Network Session Essentials (Preview)

Solution: Network Session Essentials

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Microsoft Corporation
Support Tier	Microsoft
Support Link	https://support.microsoft.com
Categories	Security - Network
Version	3.0.12
Author	Microsoft - support@microsoft.com
First Published	2022-11-11
Last Updated	2026-09-07
Solution Folder	Network Session Essentials
Marketplace	Azure Marketplace · Popularity: 🔵 Medium (74%)
Pre-requisites	Amazon Web Services, Azure Firewall, Azure Network Security Groups, Check Point, CiscoASA, CiscoMeraki, Corelight, Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel, IoTOTThreatMonitoringwithDefenderforIoT, Microsoft Defender for Cloud, Microsoft Sysmon For Linux, Windows Firewall, PaloAlto-PAN-OS, Vectra AI Stream, Watchguard Firebox, zscaler1579058425289.zscaler_internet_access_mss, IllumioSaaS

Network Session Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below , as well as any other connector or data source normalized to the ASIM.

For details on the required solutions, see the Pre-requisites section below.

Recommendation :-

It is highly recommended to use the Summarize Data for Network Session Essentials using log ingestion API logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries. NOTE: This solution includes the playbook SummarizeData_NSE, which uses the legacy HTTP data collector API to ingest data. Since that API is about to be deprecated, we recommend using the SummarizeData_NSE_Logingestionapi playbook instead.

Additional Information

📖 Related Documentation: ASIM-based domain solutions overview - Uses ASIM Network Session schema for cross-product threat detection
📖 Related Documentation: ASIM Network Session schema reference - Field definitions for normalized network logs

Pre-requisites
Data Connectors
Tables Used
Content Items

Pre-requisites

This solution depends on 16 other solution(s):

Solution
Amazon Web Services
Azure Firewall
Azure Network Security Groups
Check Point
CiscoASA
CiscoMeraki
Corelight
Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel
IllumioSaaS
IoTOTThreatMonitoringwithDefenderforIoT
Microsoft Defender for Cloud
Microsoft Sysmon For Linux
PaloAlto-PAN-OS
Vectra AI Stream
Watchguard Firebox
Windows Firewall

Data Connectors

This solution does not include its own data connectors but uses connectors from dependency solutions:

AI Vectra Stream via Legacy Agent (dependency on Vectra AI Stream)
Amazon Web Services (dependency on Amazon Web Services)
Amazon Web Services S3 (dependency on Amazon Web Services)
Amazon Web Services S3 WAF (dependency on Amazon Web Services)
Azure Firewall (dependency on Azure Firewall)
Network Security Groups (dependency on Azure Network Security Groups)
Subscription-based Microsoft Defender for Cloud (Legacy) (dependency on Microsoft Defender for Cloud)
Cisco ASA via Legacy Agent (dependency on CiscoASA)
Cisco ASA/FTD via AMA (dependency on CiscoASA)
[Deprecated] Cisco Meraki (dependency on CiscoMeraki)
Cisco Meraki (using REST API) (dependency on CiscoMeraki)
Corelight Connector Exporter (dependency on Corelight)
[Deprecated] Fortinet via Legacy Agent (dependency on Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel)
[Deprecated] Fortinet via AMA (dependency on Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel)
Illumio SaaS (dependency on IllumioSaaS)
Illumio Saas (dependency on IllumioSaaS)
Microsoft Defender for IoT (dependency on IoTOTThreatMonitoringwithDefenderforIoT)
Tenant-based Microsoft Defender for Cloud (dependency on Microsoft Defender for Cloud)
[Deprecated] Microsoft Sysmon For Linux (dependency on Microsoft Sysmon For Linux)
[Deprecated] Palo Alto Networks (Firewall) via Legacy Agent (dependency on PaloAlto-PAN-OS)
[Deprecated] Palo Alto Networks (Firewall) via AMA (dependency on PaloAlto-PAN-OS)
[Recommended] Vectra AI Stream via AMA (dependency on Vectra AI Stream)
[Deprecated] WatchGuard Firebox (dependency on Watchguard Firebox)
Windows Firewall (dependency on Windows Firewall)
Windows Firewall Events via AMA (dependency on Windows Firewall)

Tables Used

This solution queries 19 table(s) from its content items:

