#83I<~){97}Q7_=3Q^ zpWCN)G($W>|8hO$RJ=h7-E0w~F}g)EtwQ4%MWe8~l%HpEgxnONjyC4#WI#=z+HP}Q zM)`^IrSDM@_yIW0Wc$e^{hM=`#7eKZpsBLwlA}xGV7p^*JtlhSNTfaKZ%;#L6$a-| z`(8Xj9%_&BO)LabuH6_rTVy{j`>*x{_8k^EtCy{x%!{4?_T66<{EV?8nfk-8AqwYV zMT>!Z*`V945ZuG6952r*XI57S>tGLfQ>6S9Kcx0J&w#HK&)RVWcfvuM(LoFW7u`bC zF*W&{bU&L!ru}T*K)CZD#PAH1w4(jnKPIU0cHxb1n*w5SHM~DUkV4_%eLvSvBUmT` zJV3ku3!tg-hN2Afw${hO;*?-kK3;y8E+f2nG%y7NCwI;7B=&q8ucK5#7qzY>`zX>^ z8eD_|VwBs@++OtCM%tiyx>Tpwp=$42)RjNi7}N6}yL2a$r3Z;77GWL@u-VOAc7zG? zXP0C||L2v@8aBN<69i)Hwa6^ z3Vm{;w{5LQ@=O8vrCKB76QP+hasFmON{?f`Xr_Afi-qzgu-|N#$@Gi!;rn?qR*vCj zUZ<_j`}yqJ{C&8c!m{|3u?$N_`|cs4$u%)zA86ol{dJcuG_0RfHCz;{hxqOTLYb%=Gq<9QL#xxAx zG<4Z4WUeEL7L_&`ym1n!U`Bc7)6C+F+Tv5%;^V^N{Y#ntO*3y2oi}asPPKNnYk@EM z+}5sw!WmV;m>kh~pNp0^+{+Uo-4pI`B%N(bgvJM=?E+cX-e3c6SPZ|{&hx!BR-usM z7MRZyVD!W~0JiuAan8hN^8uaL3ozuWsXmAFY<>QbGbdf2`B}L7h<-K@SMchD26R~X zCQ5uBdkq-GKz@q(^z@qU5>1jIYbf31nfiJPZ|~-Ie}%SqL?_(yij4SBNQwyTHt5KF zn;W}cO@(6!<R>ls^E{i8I9boqy{A zm(ZE8@-dYSFRc!P*&eM#d7CrWwZ7h=+f4UsaUt+tLL*1NxJ3ci>EHRmKU>3hpR?Fx zi{rkpr*q9eOY2tm6kT#B3K4*jw5PJ;7&)Ih0~E$x9tbD9J+N@gwwK8k-ANV;*^gFU zZ;>)$9F*HMq+iz%P*=B;Ot;_$Po9Q=Hme_ojq7x8q!_sv|B9IRl9#nbio0Moi)TMj zJ)|@u$o2w}BQ9dCI3CWSNrhVI-5-nI=9i8Kv9I?nwz9Qu9`e5SIijqtl|DlOcl16V zGgoLg(wLM|Dg!FbilWc9LCH3xN__tZhwyoXR3<=xq0{7NFc$v;qtuQ45o!tGV~j$D zJrS)V1}ljYj6c;`#u9H*vQ4&rY-Wy#8|8<#C{l#a-C~~TUG1|eMi=lrPo$g<^2o-I z7ELGh6cf|nPccqSJZ~qhAz{1-{l>c|Dh#e+i3KM3hD~r0a3Y$}p8{tol%zu_^`?-a zA4+*FuI|zG#TB_?#INbr5#zMiH{&_vTnR7WMH4Hcour%`RDVz)EHNVgUF~cvc zu##{Mao&Xh7wm~YM>_7=e&nqN@HwBfLVEV^cHMoVC|F={je4X7!%y^lOGBiT52=Yy zclYr9c`PHzfQvL0VA2(Jf>=q?_wmfZVarDOb2bTF$(e~#cUHAqq5=xInj%5Mwm^{7 zBX31Qim~T*i3Im6yz@_FzX*NKrPgeKec;B%8<-OQ( zoS7AR8xbAxlNp?|Zz;boD#6l0ieIGfIUA>u>`iFCjWiZsxR-1$uoOcy=$eVWP3kJZ zw8z9{=(--`Q@_Nm$G-^}H5Ij$-q|*6edUVl%U?YXZm(3gzCP+XMC|2FZ=b;_Z$-pj zt)SHPNc4=q+D9Z}BgE}Ys6H*$Eo#!LKI7(^Gy-Q4N{kqZ0ADiw>dilL0cTBJZX>EzFj49hKb%AB^NEWy2Kmi-2FxaVS^H)z(RrJg8I z-DpOp)WKc7G9WM^S9RDF+U_5}jcoGVLHwIhac&HM>*2f^KE{(^0Peak}PcucU^DoH%O2OR2#rBoY;l!q62@JMKFbYpmJL0){%Jo+7XXoVsc1 zM7AO5BnJ4SRO78+7awk8zyC=-sI8Q)vg-A4?F*Z5Yi^Q@rpmkj_akRx_gBxh2&xM& zaxSwAFpWU){MsL))_SLcMVFO2hrf#rW=boLtRCIaPJl$KU8IXl6MmrqQ!o*eeJfkd zwd5jd5)*k-DO~F~I~UW7wdZOcejFcuJQU2|q=oVG5nEvtfoj1cWJYd+SrW;`D=swk4;lS#W;kFFohuAZhKD2nI*K8znIZ7u7N#_NU24I7=^lI-}<#g;1CX(87!9B5Mq?<6R zmqRQM_Pnh3n^QdT&>^6=PzNUCE8oN!Xt#;wcz|^(45}yfa_)nC&4MAvxa*tp*yj!CN|K1i$JFrF7K&ezwM;@=y!zr|3+z!@enck|^X!Pj8ImRNnrR&` z>)HN*!_2JZWrA`i4xVp8`VH7m-huVOE-ckPkZXH7f@OoPUV``h_C4HW0}6rOH9~fi z{DwYW^5V;RdQ#nGBS>QXT*fZeU2cNp72yB$2iuf+ib|(*kD^GxZ1U=j&{zdB8Mz<} z>7-!RcO#%>5Tk(G=t$}NEX!nZ1miQp{|GhbAnwts*5Q_DH0_XzVy@qL)?^{+_Lic$ z{($1hBxMlcPtj^A$9ac|5JvbW1k!c}^o2v`6E_6J&YA^=R< zZV!NaZ^R_{?bIJhagz|Fo=@rIV?w!H#a;YaW~K_tmfDsY+{+2irj9oxeMvcyShrw7 z3UJY337@EP+|H^lxLQbACqg7uDz_6*#5o5bM-LW6?V1@lW7Sd09=H9rYc z-bi1HdDRG|8g$kPy44*OIBX`J6p%pJRa!tOkG;RVtb5Q7;gtMK!YE=~m*2oPfa11tnA}l1YwoCV9tMO4i6|P1f892_X&ElTETGh6+x+md}kH_u3t@%ck1VW6gG4>?CK2QMg zzC`|#G-NAJZNUbYmLrb| z^cj?=nq*}H4*yb3Nqc_#PeraAQ+6nZIXd8R!(AS@^^ODc`vgk~?fZn{*g-#kR`hGS z!q)tfeZ0gip^*f8iCtSA$I2yx%W*sXpreNFerpA0){cMOgkp4~10Yj+;#;ZrBHui@ zJ1c8%7A|5^!pFO4O_dTO$Dt$)OWP=KK1@}#wkBkI=QZc6OOJ!zcWzCsA`8c zXk_ltpY%PABYPo*EVYnyRo_utX~|J`&*#6;?bLnGVdg`}8d@38W5ZhtTpr^HrbdiS zFpAvUx0{%zqPoVHA%Gqs=S$AEjG1RV4`0XQsmjz~{Stmdvy9Jq0@Hhx(!Jt-(Tp(* zq>fi$zbaHu;QsBjEMqiM*e{0So=I)AagOB@Gq?r^pH`OPmF<$7fK4Gg3navB3_RI$ zPr-RGl_iEy^?Z&zqjZSaer2}bIRrfvDF;j)#Jhh8F`)y=t^jhqAwv$Y(1WjzG4Eu5 zK`+vIGn#>23UhRQeG%j9_K>TgJ_F3HYhzE1zpAX_{fHAP*!FdCUQ=_@ToCGfZN2go z&X8pVxq^(juvE2%$)@|CkZi_nhrduBG0CQ+*Vx|94_p(Ha#?;KTbDFaD5`FPaXvy= zH(CgzBqlv%9swTzM8zpxQ(I|yl^M4}#<-?1q^Kd$#jhs~FR3HhDZ9u+8k_&N zog;(>4(7>237g$&r=FG~POU2Ed{FNDam8Ycyej>yTB*yleY3h&HTkYP@l?)ufK~C2 z5F|d=iVQnm;3;h??M3_mP1?-qI*ElIZr@SD)6pfJSOmBzR*`3MtanK_WxpfvB2e8@ z=UQCF8io(S)J7=OwvcfQl|?tMERE;}Y&t_WTH}nUt^Pjaq-nF?8(aZF*@-erkq?aJN|M+`l>S}OY8o{yr-N<1B z^qQ6g!D7no7gFi6hDMi;wMKk;4XU3;Z!loejGSuaC(i|?}0D(LG5 z9Z=LP6=L5_KIATbz008}Zmc;pX5Dn*^-76v1_SB5%E9zX#ZbcZj-$S0n;x^geaI=x zvDviCE!5u$EopdUSHrMCw!SNGk;jtRCyVd1k5Aiy+@Me*ArE!+-jJqIUPmITCHXWU zBm=~$S>g+SsBy_7(4}A-HTRy?Ne%?hb8!VCkI)@6&SqS>+vIL<0^$?#fj~eB0%ezP z!1%Sn-nRURo+!>?m6FtdBWWuCV{d}I=4-eV{r9=3l60bu(ug}kUAhY8moJ}k{$w1b znHM$1k(_9yFH)murpYTM_B{~St!r;0qXN`Y6ko_>{zMPataIwmSJQkcPz!!%qvk2i{f~wduNg z432co?#IUNYIP;|lSu|`kmS-q2O_Bt`qhx7nG?fBXT1oBa9t|fyZEznpr8OKIA1XJ z$3D@7(?9#EoW>|l3^{b6O(l-4Xfqfy^Dq`NXA1kaUX&Ix&XXp|7c=mio&UMdlU2R`3A1jXQuJ()98dTh+i+V15r8K+Yzzw^Z%b=HY&I%6x-iRjhRi zX}MV$+Y9Y$b-!vniH;?^z@T2j{(gIMA`AFWEdjL?L_yE?$FcT(CnZ8Q ze*V|s;2u5t@+$Fdjijsxbg!(eD{^{;ZpT{bR<8?AXSa6u7q4@yv?HLQw9R7g)Zi_V@48eXG==QG)+P(+julhu|W5-9vm>>=C0l6m-;?EXXS zh?K4?oRqr)_LftLg4f$Zim`mJCuz>aT}7(C+IIepm{eD(P>`mUg32C8;~NbdR}5nG z1RJ+jOINVbGAQcTVKm?>)^+%L$&#;C<#$Vg3gJKB<$_e5du}?xm@YMduMJQsa)KL+ zDsh76wW|=)5 zwA3Z*!Mwz@EPHsMe6Jg1NFWP8)OrP989P=~*bbLI9h>E=rvyM3If9|Z1q>i3WW?Ut zzdb+cy6}?IrxW72Q#>%x_v1U&k#nwFQ1aiuc%Q>plHvgIUQGvDqG+r1$S@SbF#t*!iUCv);{S@66S*}}Hz6z#v9P<7!ALEGt9~i{K<140p3D`-KzOGo zL4nUG~gqad1q^GxUezSc7Y%vg)rooNG6kCaX`!{u;+?W-JE z^R-50C`)h<>E}JNQMY0i;?uSTfAS=Yq znD7t*xPNgI{a5$U4O#3Rcod@IcKQKyIY^X}%*Z4M`L<@>{ zLaypB!vFo>^4^vIAZ?TBN7(O&j%~xwX7 z@10rk{Ho2-YH^;cT7qnmuBm(*DZ!7N zA$cJ@?WM&;$bDmTA``cp)|fZfpD2QvE4h_3{$Rd{3v~Mw*(_Uk^7X9ijgAi#)GohUC4R8?TB9LDO{`z8Kwgb8ky?XWoe_4+0B@rm&wV2sC-%f zpiU9h7vt+!xDQiv{OkY?qw%)+T?Ph%?SS|dD&fDe3v6<)0S}M$dp}0L2F4z1%?IOKNaaLuV>g7uCFT4irdg<~dZ6#@us81*;*%>>68 zsAmYNcwAabRi9Nc@u0Y*y-ra&@cfU$wX_J7QbhsZod&YtA^&T`tXhmiwe*ko*$((Z z(2F+nRJy-SYCR&4%rqjH=EpB2!7^5NX}1L&v22)bK8%c5QK2nByQ5C;HuxDVQ{&Yn zA+c#>p&U&}TO!`;y?U~|F_)R&_PmHFR- zxuc_q)mmxcoUWT_i;LiM#PaLq5ZPiW(unlsaMQ2HpC7$k0?Ik}gIUGF1jW?gEol>h z1Su(MBk3Ly^_Rc`d~YXAg?m$WO!LuHze>n$_{5$t?7IGoo?TZ>6X#^waA@5 zmhWwPfta581JFW!X2~E546>?EkEO4O&04Npxmpp|9<+>ao*C=Qn!jk~PJJ)8hm(L4 zES2|DC4~6``J}yS5G)36l4KBNd-Ok#J)MCLfG~iUm_{N~+ZklEnYOPP_}+pgOdope zLmK?0VvM{EdUDSZK*$8!Umks1G}}crTa}xF`J}#q35XS+$QJKTdnjF${wUq3Es5>R zk9)0BFG+k>Yf(Qhh3{S|FAY+q5O}ZEx@KM2Y1y>f(L4T@=`a{bJKn;dt~iw)4%%&U z0DHrp4%4?=?#i0C{Ku3o+gj@tZ7;<9V>vHYwA<&a>xBGQyHQi`tf@jca&_{&#>*)^ zUuQcG0Zx=WaA88UF4o?P3m5P{NE^B_Dg@b{wmfL2-~PMTkTc9w{(*8yUQ7Q_=iATE ztH0$QZtwSl4Bb^8tKC1HA)^n2gtv!K%G3y6#^96133H|@qihkA^zLEoP;ps}yHG}z zlVQviVRoplXKhqPENgs1%+hxtVIi!~8kvK;fWu3|=L?JbSq_JKvnLq?6b?#uxa7$+ zlsgG`lm$~DUx63e=-6ZhhCf~DEC`Eh4BZteA3ZU|_)jt_2H%b#i7PSD&0i=*G8fxg zpM#lJTCAGOIq!-UOncpuA}x$Abqq!~RJ?o~jV6$f^q-d>|2RhYu8@Pg?u1<}jF0nn z0I*di`$p)=i;vHKoSz+tyg7leBNB|A#>6T0whIuiho#_g8#A;_4B>m$<-~!XFC>-E z=u=Y_#FE1~7t6o2vRQHNYeh0vk((AE#ZGWw8GWkF@z`}W1_#?>U`m87hl<$!3&!`A zL;4fJt}0n$V5|d2eER>A8n)z-Epx;-VPSiFs$aY0|K(Zl!2A`)`d*Woej0rW! z4&yL#xI~Vd6rp8Zq8sB$`~zCpe7Z>FG+!W{n^em|%Ew6Tq*xceSGf%NyZw{%2nVHq zqZ-|egnzLVKP8ig4T3dE5n;e&Y~*P{^zKV7J@8CfLMUn$d*eD(@hkdFFE= z-HPP8aW3SVkE_^9BGzn+DRRz$?c7`Erkz_LAT3|)k(wSJ-jH~}*n}mZ5c0)5JQqkh z|IvtJsFw3`t-ZSZ-tl1Tdy1CwYvC8ZD4n@rJAr3YHE#jTnvUra-6yx%i-yf)n?RmV zTs;jV)oBRZ={4a^&N{;6S5gs3#(~3$D}OiZXe$@9o2}32$r{)o%Vyre6Eu{C;;eR0 z)%IY%+OvQ6+Q;OJ|HKL){>FD)-Cq)^Dih5+VkN!2>Uj9Um6?aCNT!v8;kI0&)QlBb z%tp`%N_VQi7vPlpM*HeT?|W_bKYYek7xQ586-|$ss9by?i)M`%cg90tdAxY(u>WP@ z4C1Fw%jK)@f)k&iE_9_Vzi&f~xXWbHp?8n*ydOp=_x5;+6+k-*vWn4}{s6Q9Ez7@m z2(KKmV-r-Wki)DeI6iRWvBWR-pRVg^Iqc7*30FY&Zj*)4(H-+f?D8M8=2DHbWEB{$$JZhCarK5c;7t^!@*clw>szkSc!Y=bx(-THmoRDFRVTU zn#<^PHo361_KweOk|$wZA)ew#t1Q2wsqL8(7va;#LqG zU01GP1l4A{`rnV&4Zm~5tY@>kDRzdKS_e1%AlLA^sT!O!3|scs2_G_<1SJ32R-{QZr z>Pq>-VD{hSIq(94jD@hw<LB{C{0`oY_r6KcjU5Y4uWdfP2t?Z)xV!=*(`9G%7-^p#&}>VW0To z55LOZ@F{v-P7)eCGViwyAHlJC5aS;0RR^@UC*JKz#m^6s(t|;4hw`cA$rP``er``G z+yPj?iv84iC4l06vyC>}oy~&8E8SP z^056je~zZA&gfxwaobow6k?SlZJ`8wNk`EHv2v*-G}1r?eW&x7`D#-uX13nRZwYEj_f^rjlzXgNR-(!1`e*%f&S8)$ zvU~?o3pD=NDC(x*8PS^x^p(}B)KRJ-&=cZNnWPo2(Ah(Rwo+BR1+eJZ=!D3RXbe%v z{zx^6i6w9{C+`ye;K^`qikepUp@8M#uL1f_6A@`I>95}pGyOpiLOf>oPjR|hc4aZN zvfX;zO|lLg1=eshn8_CVL%sg#zX2p3;aZeh2+wpWq#p9J(S3;?p3xGZp7jb2BMylR zlSWDiCv+eSpz31rT5L4Nm*fTEysBpT8W10!p&UF(Zo%oz=u2MQ;99EmA^>5YhJC~; zMc@lMW4O;bib*pzmKIB{^frIH3fR)CodlOFIc6nO}N}a&CGdl94j>LQ1EP|Gn@%e@Q@vLDp3yCcoayPSLSka{I?S z_<9-!`x7Kq6$?(Nsr}tGOxeODwU{=IbfSF=T17qLLl=d<65j%&9-uqHyV$9Ctxb$? zA@(BCxRoOWp+#6p85?;-Kaec+Jc5}IEjJJHxNU-JS#t8qAPhE`Jx7Of`httO?r~o_ zbtTWRVqvbberlcc(69xi0U-)*P8*+0cF{Tw;ZpO~bpyRds{%`VkdYh5zLjR9e14d% zo4xYD{j$M24I-5<8W2^&P-c7%surWGZf^t|O4`2<%kjOPv4dBS=^Ek8VAYvKkt!p7 zcT?jCM^hw2m4qX2pboMq_6XoCjTNL23mMlds8Pp^WZ0nd$ z&Mk_5v=&)0KY|Zp0QG+3lEgt9b%-A)a7@$?>m$m?tU?f{2e93E*}sRS!1{|R2J<$) zgahG@_ouFO$q|+7xRK~LMs|4zyhLB^8L?B`LfMW3vG@C^hI2TA(lX$NVbDlE8j1d~ z^?a)=7J%3pL@*E0|5+f?yx2rLRQDWoiSX%hcM*=q#N`7k{qkNiaHr88Amt{+F1#~L zqc3yy*Ef7(!!VICa<&03)auRadj6evQs$m^EO1gimV(Q}!)Dks2y}?BlWUmw%2VEp zwa6+yRamql)oUU;`u$Fj6!S!2a;xD8?=@(EjUK}N7Q=tI)x>t76Hc%?N7-3&3AGBY zaX&eZ2OAJ;$uaA^t1ym3ME`^-&qF1eTo99p;_d7Op(br0_qIC{T^JccS*p16OZ6gO z!Gom3(Fbx_x@gh1ZDIn{)>2ziRV$KdT!W)g8Y#q$*s7;Dmu`- zP8WA#uHC@wSF-{4FF8hga5Xpt5pa0o5{4r4P}hm?r;7_*C&s@m=&$nZK&d&$-p|_c0I3y_=E9>#5-Ay^ohZs<%Ck0MPj zA5Jvh z#mLly?xYeoF@J7OAUWT`E}<#!$%CCZaE5>GPpZAxROr-ZxTdDrSdwrv;qKtMb0LQ>kUlcFI4Y519XfgHWxB^;ND285U+;08@g(B=zv zOJipCC_(dcPlGzxJo}BMSfA7HX0P8^aGqBT2N^s1sCyAUQSygR{2w7IwHp`8Qsg{l z8-qII6bIwQY5~VtP-Ujx>P~96?(jA9XYS1q6-&+XcB=C+=5lo{I^s>swsk_LQ7;E? zi&|?RIJNw}5nBU2hhSMIm+=UL@YwsvG=zV~Ht~uJa!;i^5L1pirfp|9YiiUwRo-X| z0w{Vj{hi)sD8YITF@T|yNrHz2Q2J07NkMAUwL4lny#a6X1o>nwrUX1GkT+2q1L!Xm z%NGWtcrR8$9}3(qcGq?nCx29$OhH0Q3gB(7-!;2S!2&4KoiNV^qP-- zqQ#Rh$?U~1(Y)avy?s@0twf7h;s@KRM2mkTeS(F7lF>b*Sa-r*6Q}akCh=zsl>o5` zH2GYnil|W8JhYf=tpZY7)XD!{^;}cStOkIqz^auls1 z41k|hH}@!xJD~^VYzx%zp*67)mfaZ)78_>6??U6!nY`SAP7=a-fj%DA!nquI8U|o% z;c+cynxJkb<3l5d-syFZeCA0I7l$6~C(hgMt7}xXI;z+#>4dFVsYj^Wowq=oFLg~% za5pF(;HbF~2CEPf>ntItk+V{HlHL7vOow5W2>*$8Z^Y5@7+|w10w&)7)tatg#acgD z+?y39bae^cFpK+TV|z6bI|U0j@&H&~8*Um8oLwAD6fNGFZO&ii@`m8`Ga;k{o~-S~c2>=A0p+H>_H>=5Q=3T;{H+ zT{&ysz^P?}vsv>ozwY&e}AQ%f@Hve;CP##WrVjDvWVTCu}E$ zjZfU})+E0tJO{Zty2~#*U{6g^^!Z84fD3%Ckp|_kZZE_Z9n}W)$i}HlXBpmqr}G-pfiv{Y;IZ5qB3V+mD*7ZIAzg|L^8fdLqv$KcE@-i2ywHyC{Ap zRf4xq!E5gyE%SL^fz11&TMb~lz6ZxfPG9q$Tf~2#I*4o6ZT{|^OXqX)ii~giqeIf0 zK|>ZHZRhWNe?Pc*(^fzIZ`JhDLx5&GKS%#h*G+D2E`XPZkK3=! z`T>-r?aqw!qH2)}3qZ{^$RW{1BMYAY3MQ7{t4efT!x6Bjwm=&FO`;y*d5R(}AFQ~_ z=mmAQMW*7yzx}SroEXJDQgn!j4bj3VN6s1-@;9{D9lLl$(6Te03U6M;pM`1vJ5oXm zJe(`Tgfj+m3JBH%(T;%Hq>Qtg8Be`y_O^M$gxts+CNRU~6@VWU9XT8n?S~t5caZ7` zwr2I4BBRj*T1nd1&?;BV9O_+j2l}vq#2o?afYO+c)B`zdM^;jFPXsB2*Ww`KF5_DE zGP%NIyIxDeCqB)y;-r^O;ScRh_MgVvmDS)jK%{ZOHX7u}BoCwhk{2@nCnmus^qW*7 zSP98hV#DFi8{iS)4A^}<5yxUib3p#{fpan)`_gZcVUb(*nnIOCw=%?~Wk%32mx{!w zBanHozof8G&#+O+j_n&6L?*9MnM6BeMnGX zIYGJ~v3^k0%c${TZ@tNAu4@-J?L;a!_I*VgcV3iPUYpBZTW`_I8+SEEncRz%r==V1 zbr0-)27Z-mzmb3g7uiu=I}D}<5qKSL*{zUL0p6+TP?Ze?{B179dAS&l_SJx`IN7&t z4aL!w1h9=O%Mq>op>H@@kA%tz4DEjnhT>3WFc%W|9?EKbE%-ODI@%C?OdyiGn3wn4 z`yG`Czt+UlL=!v0dlwNOi;_B+zq>kBs@I+h!$`U>HIHH_?LICp0_!uZF8 zxtTPi%ept`o*fXS&vlSZO7f)u70;XrGf7U30?MKnPw7DH+$DT%JB7)t8h3PB{Fk%k zR|+|x+y3x&Y#wL-F_a%ryS-v2K2RXad(bnkun6bC=xjF{Wk1cf&Db5Z5m9-_(3zIBJJS?;-$4ue%VuGu~Mbz=X zP47HR0*hG#Ko;7{qwy6N{M)3F&r~Uoq4qIj9i%4%9mCn&ew)fnfdKfeuhWnm)4M!h z#0qK+bA>VI8c!0_GuzQ~f-q%~xQ}D|gvmzT!Lw@-akJxnTDS0sa!JD`dr9E47KcsT zO&k9PoOqv;zfhK0Qa>GU93)IDZsh)UOnsX5VCI@9S=@!f4E!;Xz3NBm0^NE1ojfUl z3-CX@(Wux`rvu@D!IVHg*RX^TI}$Iz=9QTytVFmcs;?EcR-Bkq7MnhrJg4xnknjAwAv5R=$zTSGDXgya zmM-D3c<{)Q1mq(@)@NUxtbfI{2zYM*5QhxVYd(&{`RwBn@Em=ZUir-_W5_vH0ns8@ zI~5X*b@6a`rrBnfsX+IKFUF~7sS25kHd)933B%EiMeIa?;r7XD_$4S}U= zQnN405Oa@{9S;4G_Xc7g8wrk5dDx{5Bm0MbQfH<4&1z-RMgHZw-ybR^iP8Dp1Z>DP z+~a@Tj$h6TdmB7n$rqUwWK8YS0nk76vKEDnJt58|gzD7BSrFGM3MabZUW$T^AgIm!0gk`V2B+%jvHx zCB&hghl^Y}5oElGES#8d^K3j|Cef#dV;t0>O(Mc?01RlOiUjVXfC(|?0M5iX5Pv~7 zFhU5&CmryO~%FV{cVd7jsaWRkcqN9X+U*)V@Y$! z#E6-jn0}^xIr)%L?7p$(WqaDbC9>|=^?@yrscl{twufE985KDVBb+S8S0#Ay7`WkK z6O?q6JiD+o)>ho4IddjB1H=IT{KLK+|HHmOR-FSuFoLT71HUFKbEA>}KkN&x5X`Jh zEH$R&t(a?rD{5(JAV3#w%kz7|V~O{bTcoFrAhutKAgTyCEiymx4Lhl6a?Q#Kw=$5` z+Tyr=V*GjK)gtoXqmo>new<>*<_iq`iI$1nV#W@zR@f;TVL;i_RAONu`Nnrg_ZZYZ zD^op6-w!LDrS+a5r`bB^=1au8mi@$eb5HvO;-3R9}nupiQ+MK zBOMV2V$bE`A~(*}RGeoxt1fzFsN9;AjVarqOvXTuILH@*>MOE#9E9T_jm7UVlQTY| zk}M3^$2pRdow&uB;_xLDTZ7MTOdX#{T1#K^eM0N?6F-y

uD#(qO+q>oBQsVg7JO>_YlqKIHTn=YDLC0Xfon?z<`XgguMeOhGCkN$P*Pv#)* zKVBMo@pQrPMGNAu|CnkkHgc9cf#s)tA%;xybLAQYZyd3rOx&uaAU-ir8C{Iyl2{E; zX|LB7;&p@ynO<~R(ot;q`Rgmy|NU7Q_28c4t8>P1U-qJfDZC}0nmxBQ6xCm+6W6Of zsU83GEfhWCpw0`p*X2tec#DZRXm%Nq-k|XyMgxCdrK~rw!H^$YfTlUT3m5 zG@JS~CyZ!91IG>j&%OSPUCdK2miLoA!~gJ7M+1*i$lK!>T*|p-6(+I`K+B;&9`}rf zH)C_oem|N@d^;pAX*Ppr$8447_RDsU9`(;<@9!~!b3M9lp^^)KvW7@mw-EMxhkBa< z)x~W*fLzf32@41G_-x3Xy)TI%bV2k0LQYdD+U`F5;64KAd$c_>>i|T5qV|1<1GY}% zq;oJ6weIM_lz13;OnkH@JTw0mOiF*PQmbi|D*S)uk{grUCVT>9!e&QYyEBvfMV+Oc zz4A`5ru&yfpSz}a=Z|xzEWX~6E3564k%g(e#wRlM(Bjl+Ft9s&dwWS!Uz)kFn>>@y z(wq1UB2)savuiTb6JYSy?-KNH#Ckv&CYd6b zFlSB?CGL%>!_`D{eS)wA!W>x$JXz?Hw_wgE1!E)}RQm{`J#=g%Ab|KaK~RuTGTyS_ zxReEkums*R!c)f{BgdN%mq&kspi6Q?Tx=msXUulujF|02&OT$`CKwyB&W$6UgRo^e zw`fj@%WN&9xyt~~Z6IklxB!I7dw9$K3+qIW$&AlD1+8oK68zxz-8o1XDSz?pOCKZxK7%4t>%`*JK!)<&*I0X<~nUu6rkMktcZU z1+lPa-jH+bO|sA>V|;HBoez2MFnGTCgMr-dtJI&ww`Le_E>32B{{Bm0dE7`G|8^ih z7G~rHFus~L`&@3aWgI+dh=P};_Q6?qGIvmhaOqg{v}sZ}pjf$u3!DNX?U)%*(KSC_ z;@?IO3I+|&y@}(dq9uRF>(fHYpvV-PR%}G<=?a6P^BD+5siW~s;$|65Y}Dw;ac2%c z@|IyB2JzQG(9)f0%14%Ie}!+PR3g6J4}E)(6@5ctDyeh8r9QS~rQV0*l!584=@Hk& zr8nqvQiB9BA$dne>jowF7uo_Ka|44(Ksycf6$W(OJIOc(pId*Y4J7IDmxQ%iCV;6w zmG4zVOEav0#bff@0yZJrC{k78{ub{ej7okDM@{Od@G|AQr3^*=My$vs6QY&z*7qx6 z;dm4FF2DV40e3GMCY@RM&c`|`Qo;uf4H!ZS^mErS=K7)mMjOV)X>RcC3a66%O3<4m zFMr=`BInC-a$0{-c6nUPuWOY?qL>f2j&ly1v=FRIO*RQlL#p(x&Q2X|6g>$ z)-u!p{fN=TC8NVcrJGF?|F0(TJMdgWq=GG1h4My!sa3AY@GrHBGOK^7Rph+>rB?Y% zt#jQw`Ae;Pa6uSefGpjg8vW8w;t67pemuZGg$94c41ZI62lvm$M~%PY{V6?=`n1H4 zezl!j+oXSV4#tw7*e}F?LJtTi5}P)gH<((JB8gKO&EhjZjZgT#Kg_EMk<$8Nq28Z; zxbQVjLR`0@EOy>=kZF$z^-yp=qxZyfO`Ss2=QK%0E34`ps6t1_AGj77?<^R;q(A11 z4zwVJ6su(<8~Fwo<#i)?E#tJ9wJ-#t5;XdC4nuz!qu=MmHN&lfL8YxUi+h#J-7o!g zMzCx1i*@nPnR^MSvK9XmWdrF`km2Y_;C<2$D0R`fwupbFpH6ZR(S{igr_7(~oM--M zPREG4x-u;;zTM~C0Mu*&D4j6~o)DPgxN3ZG=8PSBaEnL2v7=wQ1#9CW*cxZwAefoJ zvE_gN{wbq$kuJNW>8cApN!I0Zl} zz}0oK5IT!=u*JI90-Y;vl1Oi$Xue33GD9$gki;OYYGIb>2(}Ge z`)(C%Cdzl*JXYP=+aIWp{co!)AeanSeJX#kULR*a?ikLqRglKwL-y8>4+Nv|eOM~t=`Nz(a@zqZNvYmYzv`X=MA zKmPcWy~*ns{l)mRxSB?$OTBY$l|IHE3Bq%lTD23lg-8cLRA*JR>)`R1km-eoDkZ7O zhBL*c9fOHbNe1&E4SgUU;2T0v#mF@Gb_8yMoWh4#yi1Zn#h-50Imfo-%)Qy%V@Tfr z>%ZLp>%aW}P)h*<6aW+e000O8=RsMMgH%EZ=RsLri<6DPag)weItG|j000002Swwo diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json index d9d74403481..172b0817474 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json @@ -6,11 +6,7 @@ "config": { "isWizard": false, "basics": { -<<<<<<< HEAD "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", -======= - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **XDR Detections:** 10, **XDR Workbooks:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", ->>>>>>> master "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -55,47 +51,6 @@ } ], "steps": [ - { - "name": "contentSelection", - "label": "Content selection", - "elements": [ - { - "name": "DeployAnalyticsRule", - "type": "Microsoft.Common.CheckBox", - "label": "DeployAnalyticsRule", - "defaultValue": true, - "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - }, - { - "name": "DeployWorkbook", - "type": "Microsoft.Common.CheckBox", - "label": "DeployWorkbook", - "defaultValue": true, - "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - }, - { - "name": "DeployDefenderWorkbook", - "type": "Microsoft.Common.CheckBox", - "label": "DeployDefenderWorkbook", - "defaultValue": false, - "toolTip": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - }, - { - "name": "DeployDataConnector", - "type": "Microsoft.Common.CheckBox", - "label": "DeployDataConnector", - "defaultValue": true, - "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - }, - { - "name": "DeployCustomDetection", - "type": "Microsoft.Common.CheckBox", - "label": "DeployCustomDetection", - "defaultValue": false, - "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } - ] - }, { "name": "dataconnectors", "label": "Data Connectors", @@ -414,12 +369,7 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]", - "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", - "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", - "DeployDefenderWorkbook": "[steps('contentSelection').DeployDefenderWorkbook]", - "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", - "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]" + "workspace": "[basics('workspace')]" } } } diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json index f23f00fea8f..844f11a52f7 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json @@ -59,52 +59,13 @@ "metadata": { "description": "Name for the workbook" } - }, - "DeployAnalyticsRule": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - } - }, - "DeployWorkbook": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - } - }, - "DeployDefenderWorkbook": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - } - }, - "DeployDataConnector": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - } - }, - "DeployCustomDetection": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Azure Web Application Firewall (WAF)", -<<<<<<< HEAD "_solutionVersion": "3.1.0", -======= - "_solutionVersion": "3.2.2", ->>>>>>> master "solutionId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "WAF", @@ -228,11 +189,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "Azure Web Application Firewall (WAF) data connector with template version 3.1.0", -======= - "description": "Azure Web Application Firewall (WAF) data connector with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -334,8 +291,7 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - }, - "condition": "[parameters('DeployDataConnector')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -365,8 +321,7 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" } - }, - "condition": "[parameters('DeployDataConnector')]" + } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -422,8 +377,7 @@ ], "id": "[variables('_uiConfigId1')]" } - }, - "condition": "[parameters('DeployDataConnector')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -519,11 +473,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -551,10 +501,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -567,8 +517,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -616,8 +566,7 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -628,11 +577,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -660,10 +605,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -682,8 +627,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -691,8 +636,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -740,8 +685,7 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -752,11 +696,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -784,10 +724,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -803,8 +743,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -812,8 +752,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -861,8 +801,7 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -873,11 +812,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -905,10 +840,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -926,8 +861,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -935,8 +870,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -984,8 +919,7 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -996,11 +930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1028,10 +958,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1051,8 +981,8 @@ { "fieldMappings": [ { - "columnName": "URI_s", - "identifier": "Url" + "identifier": "Url", + "columnName": "URI_s" } ], "entityType": "URL" @@ -1060,8 +990,8 @@ { "fieldMappings": [ { - "columnName": "clientIP_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "clientIP_s" } ], "entityType": "IP" @@ -1109,8 +1039,7 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1121,11 +1050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1153,10 +1078,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1174,8 +1099,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1183,8 +1108,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1232,8 +1157,7 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1244,11 +1168,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1276,10 +1196,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1299,8 +1219,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1308,8 +1228,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1357,8 +1277,7 @@ "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1369,11 +1288,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1401,10 +1316,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1425,8 +1340,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1434,8 +1349,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1483,8 +1398,7 @@ "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1495,11 +1409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1527,10 +1437,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1549,8 +1459,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1558,8 +1468,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1607,8 +1517,7 @@ "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1619,11 +1528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.1.0", -======= - "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1651,10 +1556,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1670,8 +1575,8 @@ { "fieldMappings": [ { - "columnName": "Uri", - "identifier": "Url" + "identifier": "Url", + "columnName": "Uri" } ], "entityType": "URL" @@ -1679,8 +1584,8 @@ { "fieldMappings": [ { - "columnName": "ClientIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIp" } ], "entityType": "IP" @@ -1728,8 +1633,7 @@ "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - }, - "condition": "[parameters('DeployAnalyticsRule')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1740,11 +1644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.1.0", -======= - "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1762,7 +1662,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Application gateway firewall events\"\u007d,\"name\":\"text - 10\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":2592000000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where action_s == \\\"Blocked\\\" or action_s == \\\"Detected\\\" \\r\\n| summarize count() by requestUri_s \\r\\n| top 10 by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Blocked URL addresses\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize number = count() by action_s\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"WAF actions\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 11\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\" \\r\\n| summarize number = count() by instanceId_s, TimeGenerated\\r\\n| where instanceId_s has \\\"role\\\"\\r\\n| extend rolenumber = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\", 1, instanceId_s) \\r\\n| project rolenumber , number , TimeGenerated \\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Role use, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\"\u007d,\"customWidth\":\"40\",\"name\":\"query - 8\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize count() by Message\\r\\n| top 10 by count_ \\r\\n\",\"size\":0,\"exportFieldName\":\"Message\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"exportToExcelOptions\":\"visible\",\"title\":\"Event trigger\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":\u007b\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"labelSettings\":[\u007b\"columnId\":\"Message\"\u007d,\u007b\"columnId\":\"count_\",\"label\":\"\"\u007d]\u007d\u007d,\"customWidth\":\"50\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\\\"*\\\"\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Messages, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Message\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"50\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| project Message, TimeGenerated, SourceSystem, hostname_s, ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\\r\\n| sort by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Message, full details\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"\u007d,\"name\":\"query - 11\"\u007d,\u007b\"type\":1,\"content\":\u007b\"json\":\"---\"\u007d,\"name\":\"text - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, ResourceId, Category, Role\\r\\n| project Amount, Message, TimeGenerated, hostName, ResourceId, Category, Role\\r\\n| order by Amount desc\",\"size\":0,\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"\u007b\\\"Message\\\":\\\"*\\\"\u007d\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attacks events, by messages\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":\u007b\"showIcon\":true,\"aggregation\":\"Sum\"\u007d\u007d,\u007b\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"hostName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Category\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Role\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"$gen_group\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Count\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"TenantId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"SourceSystem\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"MG\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ManagementGroupName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleGroup_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"transactionId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"originalHost_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"_schema_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"error_code_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"error_message_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"instanceId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientIp_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientPort_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleSetType_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleSetVersion_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ruleId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"action_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"site_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_message_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_data_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_file_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"details_line_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"hostname_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientIP_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"clientPort_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpMethod_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"requestQuery_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"userAgent_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpStatus_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"httpVersion_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"receivedBytes_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sentBytes_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"timeTaken_d\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sslEnabled_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"host_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_clientTrackingId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"tags__type_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"msg_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_originRunId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_actionName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_actionTrackingId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"workflowId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Level\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"OperationName\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"status_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"tags_LogicAppsCategory_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_resourceGroupName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_workflowName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_runId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_location_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_triggerName_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"SubscriptionId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceGroup\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceProvider\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"ResourceType\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"code_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"correlation_clientTrackingId_s\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_subscriptionId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"resource_workflowId_g\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"startTime_t\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"endTime_t\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"Type\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d],\"filter\":true,\"hierarchySettings\":\u007b\"treeType\":1,\"groupBy\":[\"Message\"],\"expandTopLevel\":false\u007d\u007d\u007d,\"name\":\"query - 16\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nAzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| where SelectedMS.Message == Message or SelectedMS.Message == \\\"*\\\" or Message == Child[0].Message\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"\u007b \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"\u007d\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attack events, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 14\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"\u007bWAF:lable\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Message has \\\"SQL Injection\\\" \\r\\n| summarize count() by hostname_s, Message\\r\\n| order by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"SQL injection, by host name\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 15\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallFirewallEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Application gateway firewall events\"},\"name\":\"text - 10\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":2592000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where action_s == \\\"Blocked\\\" or action_s == \\\"Detected\\\" \\r\\n| summarize count() by requestUri_s \\r\\n| top 10 by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Blocked URL addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize number = count() by action_s\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"WAF actions\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\" \\r\\n| summarize number = count() by instanceId_s, TimeGenerated\\r\\n| where instanceId_s has \\\"role\\\"\\r\\n| extend rolenumber = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\", 1, instanceId_s) \\r\\n| project rolenumber , number , TimeGenerated \\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Role use, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\"},\"customWidth\":\"40\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| summarize count() by Message\\r\\n| top 10 by count_ \\r\\n\",\"size\":0,\"exportFieldName\":\"Message\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"exportToExcelOptions\":\"visible\",\"title\":\"Event trigger\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true}}],\"labelSettings\":[{\"columnId\":\"Message\"},{\"columnId\":\"count_\",\"label\":\"\"}]}},\"customWidth\":\"50\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where ('{Selected}' == Message) or '{Selected}'==\\\"*\\\"\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Messages, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Message\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where \\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF})\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where '{Selected}' == Message or '{Selected}' == \\\"*\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| project Message, TimeGenerated, SourceSystem, hostname_s, ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\\r\\n| sort by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Message, full details\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"query - 11\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, ResourceId, Category, Role\\r\\n| project Amount, Message, TimeGenerated, hostName, ResourceId, Category, Role\\r\\n| order by Amount desc\",\"size\":0,\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"{\\\"Message\\\":\\\"*\\\"}\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attacks events, by messages\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":{\"showIcon\":true,\"aggregation\":\"Sum\"}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"hostName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Category\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Role\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"$gen_group\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Count\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"TenantId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"SourceSystem\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"MG\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ManagementGroupName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleGroup_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"transactionId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"originalHost_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"_schema_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"error_code_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"error_message_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"instanceId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientIp_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientPort_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"requestUri_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleSetType_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleSetVersion_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ruleId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"action_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"site_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_message_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_data_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_file_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"details_line_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"hostname_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientIP_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"clientPort_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpMethod_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"requestQuery_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"userAgent_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpStatus_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"httpVersion_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"receivedBytes_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"sentBytes_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"timeTaken_d\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"sslEnabled_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"host_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_clientTrackingId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"tags__type_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"msg_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_originRunId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_actionName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_actionTrackingId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"workflowId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Level\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"OperationName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"status_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"tags_LogicAppsCategory_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_resourceGroupName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_workflowName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_runId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_location_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_triggerName_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"SubscriptionId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceGroup\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceProvider\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ResourceType\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"code_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"correlation_clientTrackingId_s\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_subscriptionId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"resource_workflowId_g\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"startTime_t\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"endTime_t\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Type\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Message\"],\"expandTopLevel\":false}}},\"name\":\"query - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nAzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where OperationName == \\\"ApplicationGatewayFirewall\\\"\\r\\n| where Message has \\\"attack\\\"\\r\\n| where SelectedMS.Message == Message or SelectedMS.Message == \\\"*\\\" or Message == Child[0].Message\\r\\n| summarize count() by Message, TimeGenerated\",\"size\":0,\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"exportToExcelOptions\":\"visible\",\"title\":\"Attack events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"70\",\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" and (\\\"{WAF:lable}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Message has \\\"SQL Injection\\\" \\r\\n| summarize count() by hostname_s, Message\\r\\n| order by count_ desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"SQL injection, by host name\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"query - 15\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallFirewallEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1773,7 +1673,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallFirewallEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - firewall events; templateRelativePath=WebApplicationFirewallFirewallEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallFirewallEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - firewall events; templateRelativePath=WebApplicationFirewallFirewallEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -1821,8 +1721,7 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1833,11 +1732,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.1.0", -======= - "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1855,7 +1750,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Application gateway access events\\n\"\u007d,\"customWidth\":\"100\",\"name\":\"text - 2\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"parameters\":[\u007b\"id\":\"b3ac8870-500d-4dd8-a570-f49a2c2f1a76\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":86400000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"customWidth\":\"50\",\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let ActivityData = AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\";\\r\\nActivityData\\r\\n| summarize Count = count() by clientIP_s\\r\\n| join kind = inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\\r\\n on clientIP_s\\r\\n | project-away clientIP_s1, TimeGenerated\\r\\n| extend clientIP = clientIP_s\\r\\n| union (\\r\\n ActivityData\\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\\r\\n | extend jkey = 1) on jkey\\r\\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":4,\"title\":\"Top 10 IP's by activity\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":\u007b\"titleContent\":\u007b\"columnMatch\":\"clientIp_s\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3\u007d\u007d\u007d,\"rightContent\":\u007b\"columnMatch\":\"clientIP_s\"\u007d,\"secondaryContent\":\u007b\"columnMatch\":\"Trend\",\"formatter\":9\u007d,\"showBorder\":false\u007d\u007d,\"name\":\"query - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\\r\\n\",\"size\":0,\"title\":\"Activity, by cIient IP address\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 3\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize count() by clientIP_s, TimeGenerated\\r\\n\",\"size\":0,\"title\":\"SSL use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 4\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\\r\\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \\r\\n\",\"size\":0,\"title\":\"Received and sent data, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 5\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize number = count() by userAgent_s\\r\\n| top 10 by number desc nulls last \\r\\n\",\"size\":0,\"title\":\"User agent use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 6\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\\r\\n| order by number desc\",\"size\":0,\"title\":\"URL address use, by client IP address\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"30\",\"name\":\"query - 7\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize Count = count() by httpMethod=httpMethod_s\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"title\":\"HTTP Methods\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"purple\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"35\",\"name\":\"query - 8\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count = count() by requestQuery=requestQuery_s\\r\\n| sort by Count desc\",\"size\":0,\"title\":\"Request queries\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"35\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\\r\\n| order by sentBytes, recBytes\",\"size\":0,\"title\":\"Detailed activity\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"sentB\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"recB\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d,\u007b\"columnMatch\":\"sentb\",\"formatter\":4,\"formatOptions\":\u007b\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true\u007d\u007d],\"rowLimit\":1000,\"filter\":true\u007d\u007d,\"name\":\"query - 10\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallGatewayAccessEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Application gateway access events\\n\"},\"customWidth\":\"100\",\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b3ac8870-500d-4dd8-a570-f49a2c2f1a76\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ActivityData = AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\";\\r\\nActivityData\\r\\n| summarize Count = count() by clientIP_s\\r\\n| join kind = inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by clientIP_s)\\r\\n on clientIP_s\\r\\n | project-away clientIP_s1, TimeGenerated\\r\\n| extend clientIP = clientIP_s\\r\\n| union (\\r\\n ActivityData\\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (ActivityData\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":4,\"title\":\"Top 10 IP's by activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"clientIp_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"rightContent\":{\"columnMatch\":\"clientIP_s\"},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9},\"showBorder\":false}},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\\r\\n\",\"size\":0,\"title\":\"Activity, by cIient IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize count() by clientIP_s, TimeGenerated\\r\\n\",\"size\":0,\"title\":\"SSL use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\\r\\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \\r\\n\",\"size\":0,\"title\":\"Received and sent data, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize number = count() by userAgent_s\\r\\n| top 10 by number desc nulls last \\r\\n\",\"size\":0,\"title\":\"User agent use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\\r\\n| order by number desc\",\"size\":0,\"title\":\"URL address use, by client IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"30\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\" \\r\\n| summarize Count = count() by httpMethod=httpMethod_s\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"title\":\"HTTP Methods\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"number\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"purple\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize Count = count() by requestQuery=requestQuery_s\\r\\n| sort by Count desc\",\"size\":0,\"title\":\"Request queries\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true}}],\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where OperationName == \\\"ApplicationGatewayAccess\\\"\\r\\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\\r\\n| order by sentBytes, recBytes\",\"size\":0,\"title\":\"Detailed activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sentB\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}},{\"columnMatch\":\"recB\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}},{\"columnMatch\":\"sentb\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"coldHot\",\"showIcon\":true}}],\"rowLimit\":1000,\"filter\":true}},\"name\":\"query - 10\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallGatewayAccessEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1866,7 +1761,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallGatewayAccessEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.2.0; title=Microsoft Web Application Firewall (WAF) - gateway access events; templateRelativePath=WebApplicationFirewallGatewayAccessEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallGatewayAccessEventsWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.2.0; title=Microsoft Web Application Firewall (WAF) - gateway access events; templateRelativePath=WebApplicationFirewallGatewayAccessEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId2')]", "contentId": "[variables('_workbookContentId2')]", "kind": "Workbook", @@ -1914,8 +1809,7 @@ "contentProductId": "[variables('_workbookcontentProductId2')]", "id": "[variables('_workbookcontentProductId2')]", "version": "[variables('workbookVersion2')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1926,11 +1820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "WebApplicationFirewallOverview Workbook with template version 3.1.0", -======= - "description": "WebApplicationFirewallOverview Workbook with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -1948,7 +1838,7 @@ }, "properties": { "displayName": "[parameters('workbook3-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":2592000000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d,\u007b\"durationMs\":172800000\u007d,\u007b\"durationMs\":259200000\u007d,\u007b\"durationMs\":604800000\u007d,\u007b\"durationMs\":1209600000\u007d,\u007b\"durationMs\":2419200000\u007d,\u007b\"durationMs\":2592000000\u007d,\u007b\"durationMs\":5184000000\u007d,\u007b\"durationMs\":7776000000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\u007b\"id\":\"b1a1c99d-4498-4e02-82f0-d52c276d5657\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Events\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count = count() by OperationName\\r\\n| order by Count desc, OperationName asc\\r\\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)\",\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"\u007d,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\n| summarize count() by Resource, TimeGenerated\",\"size\":1,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource events, by time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Resource\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"70\",\"name\":\"query - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by Resource\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource use\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 4\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by OperationName, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Firewall and access events, by time\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"\u007d,\"customWidth\":\"70\",\"name\":\"query - 5\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"\u007bWAF:lable\u007d\\\"==\\\"All\\\" or Resource in (\u007bWAF\u007d)\\r\\n| where \\\"\u007bEvents:lable\u007d\\\"==\\\"All\\\" or OperationName in (\u007bEvents\u007d)\\r\\n| summarize number = count() by OperationName\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by operation\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"30\",\"name\":\"query - 6\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallOverview\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":2592000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Lable = strcat(Resource, \\\" - \\\", Count)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b1a1c99d-4498-4e02-82f0-d52c276d5657\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Events\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| summarize Count = count() by OperationName\\r\\n| order by Count desc, OperationName asc\\r\\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\n| summarize count() by Resource, TimeGenerated\",\"size\":1,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource events, by time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Resource\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\"\\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by Resource\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Resource use\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by OperationName, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Firewall and access events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"70\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" \\r\\n| where \\\"{WAF:lable}\\\"==\\\"All\\\" or Resource in ({WAF})\\r\\n| where \\\"{Events:lable}\\\"==\\\"All\\\" or OperationName in ({Events})\\r\\n| summarize number = count() by OperationName\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by operation\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallOverview\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1959,7 +1849,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId3'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallOverviewWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - overview; templateRelativePath=WebApplicationFirewallOverview.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallOverviewWorkbook; logoFileName=waf_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - overview; templateRelativePath=WebApplicationFirewallOverview.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId3')]", "contentId": "[variables('_workbookContentId3')]", "kind": "Workbook", @@ -2007,8 +1897,7 @@ "contentProductId": "[variables('_workbookcontentProductId3')]", "id": "[variables('_workbookcontentProductId3')]", "version": "[variables('workbookVersion3')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -2019,11 +1908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { -<<<<<<< HEAD "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.1.0", -======= - "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.2.2", ->>>>>>> master "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -2041,7 +1926,7 @@ }, "properties": { "displayName": "[parameters('workbook4-name')]", - "serializedData": "\u007b\"version\":\"Notebook/1.0\",\"items\":[\u007b\"type\":1,\"content\":\u007b\"json\":\"## Azure WAF Events\"\u007d,\"name\":\"text - 10\"\u007d,\u007b\"type\":9,\"content\":\u007b\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"\u007bSubscription\u007d\"],\"parameters\":[\u007b\"id\":\"afd56a69-16a5-436d-850e-16c24e839503\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"e38cad87-ff16-40e6-9384-f6fd24fa9d6b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value=strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '\u007bDefaultSubscription_Internal\u007d', true, false)\",\"crossComponentResources\":[\"value::all\"],\"value\":[\"/subscriptions/6b1ceacd-5731-4780-8f96-2078dd96fd96\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"a125fc08-be6d-4b8b-87e2-7e0cd957db47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n|take 1\\r\\n|project id\",\"crossComponentResources\":[\"\u007bSubscription\u007d\"],\"isHiddenWhenLocked\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"65674a40-2869-4867-a24d-f86f05fd0354\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspaces\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id, selected = iff(id =~ '\u007bDefaultWorkspace_Internal\u007d', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\u007b\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":\u007b\"durationMs\":86400000\u007d,\"typeSettings\":\u007b\"selectableValues\":[\u007b\"durationMs\":300000\u007d,\u007b\"durationMs\":900000\u007d,\u007b\"durationMs\":1800000\u007d,\u007b\"durationMs\":3600000\u007d,\u007b\"durationMs\":14400000\u007d,\u007b\"durationMs\":43200000\u007d,\u007b\"durationMs\":86400000\u007d],\"allowCustom\":true\u007d\u007d,\u007b\"id\":\"604a42a0-deca-4a95-a15f-8977646a7fac\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAFType\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\"\\r\\n| summarize Count=count() by ResourceType\\r\\n| extend ResourceTypeImproved = iif(ResourceType == \\\"APPLICATIONGATEWAYS\\\", \\\"Application Gateway\\\", ResourceType)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"FRONTDOORS\\\", \\\"Azure Front Door\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"PROFILES\\\", \\\"Azure Front Door Premium\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\", \\\"Azure CDN\\\", ResourceTypeImproved)\\r\\n| order by Count desc, ResourceTypeImproved asc\\r\\n| project ResourceTypeImproved\",\"crossComponentResources\":[\"\u007bWorkspaces\u007d\"],\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"]\u007d,\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"WAF Type\"\u007d,\u007b\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"label\":\"WAF Items\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\"))\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Label = strcat(Resource, \\\" - \\\", Count)\",\"crossComponentResources\":[\"\u007bWorkspaces\u007d\"],\"value\":[\"value::all\"],\"typeSettings\":\u007b\"additionalResourceOptions\":[\"value::all\"]\u007d,\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"\u007d],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"\u007d,\"name\":\"parameters - 2\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\\r\\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| summarize number = count() by Action\",\"size\":3,\"showAnalytics\":true,\"title\":\"WAF actions filter\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"SelectedAction\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"\u007d,\"customWidth\":\"27\",\"name\":\"query - 11\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where Action == \\\"Block\\\"\\r\\n| where requestUri_s <> \\\"/\\\"\\r\\n| summarize count() by requestUri_s \\r\\n| top 40 by count_ desc \",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 40 Blocked Request URI addresses, filter to single URI address\",\"noDataMessage\":\"The current data has no \\\"Blocked\\\" results\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"requestUri_s\",\"exportParameterName\":\"RequestURI\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":\u007b\"titleContent\":\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":1,\"formatOptions\":\u007b\"showIcon\":true\u007d\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":\u007b\"palette\":\"auto\",\"showIcon\":true\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":5\u007d\u007d\u007d,\"showBorder\":false\u007d,\"graphSettings\":\u007b\"type\":0,\"topContent\":\u007b\"columnMatch\":\"requestUri_s\",\"formatter\":1\u007d,\"centerContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"mapSettings\":\u007b\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":\u007b\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"\u007d\u007d\u007d,\"customWidth\":\"63\",\"name\":\"query - 9\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Rule= iif(Rule has \\\"Mandatory rule. Cannot be disabled.\\\", strcat_array(split(Rule, \\\"Mandatory rule. Cannot be disabled. Inbound \\\",1),\\\"\\\"), Rule) // Removes initial component for mandatory rule \\r\\n| extend Rule = iif(Rule has \\\"Total Inbound Score\\\", strcat_array(array_concat(split(Rule, \\\" - SQLI=\\\", 0), parse_json('[\\\") -\\\"]'), split(Rule,\\\"):\\\",1)),\\\"\\\"),Rule) // Removes smaller information if more info is available for anomaly score\\r\\n| summarize count() by Rule\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 50 event triggers, filter by rule name\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Rule\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":\u007b\"palette\":\"blue\",\"showIcon\":true\u007d\u007d],\"sortBy\":[\u007b\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2\u007d],\"labelSettings\":[\u007b\"columnId\":\"count_\",\"label\":\"\"\u007d]\u007d,\"sortBy\":[\u007b\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2\u007d]\u007d,\"customWidth\":\"30\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize count() by Rule, bin(TimeGenerated, 1h)\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Messages, by time\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"Message\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d\u007d,\"customWidth\":\"70\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\" \\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\\r\\n| project Rule, TimeGenerated, SourceSystem, Hostname, ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\\r\\n| sort by TimeGenerated\",\"size\":0,\"showAnalytics\":true,\"title\":\"Message, full details\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"filter\":true\u007d\u007d,\"name\":\"query - 11\"\u007d,\u007b\"type\":1,\"content\":\u007b\"json\":\"---\"\u007d,\"name\":\"text - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\" \\r\\n| summarize Amount = count() by Rule\\r\\n| order by Amount desc\\r\\n\\r\\n\",\"size\":0,\"title\":\"Attacks events, by messages and filterable by rule name\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"\u007b\\\"Rule\\\":\\\"*\\\"\u007d\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"formatters\":[\u007b\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":\u007b\"palette\":\"blueDark\",\"showIcon\":true,\"aggregation\":\"Sum\"\u007d\u007d],\"filter\":true\u007d\u007d,\"customWidth\":\"20\",\"name\":\"query - 16\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\" \\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), ResourceId\\r\\n| project Amount, Rule, TimeGenerated, ResourceId\\r\\n| order by Amount desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Attack events, by time\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":86400000\u007d,\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushLowerSection\",\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"\u007b \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"\u007d\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"\u007d,\"customWidth\":\"80\",\"name\":\"query - 14\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\" \\r\\n| summarize count() by TrackingID\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID filter\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"TrackingID\",\"exportParameterName\":\"SelectedTrackingID\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"rowLimit\":500,\"filter\":true,\"sortBy\":[\u007b\"itemKey\":\"TrackingID\",\"sortOrder\":2\u007d]\u007d,\"sortBy\":[\u007b\"itemKey\":\"TrackingID\",\"sortOrder\":2\u007d]\u007d,\"customWidth\":\"20\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID Messages\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":\u007b\"rowLimit\":50\u007d\u007d,\"customWidth\":\"80\",\"name\":\"query - 13\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\"\\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| summarize count() by ClientIP\\r\\n| top 10 by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Attacking IP Addresses, filter to single IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"x\",\"exportParameterName\":\"ClientIP\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":\u007b\"showBorder\":false,\"titleContent\":\u007b\"columnMatch\":\"ClientIP\",\"formatter\":1\u007d,\"leftContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":\u007b\"palette\":\"auto\"\u007d,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"graphSettings\":\u007b\"type\":0,\"topContent\":\u007b\"columnMatch\":\"ClientIP\",\"formatter\":1\u007d,\"centerContent\":\u007b\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":\u007b\"unit\":17,\"options\":\u007b\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2\u007d\u007d\u007d\u007d,\"chartSettings\":\u007b\"showLegend\":true\u007d,\"mapSettings\":\u007b\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":\u007b\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"\u007d\u007d\u007d,\"customWidth\":\"25\",\"name\":\"query - 12\"\u007d,\u007b\"type\":3,\"content\":\u007b\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"\u007bWAFType:label\u007d\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"\u007bWAFType:label\u007d\\\" has \\\"cdn\\\")) and (\\\"\u007bWAF:label\u007d\\\" == \\\"All\\\" or Resource in (\u007bWAF\u007d))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \\\"*\\\" \\r\\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \\\"*\\\"\\r\\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \\\"*\\\")\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"title\":\"Attack messages of IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":\u007b\"durationMs\":0\u007d,\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":\u007b\"filter\":true\u007d\u007d,\"customWidth\":\"75\",\"showPin\":true,\"name\":\"query - 13\"\u007d],\"fromTemplateId\":\"sentinel-WebApplicationFirewallWAFTypeEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\u007d\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Azure WAF Events\"},\"name\":\"text - 10\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Subscription}\"],\"parameters\":[{\"id\":\"afd56a69-16a5-436d-850e-16c24e839503\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"e38cad87-ff16-40e6-9384-f6fd24fa9d6b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value=strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::all\"],\"value\":[\"/subscriptions/6b1ceacd-5731-4780-8f96-2078dd96fd96\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"a125fc08-be6d-4b8b-87e2-7e0cd957db47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n|take 1\\r\\n|project id\",\"crossComponentResources\":[\"{Subscription}\"],\"isHiddenWhenLocked\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"65674a40-2869-4867-a24d-f86f05fd0354\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspaces\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id, selected = iff(id =~ '{DefaultWorkspace_Internal}', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"49e2f511-592f-4d7f-8fda-d686803f3dbf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000}],\"allowCustom\":true}},{\"id\":\"604a42a0-deca-4a95-a15f-8977646a7fac\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAFType\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\"\\r\\n| summarize Count=count() by ResourceType\\r\\n| extend ResourceTypeImproved = iif(ResourceType == \\\"APPLICATIONGATEWAYS\\\", \\\"Application Gateway\\\", ResourceType)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"FRONTDOORS\\\", \\\"Azure Front Door\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"PROFILES\\\", \\\"Azure Front Door Premium\\\", ResourceTypeImproved)\\r\\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\", \\\"Azure CDN\\\", ResourceTypeImproved)\\r\\n| order by Count desc, ResourceTypeImproved asc\\r\\n| project ResourceTypeImproved\",\"crossComponentResources\":[\"{Workspaces}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"WAF Type\"},{\"id\":\"d54c1639-d46c-4655-9d76-d5416926a453\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WAF\",\"label\":\"WAF Items\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\"))\\r\\n| summarize Count=count() by Resource\\r\\n| order by Count desc, Resource asc\\r\\n| project Value = Resource, Label = strcat(Resource, \\\" - \\\", Count)\",\"crossComponentResources\":[\"{Workspaces}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\\r\\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| summarize number = count() by Action\",\"size\":3,\"showAnalytics\":true,\"title\":\"WAF actions filter\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"series\",\"exportParameterName\":\"SelectedAction\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"27\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where Action == \\\"Block\\\"\\r\\n| where requestUri_s <> \\\"/\\\"\\r\\n| summarize count() by requestUri_s \\r\\n| top 40 by count_ desc \",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 40 Blocked Request URI addresses, filter to single URI address\",\"noDataMessage\":\"The current data has no \\\"Blocked\\\" results\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"requestUri_s\",\"exportParameterName\":\"RequestURI\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"requestUri_s\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":5}}},\"showBorder\":false},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"requestUri_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"63\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Rule= iif(Rule has \\\"Mandatory rule. Cannot be disabled.\\\", strcat_array(split(Rule, \\\"Mandatory rule. Cannot be disabled. Inbound \\\",1),\\\"\\\"), Rule) // Removes initial component for mandatory rule \\r\\n| extend Rule = iif(Rule has \\\"Total Inbound Score\\\", strcat_array(array_concat(split(Rule, \\\" - SQLI=\\\", 0), parse_json('[\\\") -\\\"]'), split(Rule,\\\"):\\\",1)),\\\"\\\"),Rule) // Removes smaller information if more info is available for anomaly score\\r\\n| summarize count() by Rule\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 50 event triggers, filter by rule name\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Rule\",\"exportParameterName\":\"Selected\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true}}],\"sortBy\":[{\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"\"}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_count__1\",\"sortOrder\":2}]},\"customWidth\":\"30\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize count() by Rule, bin(TimeGenerated, 1h)\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Messages, by time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Message\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"70\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or OperationName == \\\"ApplicationGatewayFirewall\\\" or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\" \\r\\n| extend Role = extract(\\\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\\\",1,instanceId_s) \\r\\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\\r\\n| project Rule, TimeGenerated, SourceSystem, Hostname, ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\\r\\n| sort by TimeGenerated\",\"size\":0,\"showAnalytics\":true,\"title\":\"Message, full details\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushUpperSection\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 11\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\" \\r\\n| summarize Amount = count() by Rule\\r\\n| order by Amount desc\\r\\n\\r\\n\",\"size\":0,\"title\":\"Attacks events, by messages and filterable by rule name\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"\",\"exportParameterName\":\"MessageFilter\",\"exportDefaultValue\":\"{\\\"Rule\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Amount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blueDark\",\"showIcon\":true,\"aggregation\":\"Sum\"}}],\"filter\":true}},\"customWidth\":\"20\",\"name\":\"query - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\" \\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), ResourceId\\r\\n| project Amount, Rule, TimeGenerated, ResourceId\\r\\n| order by Amount desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Attack events, by time\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"timeBrushLowerSection\",\"exportParameterName\":\"Message\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"80\",\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\" \\r\\n| summarize count() by TrackingID\\r\\n| top 50 by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID filter\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"TrackingID\",\"exportParameterName\":\"SelectedTrackingID\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"TrackingID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TrackingID\",\"sortOrder\":2}]},\"customWidth\":\"20\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"showAnalytics\":true,\"title\":\"TrackingID Messages\",\"noDataMessage\":\"You have over-filtered or you are missing this data.