-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathGetFortiNetEventsPerDevice.kql
56 lines (46 loc) · 2.6 KB
/
GetFortiNetEventsPerDevice.kql
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend policyName = tostring(extract("profile=(\\w+)[-]?(\\w+)", 0, AdditionalExtensions))
| extend policyID = extract("policyid=(\\d+)", 1, AdditionalExtensions)
| summarize count() by bin(TimeGenerated, 1h), DeviceName
| render timechart
//AdditionalExtensions parsen
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend policyName = tostring(extract("profile=(\\w+)[-]?(\\w+)", 0, AdditionalExtensions))
| extend policyID = extract("policyid=(\\d+)", 1, AdditionalExtensions)
| where ipv4_is_private(SourceIP) == true and ipv4_is_private(DestinationIP) == false
| parse-kv AdditionalExtensions as (srccountry:string, logid:int, start:datetime) with (pair_delimiter=";", kv_delimiter="=")
//Traffic IN to IN --> Auxiliary Log
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend policyName = tostring(extract("profile=(\\w+)[-]?(\\w+)", 0, AdditionalExtensions))
| extend policyID = extract("policyid=(\\d+)", 1, AdditionalExtensions)
| where ipv4_is_private(SourceIP) == true and ipv4_is_private(DestinationIP) == true
//| summarize count() by Activity, DeviceAction
//| where DeviceCustomString6 == "VPN_SSO_AUTH_GROUP"
| project Type, billable = _IsBillable, datasize =_BilledSize, TimeGenerated
| summarize SizeInMB = sum(datasize)/1000/1000 by bin(TimeGenerated, 1h)
//Traffic IN to OUT --> Analytic Log (pass rauswerfen)
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend policyName = tostring(extract("profile=(\\w+)[-]?(\\w+)", 0, AdditionalExtensions))
| extend policyID = extract("policyid=(\\d+)", 1, AdditionalExtensions)
| where ipv4_is_private(SourceIP) == true and ipv4_is_private(DestinationIP) == false
//| summarize count() by Activity, DeviceAction
| where Activity contains "dns"
//DNS Matching ggf. wenig Daten parsen und nutzen um gegen TI zu prüfen
| project Type, billable = _IsBillable, datasize =_BilledSize, TimeGenerated
| summarize sum(datasize)/1000/1000/1000 by bin(TimeGenerated, 1h)
//Traffic OUT to IN --> Auxiliary Log
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend policyName = tostring(extract("profile=(\\w+)[-]?(\\w+)", 0, AdditionalExtensions))
| extend policyID = extract("policyid=(\\d+)", 1, AdditionalExtensions)
| where ipv4_is_private(SourceIP) == false and ipv4_is_private(DestinationIP) == true
//| summarize count() by Activity, DeviceAction
| project Type, billable = _IsBillable, datasize =_BilledSize, TimeGenerated
| summarize SizeInMB = sum(datasize)/1000/1000 by bin(TimeGenerated, 1h)
| where DeviceAction contains "block"
| summarize count() by bin(TimeGenerated, 1h), DeviceName
| render timechart