Summarize Web Session Data
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configu
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | Web Session Essentials |
| Source | View on GitHub |
Tables Used
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
WebSession_Summarized_DstIP_CL 🔶 |
? | ✓ | ? |
WebSession_Summarized_SrcIP_CL 🔶 |
? | ✓ | ? |
WebSession_Summarized_SrcInfo_CL 🔶 |
? | ✓ | ? |
WebSession_Summarized_ThreatInfo_CL 🔶 |
? | ✓ | ? |
Logic App Connectors
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azureloganalyticsdatacollector |
Managed | 1 | 4 |
azuremonitorlogs |
Managed | 1 | 4 |
Action parameters (URLs, paths, function IDs)
azureloganalyticsdatacollector (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Send_Data_DstIP | post | /api/logs |
— |
| Send_Data_SourceInfo | post | /api/logs |
— |
| Send_Data_SrcIP | post | /api/logs |
— |
| Send_Data | post | /api/logs |
— |
azuremonitorlogs (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Run_query_and_list_results_DstIP | post | /queryData |
— |
| Run_query_and_list_results_SourceInfo | post | /queryData |
— |
| Run_query_and_list_results_SrcIP | post | /queryData |
— |
| Run_query_and_list_results_ThreatInfo | post | /queryData |
— |
Additional Documentation
📄 Source: SummarizeWebSessionData/readme.md
Web Session Essentials Summarization capability
This logic app helps to ingest summarized web session data into custom tables. Please note - enabling this playbook would incur additional cost.
Summary
To ensure good performance of Web Session solution, summarization capability can be used. This would create four custom tables containing analytics based on different parameters of ASIM Web Session Schema. This playbook will create the following four tables in your Log Analytics Workspace:
- WebSession_Summarized_SrcInfo_CL
- WebSession_Summarized_SrcIP_CL
- WebSession_Summarized_DstIP_CL
- WebSession_Summarized_ThreatInfo_CL
Deployment instructions
Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.
Fill in the required parameter:
- Playbook Name: Enter the playbook name here (Ex: SummarizeWebSessionData)
Post-Deployment instructions
a. Authorize connections (Perform this action if needed)
Once deployment is complete, you will need to authorize each connection.
- Click the Azure Monitor Logs
- Click edit API connection
- Click Authorize
- Sign in
- Click Save
- Click the Azure Log Analytics Data Collector
- Click edit API connection
- Add value for workspace id and key which is associated with the Sentinel instance
- Click Save
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