Table	Used By Content
`NetworkCustomAnalyticsV1_CL`	Playbooks
`NetworkCustomAnalytics_countryV1_CL`	Playbooks
`NetworkCustomAnalytics_ipV1_CL`	Playbooks
`NetworkCustomAnalytics_protocolV1_CL`	Playbooks
`NetworkCustomAnalytics_ruleV1_CL`	Playbooks
`NetworkCustomAnalytics_sourceInfoV1_CL`	Playbooks
`NetworkCustomAnalytics_source_portV1_CL`	Playbooks
`NetworkCustomAnalytics_threatV1_CL`	Playbooks
`NetworkCustomAnalytics_threat_iocV1_CL`	Playbooks
`NetworkSummary_Country_CL`	Workbooks
`NetworkSummary_IP_CL`	Workbooks
`NetworkSummary_Protocol_CL`	Analytics, Hunting, Workbooks
`NetworkSummary_Result_CL`	Workbooks
`NetworkSummary_Rule_CL`	Workbooks
`NetworkSummary_SourceInfo_CL`	Workbooks
`NetworkSummary_Source_Port_CL`	Workbooks
`NetworkSummary_Threat_CL`	Workbooks
`NetworkSummary_Threat_IOC_CL`	Workbooks
`ThreatIntelligenceIndicator`	Workbooks

Internal Tables

The following 11 table(s) are used internally by this solution's content items:

Table	Used By Content
`Anomalies`	Analytics, Hunting
`NetworkCustomAnalytics_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_country_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_ip_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_protocol_CL`	Analytics, Hunting, Playbooks (writes), Workbooks
`NetworkCustomAnalytics_rule_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_sourceInfo_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_source_port_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_threat_CL`	Playbooks (writes), Workbooks
`NetworkCustomAnalytics_threat_ioc_CL`	Playbooks (writes), Workbooks
`SecurityAlert`	Workbooks

Content Items

This solution includes 39 content item(s):

Content Type	Count
Summary Rule	18
Analytic Rules	9
Hunting Queries	7
Workbooks	2
Playbooks	2
Watchlists	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Anomaly found in Network Session Traffic (ASIM Network Session schema)	Medium	CommandAndControl, Discovery, Exfiltration, LateralMovement	`NetworkSummary_Protocol_CL` Internal use: `Anomalies` `NetworkCustomAnalytics_protocol_CL`
Anomaly in SMB Traffic(ASIM Network Session schema)	Medium	LateralMovement	-
Detect port misuse by anomaly based detection (ASIM Network Session schema)	Medium	CommandAndControl, LateralMovement, Execution, InitialAccess	`NetworkSummary_Protocol_CL` Internal use: `Anomalies` `NetworkCustomAnalytics_protocol_CL`
Detect port misuse by static threshold (ASIM Network Session schema)	Medium	CommandAndControl, Execution, InitialAccess	`NetworkSummary_Protocol_CL` Internal use: `NetworkCustomAnalytics_protocol_CL`
Excessive number of failed connections from a single source (ASIM Network Session schema)	Medium	Impact	-
Network Port Sweep from External Network (ASIM Network Session schema)	High	Reconnaissance, Discovery	-
Port scan detected (ASIM Network Session schema)	Medium	Discovery	-
Potential beaconing activity (ASIM Network Session schema)	Low	CommandAndControl	-
Remote Desktop Network Brute force (ASIM Network Session schema)	Medium	CredentialAccess	-

Hunting Queries

Name	Tactics	Tables Used
Detect Outbound LDAP Traffic(ASIM Network Session schema)	InitialAccess, Execution	-
Detect port misuse by anomaly (ASIM Network Session schema)	CommandAndControl, InitialAccess, Execution	`NetworkSummary_Protocol_CL` Internal use: `Anomalies` `NetworkCustomAnalytics_protocol_CL`
Detect port misuse by static threshold (ASIM Network Session schema)	CommandAndControl, InitialAccess, Execution	`NetworkSummary_Protocol_CL` Internal use: `NetworkCustomAnalytics_protocol_CL`
Detects several users with the same MAC address (ASIM Network Session schema)	InitialAccess	-
Mismatch between Destination App name and Destination Port (ASIM Network Session schema)	Discovery	-
Protocols passing authentication in cleartext (ASIM Network Session schema)	CommandAndControl	-
Remote Desktop Network Traffic(ASIM Network Session schema)	LateralMovement	-