\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50}},\"customWidth\":\"80\",\"name\":\"query - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\"\\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| summarize count() by ClientIP\\r\\n| top 10 by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Attacking IP Addresses, filter to single IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"exportFieldName\":\"x\",\"exportParameterName\":\"ClientIP\",\"exportDefaultValue\":\"*\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"ClientIP\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"ClientIP\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"25\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SelectedMS = dynamic({MessageFilter}); // reference to the above list of messages (Event trigger)\\r\\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\\r\\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\", \\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\" ]);\\r\\nFakeData | union AzureDiagnostics\\r\\n| where (ResourceType == \\\"APPLICATIONGATEWAYS\\\" or ResourceType == \\\"FRONTDOORS\\\" or ResourceType == \\\"PROFILES\\\" or ResourceType == \\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\") and (\\\"{WAFType:label}\\\" == \\\"All\\\" or (ResourceType == \\\"APPLICATIONGATEWAYS\\\" and \\\"{WAFType:label}\\\" has \\\"application gateway\\\") or (ResourceType == \\\"FRONTDOORS\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door\\\") or (ResourceType == \\\"PROFILES\\\" and \\\"{WAFType:label}\\\" has \\\"azure front door premium\\\") or (ResourceType==\\\"CDNWEBAPPLICATIONFIREWALLPOLICIES\\\" and \\\"{WAFType:label}\\\" has \\\"cdn\\\")) and (\\\"{WAF:label}\\\" == \\\"All\\\" or Resource in ({WAF}))\\r\\n| where Category == \\\"FrontdoorWebApplicationFirewallLog\\\" or Category == \\\"FrontDoorWebApplicationFirewallLog\\\" or (OperationName == \\\"ApplicationGatewayFirewall\\\" and Message has \\\"attack\\\") or Category == \\\"WebApplicationFirewallLogs\\\"\\r\\n| where '{RequestURI}' == requestUri_s or '{RequestURI}' == \\\"*\\\"\\r\\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\\r\\n| where Rule == Child or Child == \\\"*\\\"\\r\\n| extend Action = iif(action_s == \\\"Blocked\\\", Action = \\\"Block\\\", action_s)\\r\\n| extend Action = iif(Action == \\\"Detected\\\", Action = \\\"Log\\\", Action)\\r\\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\\r\\n| where '{SelectedTrackingID}' == TrackingID or '{SelectedTrackingID}' == \\\"*\\\" \\r\\n| where '{SelectedAction}' == Action or '{SelectedAction}' == \\\"*\\\" \\r\\n| where '{Selected}' == Rule or '{Selected}' == \\\"*\\\"\\r\\n| where ('{ClientIP}' == ClientIP or '{ClientIP}' == \\\"*\\\")\\r\\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\\r\\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category\",\"size\":0,\"title\":\"Attack messages of IP address\",\"noDataMessage\":\"Filtered messages are not attack events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"timeBrushLowerSection\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"75\",\"showPin\":true,\"name\":\"query - 13\"}],\"fromTemplateId\":\"sentinel-WebApplicationFirewallWAFTypeEvents\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -2052,7 +1937,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId4'),'/'))))]", "properties": { - "description": "@\u007bworkbookKey=WebApplicationFirewallWAFTypeEventsWorkbook; logoFileName=webapplicationfirewall(WAF)_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - Azure WAF; templateRelativePath=WebApplicationFirewallWAFTypeEvents.json; subtitle=; provider=Microsoft\u007d.description", + "description": "@{workbookKey=WebApplicationFirewallWAFTypeEventsWorkbook; logoFileName=webapplicationfirewall(WAF)_logo.svg; description=Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Web Application Firewall (WAF) - Azure WAF; templateRelativePath=WebApplicationFirewallWAFTypeEvents.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId4')]", "contentId": "[variables('_workbookContentId4')]", "kind": "Workbook", @@ -2100,28 +1985,19 @@ "contentProductId": "[variables('_workbookcontentProductId4')]", "id": "[variables('_workbookcontentProductId4')]", "version": "[variables('workbookVersion4')]" - }, - "condition": "[parameters('DeployWorkbook')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { -<<<<<<< HEAD "version": "3.1.0", -======= - "version": "3.2.2", ->>>>>>> master "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Azure Web Application Firewall (WAF)", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", -<<<<<<< HEAD "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", -======= - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, XDR Detections: 10, XDR Workbooks: 4

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", ->>>>>>> master "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2225,76 +2101,6 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId4')]", "version": "[variables('workbookVersion4')]" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "version": "3.1.0" - }, - { - "kind": "CustomDetection", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "version": "3.1.0" - }, - { - "kind": "DefenderWorkbook", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "version": "3.2.2" - }, - { - "kind": "DefenderWorkbook", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "version": "3.2.2" } ] }, @@ -2309,6383 +2115,6 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-16da3a2a-af29-48a-3ddec5f9", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"SQL Injection\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18', 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-16da3a2a-af29-48a0-8606-d467c180fe18')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-16da3a2a-af29-48a-3ddec5f9')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"SQL Injection\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18', 'xdr-16da3a2a-af29-48a0-8606-d467c180fe18')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentKind": "CustomDetection", - "displayName": "Front Door Premium WAF - SQLi Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-16da3a2a-af29-48a0-8606-d467c180fe18','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-16da3a2a-af29-48a0-8606-d467c180fe18','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-16da3a2a-af29-48a0-8606-d467c180fe18", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-b7643904-5081-492-b3c737f9", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"XSS\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-b7643904-5081-4920-917e-a559ddc3448f', 'xdr-b7643904-5081-4920-917e-a559ddc3448f')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b7643904-5081-4920-917e-a559ddc3448f')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-b7643904-5081-492-b3c737f9')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "Front Door Premium WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "Front Door Premium WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"XSS\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-b7643904-5081-4920-917e-a559ddc3448f', 'xdr-b7643904-5081-4920-917e-a559ddc3448f')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentKind": "CustomDetection", - "displayName": "Front Door Premium WAF - XSS Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7643904-5081-4920-917e-a559ddc3448f','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7643904-5081-4920-917e-a559ddc3448f','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b7643904-5081-4920-917e-a559ddc3448f", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-ded8168e-c806-477-d05893ef", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Injection\" or details_msg_s has \"File Inclusion\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-ded8168e-c806-4772-af30-10576e0a7529', 'xdr-ded8168e-c806-4772-af30-10576e0a7529')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-ded8168e-c806-4772-af30-10576e0a7529')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-ded8168e-c806-477-d05893ef')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Injection\" or details_msg_s has \"File Inclusion\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-ded8168e-c806-4772-af30-10576e0a7529', 'xdr-ded8168e-c806-4772-af30-10576e0a7529')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentKind": "CustomDetection", - "displayName": "AFD WAF - Code Injection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-ded8168e-c806-4772-af30-10576e0a7529','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-ded8168e-c806-4772-af30-10576e0a7529','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-ded8168e-c806-4772-af30-10576e0a7529", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-a4d99328-e4e6-493-18e2c809", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Path Traversal Attack\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77', 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-a4d99328-e4e6-493-18e2c809')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "clientIP_s" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "URI_s" - } - ] - }, - "severity": "high", - "title": "AFD WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "AFD WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), details_msg_s = column_ifexists(\"details_msg_s\", \"\"), details_data_s = column_ifexists(\"details_data_s\", \"\"), details_matches_s = column_ifexists(\"details_matches_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Path Traversal Attack\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| extend action_s = column_ifexists(\"action_s\", \"\"), trackingReference_s = column_ifexists(\"trackingReference_s\", \"\")\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold" - }, - "id": "[if(true(), 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77', 'xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentKind": "CustomDetection", - "displayName": "AFD WAF - Path Traversal Attack", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-a4d99328-e4e6-493d-b0d5-57e6f9ddae77", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-912a18fc-6165-446-55d2072a", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Injection\" or Message has \"File Inclusion\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee', 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-912a18fc-6165-446-55d2072a')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Code Injection based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Code_Injection'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Code Injection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Code Injection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Injection\" or Message has \"File Inclusion\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee', 'xdr-912a18fc-6165-446b-8740-81ae6c3f75ee')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentKind": "CustomDetection", - "displayName": "App GW WAF - Code Injection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-912a18fc-6165-446b-8740-81ae6c3f75ee','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-912a18fc-6165-446b-8740-81ae6c3f75ee','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-912a18fc-6165-446b-8740-81ae6c3f75ee", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-b6c3a8a6-d22c-488-88ca0ec3", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Path Traversal Attack\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b', 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-b6c3a8a6-d22c-488-88ca0ec3')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Path Traversal based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/attacks/Path_Traversal'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App GW WAF - Path Traversal Attack" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App GW WAF - Path Traversal Attack", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"Path Traversal Attack\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\") on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId,100), Message = make_set(Message,100), Detail_Message = make_set(DetailedMessage,100), Detail_Data = make_set(DetailedData,100), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b', 'xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentKind": "CustomDetection", - "displayName": "App GW WAF - Path Traversal Attack", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-b6c3a8a6-d22c-4882-9c57-abc01690938b", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-bdb2cd63-99f2-472-a7d84b7f", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"SQL Injection\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744', 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-bdb2cd63-99f2-472-a7d84b7f')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1211" - } - ] - } - ], - "description": "'Identifies a match for a SQL Injection attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/Top10/A03_2021-Injection/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - SQLi Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - SQLi Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"SQL Injection\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744', 'xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - SQLi Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-bdb2cd63-99f2-472e-b1b9-acba473b6744", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-9b8dd8fd-f192-42e-446ba077", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - Scanner Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - Scanner Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message contains \"Found User-Agent associated with security scanner\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId), Message = make_set(Message), Detail_Message = make_set(DetailedMessage), Detail_Data = make_set(DetailedData), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a', 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-9b8dd8fd-f192-42e-446ba077')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "DefenseEvasion", - "techniques": [ - { - "technique": "T1548" - } - ] - } - ], - "description": "'Identifies a match for a Scanner detection user agent based attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\nReferences: https://owasp.org/www-community/Vulnerability_Scanning_Tools'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - Scanner Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - Scanner Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message contains \"Found User-Agent associated with security scanner\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId), Message = make_set(Message), Detail_Message = make_set(DetailedMessage), Detail_Data = make_set(DetailedData), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a', 'xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - Scanner Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-9b8dd8fd-f192-42eb-84f6-541920400a7a", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-1c7ff502-2ad4-497-a22808d2", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"XSS\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138', 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-1c7ff502-2ad4-497-a22808d2')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1189" - } - ] - } - ], - "description": "'Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements.\n References: https://owasp.org/www-community/attacks/xss/'", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ], - "urls": [ - { - "id": "[if(true(), 'url1', 'url1')]", - "addressColumn": "Uri" - } - ] - }, - "severity": "high", - "title": "App Gateway WAF - XSS Detection" - } - }, - "schedule": { - "frequency": "PT6H" - }, - "displayName": "App Gateway WAF - XSS Detection", - "queryCondition": { - "queryText": "let Threshold = 3;\nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"XSS\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold" - }, - "id": "[if(true(), 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138', 'xdr-1c7ff502-2ad4-4970-9d29-9210c6753138')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentKind": "CustomDetection", - "displayName": "App Gateway WAF - XSS Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1c7ff502-2ad4-4970-9d29-9210c6753138','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1c7ff502-2ad4-4970-9d29-9210c6753138','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-1c7ff502-2ad4-4970-9d29-9210c6753138", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "AzureWebApplicationFirewallWAF-CD-xdr-46ac55ae-47b8-414-82996ed1", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1190" - } - ] - } - ], - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ] - }, - "severity": "medium", - "title": "A potentially malicious web request was executed against a web server" - } - }, - "schedule": { - "frequency": "P1D" - }, - "displayName": "A potentially malicious web request was executed against a web server", - "queryCondition": { - "queryText": "let queryperiod = 1d;\nlet mode = dynamic(['Blocked', 'Detected']);\nlet successCode = dynamic(['200', '101','204', '400','504','304','401','500']);\nlet sessionBin = 30m;\nAGWFirewallLogs\n| where TimeGenerated > ago(queryperiod)\n| where Action in (mode)\n| sort by Hostname asc, ClientIp asc, TimeGenerated asc\n| extend SessionBlockedStarted = row_window_session(TimeGenerated, queryperiod, 10m, ((ClientIp != prev(ClientIp)) or (Hostname != prev(Hostname))))\n| summarize SessionBlockedEnded = max(TimeGenerated), SessionBlockedCount = count() by Hostname, ClientIp, SessionBlockedStarted\n| extend TimeKey = range(bin(SessionBlockedStarted, sessionBin), bin(SessionBlockedEnded, sessionBin), sessionBin)\n| mv-expand TimeKey to typeof(datetime)\n| join kind = inner(\n AGWAccessLogs\n | where TimeGenerated > ago(queryperiod)\n | where (isempty(HttpStatus) or HttpStatus in (successCode))\n | extend TimeKey = bin(TimeGenerated, sessionBin)\n | extend Hostname = coalesce(Host,OriginalHost)\n | extend ClientIp = tostring(ClientIp)\n) on TimeKey, Hostname, ClientIp\n| where TimeGenerated between (SessionBlockedStarted..SessionBlockedEnded)\n| extend\n OriginalRequestUriWithArgs = column_ifexists(\"OriginalRequestUriWithArgs\", \"\"),\n ServerStatus = column_ifexists(\"ServerStatus\", \"\")\n| summarize\n SuccessfulAccessCount = count(),\n UserAgents = make_set(UserAgent, 250),\n RequestURIs = make_set(RequestUri, 250),\n OriginalRequestURIs = make_set(OriginalRequestUriWithArgs, 250),\n SuccessCodes = make_set(HttpStatus, 250),\n SuccessCodes_BackendServer = make_set(ServerStatus, 250),\n take_any(SessionBlockedEnded, SessionBlockedCount)\n by Hostname, ClientIp, SessionBlockedStarted\n| where SessionBlockedCount > SuccessfulAccessCount\n| extend BlockvsSuccessRatio = SessionBlockedCount/toreal(SuccessfulAccessCount)\n| sort by BlockvsSuccessRatio desc, SessionBlockedStarted asc\n| project-reorder SessionBlockedStarted, SessionBlockedEnded, Hostname, ClientIp, SessionBlockedCount, SuccessfulAccessCount, BlockvsSuccessRatio, SuccessCodes, RequestURIs, OriginalRequestURIs, UserAgents" - }, - "id": "[if(true(), 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178', 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0" - } - } - } - } - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'AzureWebApplicationFirewallWAF-CD-xdr-46ac55ae-47b8-414-82996ed1')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "detectionRule": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/detectionRules@2026-06-01-preview", - "properties": { - "status": "disabled", - "detectionAction": { - "alertTemplate": { - "tactics": [ - { - "tactic": "InitialAccess", - "techniques": [ - { - "technique": "T1190" - } - ] - } - ], - "description": "'Detects unobstructed Web Application Firewall (WAF) activity in sessions where the WAF blocked incoming requests by computing the ratio between blocked requests and unobstructed WAF requests in these sessions (BlockvsSuccessRatio metric).