Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This summary rule aggregates web session logs from Palo Alto PAN-OS devices, providing hourly insights into session count, data sent, data received by device actions, sourceUserName, destination hostname, source and destination IP addresses.
| Attribute | Value |
|---|---|
| Type | Summary Rule |
| Solution | Standalone Content |
| ID | 1ccf0f4e-4f5d-4a46-819b-5ba857394f2a |
| Required Connectors | CefAma |
| Source | [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Summary rules/WebSession/PaloAltoPANOSWebSessionIPSummary.yaml) |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
Activity == "THREAT"DeviceEventClassID == "url"DeviceProduct == "PAN-OS"DeviceVendor == "Palo Alto Networks" |
✓ | ✓ | ✓ |
The following connectors provide data for this content item:
Solutions: Common Event Format, PaloAlto-PAN-OS (legacy connector), VirtualMetric DataStream
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