Web Session Essentials
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com |
| Categories | Networking |
| Version | 3.0.4 |
| Author | Microsoft - support@microsoft.com |
| First Published | 2023-06-29 |
| Last Updated | 2026-09-07 |
| Solution Folder | Web Session Essentials |
| Marketplace | Azure Marketplace · Popularity: ⚪ Very Low (0%) |
| Pre-requisites | PaloAlto-PAN-OS, SquidProxy, Vectra AI Stream, zscaler1579058425289.zscaler_internet_access_mss |
Web Session Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the ASIM.
For details on the required solutions, see the Pre-requisites section below.
Recommendation :-
It is highly recommended to use the SummarizeWebSessionData logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries. NOTE: This solution includes the playbook SummarizeWebSessionData, which uses the legacy HTTP data collector API to ingest data. Since that API is about to be deprecated, we recommend using the SummarizeWebSessionData_logingestion playbook instead.
Contents
Pre-requisites
This solution depends on 3 other solution(s):
| Solution |
|---|
| PaloAlto-PAN-OS |
| SquidProxy |
| Vectra AI Stream |
Data Connectors
This solution does not include its own data connectors but uses connectors from dependency solutions:
- AI Vectra Stream via Legacy Agent (dependency on Vectra AI Stream)
- [Deprecated] Palo Alto Networks (Firewall) via Legacy Agent (dependency on PaloAlto-PAN-OS)
- [Deprecated] Palo Alto Networks (Firewall) via AMA (dependency on PaloAlto-PAN-OS)
- [Deprecated] Squid Proxy (dependency on SquidProxy)
- [Recommended] Vectra AI Stream via AMA (dependency on Vectra AI Stream)
Tables Used
This solution queries 5 table(s) from its content items:
| Table | Used By Content |
|---|---|
ThreatIntelligenceIndicator |
Workbooks |
WebSession_Summarized_DstIPV1_CL |
Playbooks |
WebSession_Summarized_SrcIPV1_CL |
Playbooks |
WebSession_Summarized_SrcInfoV1_CL |
Playbooks |
WebSession_Summarized_ThreatInfoV1_CL |
Playbooks |
Internal Tables
The following 7 table(s) are used internally by this solution's content items:
| Table | Used By Content |
|---|---|
Anomalies |
Analytics |
SecurityAlert |
Workbooks |
Watchlist |
Analytics |
WebSession_Summarized_DstIP_CL |
Playbooks (writes), Workbooks |
WebSession_Summarized_SrcIP_CL |
Analytics, Playbooks (writes), Workbooks |
WebSession_Summarized_SrcInfo_CL |
Analytics, Playbooks (writes), Workbooks |
WebSession_Summarized_ThreatInfo_CL |
Playbooks (writes), Workbooks |
Content Items
This solution includes 27 content item(s):
| Content Type | Count |
|---|---|
| Analytic Rules | 15 |
| Hunting Queries | 9 |
| Playbooks | 2 |
| Workbooks | 1 |
Analytic Rules
Hunting Queries
| Name | Tactics | Tables Used |
|---|---|---|
| Beaconing traffic based on common user agents visiting limited number of domains (ASIM Web Session) | CommandAndControl | - |
| Detect IPAddress in the requested URL (ASIM Web Session) | Exfiltration, CommandAndControl | - |
| Detect Kali Linux UserAgent (ASIM Web Session) | Execution | - |
| Detect threat information in web requests (ASIM Web Session) | InitialAccess | - |
| Empty User Agent Detected (ASIM Web Session) | InitialAccess | - |
| Excessive number of forbidden requests detected (ASIM Web Session) | Persistence, CredentialAccess | - |
| Potential beaconing detected (ASIM Web Session) | CommandAndControl | - |
| Potential beaconing detected - Similar sent bytes (ASIM Web Session) | CommandAndControl | - |
| Request from bots and crawlers (ASIM Web Session) | InitialAccess | - |
Workbooks
Playbooks
| Name | Description | Tables Used |
|---|---|---|
| Summarize Web Session Data using Log Ingestion API | The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting the... | WebSession_Summarized_DstIPV1_CL (read)WebSession_Summarized_SrcIPV1_CL (read)WebSession_Summarized_SrcInfoV1_CL (read)WebSession_Summarized_ThreatInfoV1_CL (read) |
| [Deprecated] Summarize Web Session Data | The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting the... | Internal use:WebSession_Summarized_DstIP_CL (read/write)WebSession_Summarized_SrcIP_CL (read/write)WebSession_Summarized_SrcInfo_CL (read/write)WebSession_Summarized_ThreatInfo_CL (read/write) |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.4 | 02-09-2026 | Added Summarize Web Session Data using Log Ingestion API Playbook |
| 3.0.3 | 06-06-2024 | Updated Entity Mapping Analytic Rule CommandInURL.yaml |
| 3.0.2 | 31-01-2024 | Updated the solution to fix Analytic Rules deployment issue |
| 3.0.1 | 02-01-2024 | Tagged for dependent Solutions for deployment |
| 3.0.0 | 11-09-2023 | Initial Solution Release |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