\nA high ratio value for a given client IP and hostname calls for further investigation of the WAF data in that session, due to the significantly high number of blocked requests and a few unobstructed logs that may be malicious but have passed undetected through the WAF. The successCode variable defines what the detection thinks is a successful status code and", - "entityMappings": { - "ips": [ - { - "id": "[if(true(), 'ip1', 'ip1')]", - "addressColumn": "ClientIp" - } - ] - }, - "severity": "medium", - "title": "A potentially malicious web request was executed against a web server" - } - }, - "schedule": { - "frequency": "P1D" - }, - "displayName": "A potentially malicious web request was executed against a web server", - "queryCondition": { - "queryText": "let queryperiod = 1d;\nlet mode = dynamic(['Blocked', 'Detected']);\nlet successCode = dynamic(['200', '101','204', '400','504','304','401','500']);\nlet sessionBin = 30m;\nAGWFirewallLogs\n| where TimeGenerated > ago(queryperiod)\n| where Action in (mode)\n| sort by Hostname asc, ClientIp asc, TimeGenerated asc\n| extend SessionBlockedStarted = row_window_session(TimeGenerated, queryperiod, 10m, ((ClientIp != prev(ClientIp)) or (Hostname != prev(Hostname))))\n| summarize SessionBlockedEnded = max(TimeGenerated), SessionBlockedCount = count() by Hostname, ClientIp, SessionBlockedStarted\n| extend TimeKey = range(bin(SessionBlockedStarted, sessionBin), bin(SessionBlockedEnded, sessionBin), sessionBin)\n| mv-expand TimeKey to typeof(datetime)\n| join kind = inner(\n AGWAccessLogs\n | where TimeGenerated > ago(queryperiod)\n | where (isempty(HttpStatus) or HttpStatus in (successCode))\n | extend TimeKey = bin(TimeGenerated, sessionBin)\n | extend Hostname = coalesce(Host,OriginalHost)\n | extend ClientIp = tostring(ClientIp)\n) on TimeKey, Hostname, ClientIp\n| where TimeGenerated between (SessionBlockedStarted..SessionBlockedEnded)\n| extend\n OriginalRequestUriWithArgs = column_ifexists(\"OriginalRequestUriWithArgs\", \"\"),\n ServerStatus = column_ifexists(\"ServerStatus\", \"\")\n| summarize\n SuccessfulAccessCount = count(),\n UserAgents = make_set(UserAgent, 250),\n RequestURIs = make_set(RequestUri, 250),\n OriginalRequestURIs = make_set(OriginalRequestUriWithArgs, 250),\n SuccessCodes = make_set(HttpStatus, 250),\n SuccessCodes_BackendServer = make_set(ServerStatus, 250),\n take_any(SessionBlockedEnded, SessionBlockedCount)\n by Hostname, ClientIp, SessionBlockedStarted\n| where SessionBlockedCount > SuccessfulAccessCount\n| extend BlockvsSuccessRatio = SessionBlockedCount/toreal(SuccessfulAccessCount)\n| sort by BlockvsSuccessRatio desc, SessionBlockedStarted asc\n| project-reorder SessionBlockedStarted, SessionBlockedEnded, Hostname, ClientIp, SessionBlockedCount, SuccessfulAccessCount, BlockvsSuccessRatio, SuccessCodes, RequestURIs, OriginalRequestURIs, UserAgents" - }, - "id": "[if(true(), 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178', 'xdr-46ac55ae-47b8-414a-8f94-89ccd1962178')]", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0" - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentKind": "CustomDetection", - "displayName": "A potentially malicious web request was executed against a web server", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-46ac55ae-47b8-414a-8f94-89ccd1962178','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-46ac55ae-47b8-414a-8f94-89ccd1962178','-','3.1.0')))]", - "version": "3.1.0", - "contentProvenance": { - "packageId": "[if(true(), 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal', 'azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal')]", - "packageVersion": "3.2.2", - "contentId": "xdr-46ac55ae-47b8-414a-8f94-89ccd1962178", - "contentVersion": "3.1.0", - "requiredWorkloads": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "workload": "sentinel" - } - ], - "requiredDataConnectors": [ - { - "dataTypes": [ - "AzureDiagnostics" - ], - "connectorId": "WAF" - } - ] - } - }, - "condition": "[parameters('DeployCustomDetection')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-f7a598b02ee52581c4a5db0294684ac3", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "35903b73-960e-5bec-af91-0886b5f6f961", - "name": "Microsoft Web Application Firewall (WAF) - firewall events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway firewall events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where action_s == \"Blocked\" or action_s == \"Detected\" \r\n| summarize count() by requestUri_s \r\n| top 10 by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Blocked URL addresses", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize number = count() by action_s", - "size": 0, - "exportToExcelOptions": "visible", - "title": "WAF actions", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\" \r\n| summarize number = count() by instanceId_s, TimeGenerated\r\n| where instanceId_s has \"role\"\r\n| extend rolenumber = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\", 1, instanceId_s) \r\n| project rolenumber , number , TimeGenerated \r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Role use, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart" - }, - "customWidth": "40", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize count() by Message\r\n| top 10 by count_ \r\n", - "size": 0, - "exportFieldName": "Message", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "exportToExcelOptions": "visible", - "title": "Event trigger", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "labelSettings": [ - { - "columnId": "Message" - }, - { - "columnId": "count_", - "label": "" - } - ] - } - }, - "customWidth": "50", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\"*\"\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Messages, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \"*\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| project Message, TimeGenerated, SourceSystem, hostname_s, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\r\n| sort by TimeGenerated\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table" - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, _ResourceId, Category, Role\r\n| project Amount, Message, TimeGenerated, hostName, _ResourceId, Category, Role\r\n| order by Amount desc", - "size": 0, - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Message\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attacks events, by messages", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "showIcon": true, - "aggregation": "Sum" - } - }, - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TimeGenerated", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Category", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Role", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "$gen_group", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Count", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TenantId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SourceSystem", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "MG", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ManagementGroupName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Computer", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleGroup_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "transactionId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "originalHost_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_schema_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "instanceId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIp_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestUri_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetType_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "action_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "site_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_data_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_file_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_line_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostname_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIP_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpMethod_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestQuery_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "userAgent_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpStatus_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "receivedBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sentBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "timeTaken_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sslEnabled_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "host_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags__type_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "msg_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_originRunId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_actionName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_actionTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "workflowId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Level", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "OperationName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "status_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags_LogicAppsCategory_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_resourceGroupName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_runId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_location_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_triggerName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SubscriptionId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceGroup", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceProvider", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Resource", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceType", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_subscriptionId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "startTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "endTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Type", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true, - "hierarchySettings": { - "treeType": 1, - "groupBy": [ - "Message" - ], - "expandTopLevel": false - }, - "labelSettings": [] - } - }, - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\r\nAzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| where SelectedMS.Message == Message or SelectedMS.Message == \"*\" or Message == Child[0].Message\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attack events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart" - }, - "customWidth": "70", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Message has \"SQL Injection\" \r\n| summarize count() by hostname_s, Message\r\n| order by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "SQL injection, by host name", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - }, - "customWidth": "30", - "name": "query - 15" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallFirewallEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('da2b058d-fac5-5924-9e7f-da781ce9aa5b')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-f7a598b02ee52581c4a5db0294684ac3')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - firewall events", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "35903b73-960e-5bec-af91-0886b5f6f961", - "name": "Microsoft Web Application Firewall (WAF) - firewall events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway firewall events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where action_s == \"Blocked\" or action_s == \"Detected\" \r\n| summarize count() by requestUri_s \r\n| top 10 by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Blocked URL addresses", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize number = count() by action_s", - "size": 0, - "exportToExcelOptions": "visible", - "title": "WAF actions", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\" \r\n| summarize number = count() by instanceId_s, TimeGenerated\r\n| where instanceId_s has \"role\"\r\n| extend rolenumber = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\", 1, instanceId_s) \r\n| project rolenumber , number , TimeGenerated \r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Role use, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart" - }, - "customWidth": "40", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| summarize count() by Message\r\n| top 10 by count_ \r\n", - "size": 0, - "exportFieldName": "Message", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "exportToExcelOptions": "visible", - "title": "Event trigger", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "labelSettings": [ - { - "columnId": "Message" - }, - { - "columnId": "count_", - "label": "" - } - ] - } - }, - "customWidth": "50", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where ('\u007bSelected\u007d' == Message) or '\u007bSelected\u007d'==\"*\"\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Messages, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where \"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d)\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where '\u007bSelected\u007d' == Message or '\u007bSelected\u007d' == \"*\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| project Message, TimeGenerated, SourceSystem, hostname_s, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, action_s, site_s, details_message_s, details_file_s, clientIp_s, requestUri_s\r\n| sort by TimeGenerated\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table" - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| summarize Amount = count() by Message, bin(TimeGenerated, 1h), hostName = hostname_s, _ResourceId, Category, Role\r\n| project Amount, Message, TimeGenerated, hostName, _ResourceId, Category, Role\r\n| order by Amount desc", - "size": 0, - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Message\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attacks events, by messages", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "showIcon": true, - "aggregation": "Sum" - } - }, - { - "columnMatch": "Message", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TimeGenerated", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Category", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Role", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "$gen_group", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Count", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "TenantId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SourceSystem", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "MG", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ManagementGroupName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Computer", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleGroup_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "transactionId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "originalHost_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_schema_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "error_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "instanceId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIp_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestUri_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetType_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleSetVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ruleId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "action_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "site_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_message_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_data_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_file_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "details_line_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "hostname_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientIP_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "clientPort_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpMethod_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "requestQuery_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "userAgent_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpStatus_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "httpVersion_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "receivedBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sentBytes_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "timeTaken_d", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "sslEnabled_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "host_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags__type_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "msg_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_originRunId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_actionName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_actionTrackingId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "workflowId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Level", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "OperationName", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "status_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "tags_LogicAppsCategory_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_resourceGroupName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_runId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_location_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_triggerName_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "SubscriptionId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceGroup", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceProvider", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Resource", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "ResourceType", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "code_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "correlation_clientTrackingId_s", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_subscriptionId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "resource_workflowId_g", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "startTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "endTime_t", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "Type", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "_ResourceId", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true, - "hierarchySettings": { - "treeType": 