[Deprecated] Summarize Data for DNS Essentials Solution
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This playbook summarizes data for DNS Essentials Solution and ingests into custom tables. NOTE: It uses the legacy HTTP data collector API to ingest the data, which is about to be deprecated, so it is recommended to use the SummarizeDNSData_DNS_logingestion playbook instead. That playbook ingests data into the new tables - DNS_Summarized_Logs_sourceInfoV1_CL and DNS_Summarized_Logs_ipV1_CL
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | DNS Essentials |
| Source | View on GitHub |
Tables Used
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DNS_Summarized_Logs_ip_CL 🔶 |
? | ✓ | ? |
DNS_Summarized_Logs_sourceInfo_CL 🔶 |
? | ✓ | ? |
Logic App Connectors
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azureloganalyticsdatacollector |
Managed | 1 | 2 |
azuremonitorlogs |
Managed | 1 | 2 |
Action parameters (URLs, paths, function IDs)
azureloganalyticsdatacollector (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Send_Data_-_IP | post | /api/logs |
— |
| Send_Data | post | /api/logs |
— |
azuremonitorlogs (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Run_query_and_list_results_-_IP | post | /queryData |
— |
| Run_query_and_list_results_-_SourceInfo | post | /queryData |
— |
Additional Documentation
📄 Source: SummarizeData_DNSEssentials/readme.md
DNS Essentials Summarization capability
This logic app helps to ingest summarized DNS data into custom tables. Please note - enabling this playbook would incur additional cost.
Summary
To ensure good performance of DNS Domain solution, summarization capability can be used. This would create two custom tables containing analytics based on different parameters of ASIM DNS Schema. This playbook will create the following two tables in your Log Analytics Workspace:
- DNS_Summarized_Logs_sourceInfo_CL
- DNS_Summarized_Logs_ip_CL
Deployment instructions
Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.
Fill in the required parameter:
- Playbook Name: Enter the playbook name here (Ex: SummarizeDNSData)
Post-Deployment instructions
a. Authorize connections (Perform this action if needed)
Once deployment is complete, you will need to authorize each connection.
- Click the Azure Monitor Logs
- Click edit API connection
- Click Authorize
- Sign in
- Click Save
- Click the Azure Log Analytics Data Collector
- Click edit API connection
- Add value for workspace id and key which is associated with the Sentinel instance
- Click Save
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