Workbooks

Name	Tables Used
NetworkSessionEssentials	`ThreatIntelligenceIndicator` Internal use: `NetworkCustomAnalytics_CL` `NetworkCustomAnalytics_country_CL` `NetworkCustomAnalytics_ip_CL` `NetworkCustomAnalytics_protocol_CL` `NetworkCustomAnalytics_rule_CL` `NetworkCustomAnalytics_sourceInfo_CL` `NetworkCustomAnalytics_source_port_CL` `NetworkCustomAnalytics_threat_CL` `NetworkCustomAnalytics_threat_ioc_CL` `SecurityAlert`
NetworkSessionEssentialsV2	`NetworkSummary_Country_CL` `NetworkSummary_IP_CL` `NetworkSummary_Protocol_CL` `NetworkSummary_Result_CL` `NetworkSummary_Rule_CL` `NetworkSummary_SourceInfo_CL` `NetworkSummary_Source_Port_CL` `NetworkSummary_Threat_CL` `NetworkSummary_Threat_IOC_CL` `ThreatIntelligenceIndicator` Internal use: `NetworkCustomAnalytics_threat_ioc_CL` `SecurityAlert`

Playbooks

Name	Description	Tables Used
Summarize Data for Network Session Essentials using log ingestion API	This playbook summarizes data for Network Session Essentials and lands it into custom tables.	`NetworkCustomAnalyticsV1_CL` (read) `NetworkCustomAnalytics_countryV1_CL` (read) `NetworkCustomAnalytics_ipV1_CL` (read) `NetworkCustomAnalytics_protocolV1_CL` (read) `NetworkCustomAnalytics_ruleV1_CL` (read) `NetworkCustomAnalytics_sourceInfoV1_CL` (read) `NetworkCustomAnalytics_source_portV1_CL` (read) `NetworkCustomAnalytics_threatV1_CL` (read) `NetworkCustomAnalytics_threat_iocV1_CL` (read)
[Deprecated] Summarize Data for Network Session Essentials	This playbook summarizes data for Network Session Essentials and lands it into custom tables. **NOTE...	Internal use: `NetworkCustomAnalytics_CL` (read/write) `NetworkCustomAnalytics_country_CL` (read/write) `NetworkCustomAnalytics_ip_CL` (read/write) `NetworkCustomAnalytics_protocol_CL` (read/write) `NetworkCustomAnalytics_rule_CL` (read/write) `NetworkCustomAnalytics_sourceInfo_CL` (read/write) `NetworkCustomAnalytics_source_port_CL` (read/write) `NetworkCustomAnalytics_threat_CL` (read/write) `NetworkCustomAnalytics_threat_ioc_CL` (read/write)

Watchlists

Name	Description	Tables Used
NetworkSession_Monitor_Configuration	-	-

Summary Rule

Name	Description	Tables Used
NetworkSummary_Country	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Country	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_IP	'This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession func...	-
NetworkSummary_IP	'This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession func...	-
NetworkSummary_Protocol	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Protocol	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Result	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Result	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Rule	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Rule	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_SourceInfo	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_SourceInfo	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Source_Port	'This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession func...	-
NetworkSummary_Source_Port	'This summary rule aggregates network session data using the ASIM normalized _Im_NetworkSession func...	-
NetworkSummary_Threat	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Threat	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Threat_IOC	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-
NetworkSummary_Threat_IOC	'This summary rule aggregates recent network session data using the ASIM normalized _Im_NetworkSessi...	-

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.12	02-09-2026	Added Summarize Data for Network Session Essentials using log ingestion API Playbook
3.0.11	24-03-2026	Bump solution version and Updated links to remove review.learn.
3.0.10	14-02-2026	Updated links to remove review.learn.
3.0.9	06-02-2026	Updated the relevant techniques in the hunting queries.

| 3.0.8 | 23-09-2025 | Removed duplicate and redundant query blocks that previously handled different eps ranges, reducing code complexity and improving maintainability. | 3.0.7 | 4-07-2025 | Summary rules added and updated requiredDataConnectors. | | 3.0.6 | 15-04-2025 | Updated Analytic Rule NetworkPortSweepFromExternalNetwork. | | 3.0.5 | 12-12-2024 | Added IllumioSaaS solution in a domain solution list | | 3.0.4 | 03-06-2024 | Added missing AMA Data Connector reference in Analytical rule and Hunting Query. | | 3.0.3 | 12-03-2024 | Added 3 new Hunting Queries and 2 new Analytic Rules. | | 3.0.2 | 07-02-2024 | Updated Analytic Rule (DetectPortMisuseByAnomalyBasedDetection).
Updated Solution description. | | 3.0.1 | 02-01-2024 | Tagged for dependent solutions for deployment. | | 3.0.0 | 24-07-2023 | Updated ApiVersion for Watchlist. |