1, - "groupBy": [ - "Message" - ], - "expandTopLevel": false - }, - "labelSettings": [] - } - }, - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.childRows; // Used to choose a group of messages - redirects to the message which was grouped\r\nAzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where OperationName == \"ApplicationGatewayFirewall\"\r\n| where Message has \"attack\"\r\n| where SelectedMS.Message == Message or SelectedMS.Message == \"*\" or Message == Child[0].Message\r\n| summarize count() by Message, TimeGenerated", - "size": 0, - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "exportToExcelOptions": "visible", - "title": "Attack events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "barchart" - }, - "customWidth": "70", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and (\"\u007bWAF:lable\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Message has \"SQL Injection\" \r\n| summarize count() by hostname_s, Message\r\n| order by count_ desc ", - "size": 0, - "exportToExcelOptions": "visible", - "title": "SQL injection, by host name", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - }, - "customWidth": "30", - "name": "query - 15" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallFirewallEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - firewall events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','da2b058d-fac5-5924-9e7f-da781ce9aa5b','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','da2b058d-fac5-5924-9e7f-da781ce9aa5b','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "da2b058d-fac5-5924-9e7f-da781ce9aa5b", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-7b8cbc62b0925b2d9084c264aff4e073", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "edc3486c-4f0d-5f04-82a0-0c009c1fc579", - "name": "Microsoft Web Application Firewall (WAF) - gateway access events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway access events\n" - }, - "customWidth": "100", - "name": "text - 2" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "b3ac8870-500d-4dd8-a570-f49a2c2f1a76", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - } - ], - "style": "pills" - }, - "customWidth": "50", - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let ActivityData = AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\";\r\nActivityData\r\n| summarize Count = count() by clientIP_s\r\n| join kind = inner (ActivityData\r\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\r\n on clientIP_s\r\n | project-away clientIP_s1, TimeGenerated\r\n| extend clientIP = clientIP_s\r\n| union (\r\n ActivityData\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (ActivityData\r\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\r\n | extend jkey = 1) on jkey\r\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \r\n)\r\n| order by Count desc\r\n| take 10", - "size": 4, - "title": "Top 10 IP's by activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "clientIp_s", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "rightContent": { - "columnMatch": "clientIP_s" - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9 - }, - "showBorder": false - } - }, - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\r\n", - "size": 0, - "title": "Activity, by cIient IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize count() by clientIP_s, TimeGenerated\r\n", - "size": 0, - "title": "SSL use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\r\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \r\n", - "size": 0, - "title": "Received and sent data, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize number = count() by userAgent_s\r\n| top 10 by number desc nulls last \r\n", - "size": 0, - "title": "User agent use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\r\n| order by number desc", - "size": 0, - "title": "URL address use, by client IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "blue", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "30", - "name": "query - 7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize Count = count() by httpMethod=httpMethod_s\r\n| sort by Count desc\r\n", - "size": 0, - "title": "HTTP Methods", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "purple", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count = count() by requestQuery=requestQuery_s\r\n| sort by Count desc", - "size": 0, - "title": "Request queries", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "turquoise", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\r\n| order by sentBytes, recBytes", - "size": 0, - "title": "Detailed activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "sentB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "recB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "sentb", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - } - ], - "rowLimit": 1000, - "filter": true - } - }, - "name": "query - 10" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallGatewayAccessEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-7b8cbc62b0925b2d9084c264aff4e073')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - gateway access events", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "edc3486c-4f0d-5f04-82a0-0c009c1fc579", - "name": "Microsoft Web Application Firewall (WAF) - gateway access events", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Application gateway access events\n" - }, - "customWidth": "100", - "name": "text - 2" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "b3ac8870-500d-4dd8-a570-f49a2c2f1a76", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - } - ], - "style": "pills" - }, - "customWidth": "50", - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let ActivityData = AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\";\r\nActivityData\r\n| summarize Count = count() by clientIP_s\r\n| join kind = inner (ActivityData\r\n | make-series Trend = count() default = 0 on bin(TimeGenerated, 1d) from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d by clientIP_s)\r\n on clientIP_s\r\n | project-away clientIP_s1, TimeGenerated\r\n| extend clientIP = clientIP_s\r\n| union (\r\n ActivityData\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (ActivityData\r\n | make-series Trend = count() default = 0 on TimeGenerated from \u007bTimeRange:start\u007d to \u007bTimeRange:end\u007d step \u007bTimeRange:grain\u007d\r\n | extend jkey = 1) on jkey\r\n | extend clientIP_s = 'All Clients', clientIP_ = '*' \r\n)\r\n| order by Count desc\r\n| take 10", - "size": 4, - "title": "Top 10 IP's by activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "clientIp_s", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "rightContent": { - "columnMatch": "clientIP_s" - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9 - }, - "showBorder": false - } - }, - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count= count() by clientIP_s, bin(TimeGenerated, 1d)\r\n", - "size": 0, - "title": "Activity, by cIient IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize count() by clientIP_s, TimeGenerated\r\n", - "size": 0, - "title": "SSL use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize receivedBytes = sum(receivedBytes_d)/1048576, sentBytes = sum(sentBytes_d)/1048576 by bin(TimeGenerated, 1d)\r\n//| project receivedBytes_d, sentBytes_d, TimeGenerated \r\n", - "size": 0, - "title": "Received and sent data, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize number = count() by userAgent_s\r\n| top 10 by number desc nulls last \r\n", - "size": 0, - "title": "User agent use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize number= count() by requestURI=requestUri_s, originalHost=originalHost_s, clientIP=clientIP_s\r\n| order by number desc", - "size": 0, - "title": "URL address use, by client IP address", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "blue", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "30", - "name": "query - 7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\" \r\n| summarize Count = count() by httpMethod=httpMethod_s\r\n| sort by Count desc\r\n", - "size": 0, - "title": "HTTP Methods", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "number", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "purple", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize Count = count() by requestQuery=requestQuery_s\r\n| sort by Count desc", - "size": 0, - "title": "Request queries", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 4, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "turquoise", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "35", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where OperationName == \"ApplicationGatewayAccess\"\r\n| summarize sentBytes = sum(sentBytes_d), recBytes= sum(receivedBytes_d), Count = count() by originalHost=originalHost_s ,clientIP=clientIP_s, requestURI=requestUri_s, httpMethod=httpMethod_s, requestQuery=requestQuery_s, userAgent=userAgent_s, httpVersion=httpVersion_s, httpStatus=httpStatus_d,sslEnabled=sslEnabled_s, bin(TimeGenerated, 1d)\r\n| order by sentBytes, recBytes", - "size": 0, - "title": "Detailed activity", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "gridSettings": { - "formatters": [ - { - "columnMatch": "sentB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "recB", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - }, - { - "columnMatch": "sentb", - "formatter": 4, - "formatOptions": { - "min": 0, - "palette": "coldHot", - "showIcon": true - } - } - ], - "rowLimit": 1000, - "filter": true - } - }, - "name": "query - 10" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallGatewayAccessEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - gateway access events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "8d7aabc2-f97c-5cfe-bd53-4f9478e1b4e8", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-9a7c892f5bdc363a0a2fd7f5f5da210f", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "fa791130-bc1f-5b63-97de-4a48eed36574", - "name": "Microsoft Web Application Firewall (WAF) - overview", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - }, - { - "id": "b1a1c99d-4498-4e02-82f0-d52c276d5657", - "version": "KqlParameterItem/1.0", - "name": "Events", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc\r\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\n| where ResourceType == \"APPLICATIONGATEWAYS\" \n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\n| summarize count() by Resource, TimeGenerated", - "size": 1, - "exportToExcelOptions": "visible", - "title": "Resource events, by time", - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Resource", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by Resource\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Resource use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Firewall and access events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Events, by operation", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallOverview", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('b6b63aa4-e7c8-557a-b87a-2566588ed8cf')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-9a7c892f5bdc363a0a2fd7f5f5da210f')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - overview", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "fa791130-bc1f-5b63-97de-4a48eed36574", - "name": "Microsoft Web Application Firewall (WAF) - overview", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 2592000000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ], - "allowCustom": true - } - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - }, - { - "id": "b1a1c99d-4498-4e02-82f0-d52c276d5657", - "version": "KqlParameterItem/1.0", - "name": "Events", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc\r\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)", - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\n| where ResourceType == \"APPLICATIONGATEWAYS\" \n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\n| summarize count() by Resource, TimeGenerated", - "size": 1, - "exportToExcelOptions": "visible", - "title": "Resource events, by time", - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "linechart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Resource", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by Resource\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Resource use", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName, TimeGenerated", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Firewall and access events, by time", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "timechart" - }, - "customWidth": "70", - "name": "query - 5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"\u007bWAF:lable\u007d\"==\"All\" or Resource in (\u007bWAF\u007d)\r\n| where \"\u007bEvents:lable\u007d\"==\"All\" or OperationName in (\u007bEvents\u007d)\r\n| summarize number = count() by OperationName", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Events, by operation", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "30", - "name": "query - 6" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-WebApplicationFirewallOverview", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - overview", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','b6b63aa4-e7c8-557a-b87a-2566588ed8cf','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','b6b63aa4-e7c8-557a-b87a-2566588ed8cf','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "b6b63aa4-e7c8-557a-b87a-2566588ed8cf", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "DefenderWorkbook-fa49b3ef39b8d9de9077e46789396f9a", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "mode": "Incremental", - "expressionEvaluationOptions": { - "scope": "inner" - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "6a64662b-fe3a-5f28-8a38-71dc7f4279dd", - "name": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Azure WAF Events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "label": "Time Range", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - } - ], - "allowCustom": true - } - }, - { - "id": "604a42a0-deca-4a95-a15f-8977646a7fac", - "version": "KqlParameterItem/1.0", - "name": "WAFType", - "type": 5, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\r\n| summarize Count=count() by ResourceType\r\n| extend ResourceTypeImproved = iif(ResourceType == \"APPLICATIONGATEWAYS\", \"Application Gateway\", ResourceType)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"FRONTDOORS\", \"Azure Front Door\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"PROFILES\", \"Azure Front Door Premium\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"Azure CDN\", ResourceTypeImproved)\r\n| order by Count desc, ResourceTypeImproved asc\r\n| project ResourceTypeImproved", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "label": "WAF Type" - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "label": "WAF Items", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\"))\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Label = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\r\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| summarize number = count() by Action", - "size": 3, - "showAnalytics": true, - "title": "WAF actions filter", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "series", - "exportParameterName": "SelectedAction", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "27", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where Action == \"Block\"\r\n| where requestUri_s <> \"/\"\r\n| summarize count() by requestUri_s \r\n| top 40 by count_ desc ", - "size": 3, - "showAnalytics": true, - "title": "Top 40 Blocked Request URI addresses, filter to single URI address", - "noDataMessage": "The current data has no \"Blocked\" results", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "requestUri_s", - "exportParameterName": "RequestURI", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "requestUri_s", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "auto", - "showIcon": true - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 5 - } - } - }, - "showBorder": false - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "requestUri_s", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "63", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule has \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \",1),\"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule has \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule,\"):\",1)),\"\"),Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Top 50 