Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This summary rule aggregates web session logs from Fortinet Fortigate devices, providing hourly insights into session count, data sent and data received by device actions, destination hostname, source and destination IP addresses.
| Attribute | Value |
|---|---|
| Type | Summary Rule |
| Solution | Standalone Content |
| ID | 9862489b-230a-4b70-b45a-8a2771360a86 |
| Required Connectors | CefAma |
| Source | [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Summary rules/WebSession/FortinetFortigateWebSessionIPSummary.yaml) |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
Activity has_all "webfilter"DeviceProduct startswith "Fortigate"DeviceVendor == "Fortinet" |
✓ | ✓ | ✓ |
The following connectors provide data for this content item:
Solutions: Common Event Format, Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel (legacy connector), VirtualMetric DataStream
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