event triggers, filter by rule name", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "Rule", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ], - "labelSettings": [ - { - "columnId": "count_", - "label": "" - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ] - }, - "customWidth": "30", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by Rule, bin(TimeGenerated, 1h)\r\n", - "size": 0, - "showAnalytics": true, - "title": "Messages, by time", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\r\n| project Rule, TimeGenerated, SourceSystem, Hostname, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\r\n| sort by TimeGenerated", - "size": 0, - "showAnalytics": true, - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - }, - "sortBy": [] - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| summarize Amount = count() by Rule\r\n| order by Amount desc\r\n\r\n", - "size": 0, - "title": "Attacks events, by messages and filterable by rule name", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Rule\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "palette": "blueDark", - "showIcon": true, - "aggregation": "Sum" - } - } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "20", - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\" \r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), _ResourceId\r\n| project Amount, Rule, TimeGenerated, _ResourceId\r\n| order by Amount desc", - "size": 0, - "showAnalytics": true, - "title": "Attack events, by time", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushLowerSection", - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "areachart" - }, - "customWidth": "80", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\" \r\n| summarize count() by TrackingID\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "TrackingID filter", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "TrackingID", - "exportParameterName": "SelectedTrackingID", - "exportDefaultValue": "*", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 500, - "filter": true, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "customWidth": "20", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\"\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "showAnalytics": true, - "title": "TrackingID Messages", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 50 - } - }, - "customWidth": "80", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by ClientIP\r\n| top 10 by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Top 10 Attacking IP Addresses, filter to single IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "x", - "exportParameterName": "ClientIP", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "chartSettings": { - "showLegend": true - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "25", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \"*\")\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "title": "Attack messages of IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - } - }, - "customWidth": "75", - "showPin": true, - "name": "query - 13" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallWAFTypeEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2" - } - } - } - } - } - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('a374c3f4-babb-5520-8832-366fe8bd6071')))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-fa49b3ef39b8d9de9077e46789396f9a')]", - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Defender Workbook: Microsoft Web Application Firewall (WAF) - Azure WAF", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "languageVersion": "2.0", - "contentVersion": "1.0.0.0", - "imports": { - "MicrosoftSecurity": { - "provider": "MicrosoftSecurity", - "version": "1.0.0" - } - }, - "resources": { - "workbook": { - "import": "MicrosoftSecurity", - "type": "Microsoft.Security/workbooks@2026-06-01-preview", - "properties": { - "id": "6a64662b-fe3a-5f28-8a38-71dc7f4279dd", - "name": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "content": { - "version": "Notebook/1.0", - "items": [ - { - "type": 1, - "content": { - "json": "## Azure WAF Events" - }, - "name": "text - 10" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "label": "Time Range", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 86400000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - } - ], - "allowCustom": true - } - }, - { - "id": "604a42a0-deca-4a95-a15f-8977646a7fac", - "version": "KqlParameterItem/1.0", - "name": "WAFType", - "type": 5, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\r\n| summarize Count=count() by ResourceType\r\n| extend ResourceTypeImproved = iif(ResourceType == \"APPLICATIONGATEWAYS\", \"Application Gateway\", ResourceType)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"FRONTDOORS\", \"Azure Front Door\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"PROFILES\", \"Azure Front Door Premium\", ResourceTypeImproved)\r\n| extend ResourceTypeImproved = iif(ResourceTypeImproved == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"Azure CDN\", ResourceTypeImproved)\r\n| order by Count desc, ResourceTypeImproved asc\r\n| project ResourceTypeImproved", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting", - "label": "WAF Type" - }, - { - "id": "d54c1639-d46c-4655-9d76-d5416926a453", - "version": "KqlParameterItem/1.0", - "name": "WAF", - "label": "WAF Items", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\"))\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Label = strcat(Resource, \" - \", Count)", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": "advancedHunting" - } - ], - "style": "pills" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n// Application Gateway has Matched, Blocked, Detected : translates to Matched, Block, Log\r\n// Azure Front Door has Matched, Block, Log : translates to Matched, Block, Log\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| summarize number = count() by Action", - "size": 3, - "showAnalytics": true, - "title": "WAF actions filter", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "series", - "exportParameterName": "SelectedAction", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "piechart" - }, - "customWidth": "27", - "name": "query - 11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where Action == \"Block\"\r\n| where requestUri_s <> \"/\"\r\n| summarize count() by requestUri_s \r\n| top 40 by count_ desc ", - "size": 3, - "showAnalytics": true, - "title": "Top 40 Blocked Request URI addresses, filter to single URI address", - "noDataMessage": "The current data has no \"Blocked\" results", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "requestUri_s", - "exportParameterName": "RequestURI", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "requestUri_s", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "auto", - "showIcon": true - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumFractionDigits": 2, - "maximumSignificantDigits": 5 - } - } - }, - "showBorder": false - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "requestUri_s", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "63", - "name": "query - 9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule has \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \",1),\"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule has \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule,\"):\",1)),\"\"),Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Top 50 event triggers, filter by rule name", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "Rule", - "exportParameterName": "Selected", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 3, - "formatOptions": { - "palette": "blue", - "showIcon": true - } - } - ], - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ], - "labelSettings": [ - { - "columnId": "count_", - "label": "" - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_bar_count__1", - "sortOrder": 2 - } - ] - }, - "customWidth": "30", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by Rule, bin(TimeGenerated, 1h)\r\n", - "size": 0, - "showAnalytics": true, - "title": "Messages, by time", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Message", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "70", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\r\n| project Rule, TimeGenerated, SourceSystem, Hostname, _ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\r\n| sort by TimeGenerated", - "size": 0, - "showAnalytics": true, - "title": "Message, full details", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushUpperSection", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - }, - "sortBy": [] - }, - "name": "query - 11" - }, - { - "type": 1, - "content": { - "json": "---" - }, - "name": "text - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\" \r\n| summarize Amount = count() by Rule\r\n| order by Amount desc\r\n\r\n", - "size": 0, - "title": "Attacks events, by messages and filterable by rule name", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "", - "exportParameterName": "MessageFilter", - "exportDefaultValue": "\u007b\"Rule\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Amount", - "formatter": 8, - "formatOptions": { - "palette": "blueDark", - "showIcon": true, - "aggregation": "Sum" - } - } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "20", - "name": "query - 16" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\" \r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize Amount = count() by Rule, bin(TimeGenerated, 1h), _ResourceId\r\n| project Amount, Rule, TimeGenerated, _ResourceId\r\n| order by Amount desc", - "size": 0, - "showAnalytics": true, - "title": "Attack events, by time", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 86400000 - }, - "timeContextFromParameter": "TimeRange", - "timeBrushParameterName": "timeBrushLowerSection", - "exportParameterName": "Message", - "exportDefaultValue": "\u007b \"Name\":\"\", \"Type\":\"*\"\u007d", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "areachart" - }, - "customWidth": "80", - "name": "query - 14" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\" \r\n| summarize count() by TrackingID\r\n| top 50 by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "TrackingID filter", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "TrackingID", - "exportParameterName": "SelectedTrackingID", - "exportDefaultValue": "*", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 500, - "filter": true, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "TrackingID", - "sortOrder": 2 - } - ] - }, - "customWidth": "20", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where Rule == Child or Child == \"*\"\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TrackingID, TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "showAnalytics": true, - "title": "TrackingID Messages", - "noDataMessage": "You have over-filtered or you are missing this data.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "gridSettings": { - "rowLimit": 50 - } - }, - "customWidth": "80", - "name": "query - 13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string, ruleName_s:string, clientIp_s:string, clientIP_s:string, action_s:string, transactionId_s:string,trackingReference_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where Rule == Child or Child == \"*\"\r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\"\r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| summarize count() by ClientIP\r\n| top 10 by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Top 10 Attacking IP Addresses, filter to single IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "exportFieldName": "x", - "exportParameterName": "ClientIP", - "exportDefaultValue": "*", - "showExportToExcel": true, - "exportToExcelOptions": "all", - "queryType": "advancedHunting", - "visualization": "barchart", - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "graphSettings": { - "type": 0, - "topContent": { - "columnMatch": "ClientIP", - "formatter": 1 - }, - "centerContent": { - "columnMatch": "count_", - "formatter": 1, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - }, - "chartSettings": { - "showLegend": true - }, - "mapSettings": { - "locInfo": "LatLong", - "sizeSettings": "count_", - "sizeAggregation": "Sum", - "legendMetric": "count_", - "legendAggregation": "Sum", - "itemColorSettings": { - "type": "heatmap", - "colorAggregation": "Sum", - "nodeColorField": "count_", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "25", - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let SelectedMS = dynamic(\u007bMessageFilter\u007d); // reference to the above list of messages (Event trigger)\r\nlet Child = SelectedMS.Rule; // Used to choose a group of messages - redirects to the message which was grouped\r\nlet FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,ruleGroup_s:string,instanceId_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,requestUri_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"PROFILES\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"\u007bWAFType:label\u007d\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"\u007bWAFType:label\u007d\" has \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"\u007bWAFType:label\u007d\" has \"azure front door\") or (ResourceType == \"PROFILES\" and \"\u007bWAFType:label\u007d\" has \"azure front door premium\") or (ResourceType==\"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"\u007bWAFType:label\u007d\" has \"cdn\")) and (\"\u007bWAF:label\u007d\" == \"All\" or Resource in (\u007bWAF\u007d))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or Category == \"FrontDoorWebApplicationFirewallLog\" or (OperationName == \"ApplicationGatewayFirewall\" and Message has \"attack\") or Category == \"WebApplicationFirewallLogs\"\r\n| where '\u007bRequestURI\u007d' == requestUri_s or '\u007bRequestURI\u007d' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| where Rule == Child or Child == \"*\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend TrackingID = strcat(transactionId_s, trackingReference_s)\r\n| where '\u007bSelectedTrackingID\u007d' == TrackingID or '\u007bSelectedTrackingID\u007d' == \"*\" \r\n| where '\u007bSelectedAction\u007d' == Action or '\u007bSelectedAction\u007d' == \"*\" \r\n| where '\u007bSelected\u007d' == Rule or '\u007bSelected\u007d' == \"*\"\r\n| where ('\u007bClientIP\u007d' == ClientIP or '\u007bClientIP\u007d' == \"*\")\r\n| extend RuleGroup = ruleGroup_s, InstandUri = instanceId_s, RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s\r\n| project TimeGenerated, Rule, ClientIP, RuleGroup, InstandUri, RequestUri, RuleSetType, Action, Message_Details, File_Details, Data_Details, Hostname, Category", - "size": 0, - "title": "Attack messages of IP address", - "noDataMessage": "Filtered messages are not attack events", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "timeBrushLowerSection", - "showExportToExcel": true, - "queryType": "advancedHunting", - "visualization": "table", - "gridSettings": { - "filter": true - } - }, - "customWidth": "75", - "showPin": true, - "name": "query - 13" - } - ], - "fromTemplateId": "sentinel-WebApplicationFirewallWAFTypeEvents", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2" - } - } - } - } - } - }, - "packageKind": "Solution", - "packageVersion": "3.2.2", - "packageName": "Azure Web Application Firewall (WAF)", - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "contentSchemaVersion": "3.0.0", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentKind": "DefenderWorkbook", - "displayName": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','a374c3f4-babb-5520-8832-366fe8bd6071','-','3.2.2')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','a374c3f4-babb-5520-8832-366fe8bd6071','-','3.2.2')))]", - "version": "3.2.2", - "contentProvenance": { - "packageId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", - "packageVersion": "3.2.2", - "contentId": "a374c3f4-babb-5520-8832-366fe8bd6071", - "contentVersion": "3.2.2", - "requiredWorkloads": [ - { - "workload": "sentinel", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredDataConnectors": [ - { - "connectorId": "AzureWebApplicationFirewallWAF", - "dataTypes": [ - "AzureDiagnostics" - ] - } - ], - "requiredWorkspaceFunctions": [] - } - }, - "condition": "[parameters('DeployDefenderWorkbook')]" - }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "pid-8e5ceded-60a4-42bc-a39a-1ba9674c2930-partnercenter", - "properties": { - "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "resources": [] - } - } } ], "outputs": {} diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json b/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json index 21c3117b9d8..ba3d8ae4a25 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/testParameters.json @@ -52,40 +52,5 @@ "metadata": { "description": "Name for the workbook" } - }, - "DeployAnalyticsRule": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." - } - }, - "DeployWorkbook": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." - } - }, - "DeployDefenderWorkbook": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification." - } - }, - "DeployDataConnector": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." - } - }, - "DeployCustomDetection": { - "type": "bool", - "defaultValue": false, - "metadata": { - "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." - } } } diff --git a/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json b/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json index dfe0af4ca07..eb6d9940ca8 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json +++ b/Solutions/Azure Web Application Firewall (WAF)/SolutionMetadata.json @@ -17,5 +17,5 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" }, - "version": "3.2.2" + "version": "3.1.0" }