Kueri untuk tabel CommonSecurityLog

Penggunaan mesin kolektor Palo Alto

Kueri ini menampilkan daftar menurun dari semua nama host mesin kolektor sesuai dengan jumlah peristiwa yang mereka terima dari appliance Palo Alto.

CommonSecurityLog
// Quering on the past 7 days
| where TimeGenerated > ago(7d)
// Quering only on incoming events from a Palo Alto appliance
| where DeviceProduct has 'PAN-OS'
| where DeviceVendor =~ 'Palo Alto Networks'
// Find the the collector machine with the highest usage
| summarize Count=count() by Computer
// Sort in a descending order- Most used Collector hostname comes first
| sort by Count desc

Penggunaan jenis peristiwa Cisco ASA

Kueri ini menampilkan daftar turun dari jumlah peristiwa yang diserap untuk setiap DeviceEventClassID

CommonSecurityLog 
// Quering on the past 7 days
| where TimeGenerated > ago(7d)
// Only filter on Cisco ASA events
| where DeviceVendor == "Cisco" and DeviceProduct == "ASA"
// group events by their DeviceEventClassID value, which represents the Cisco message id
| summarize count_events=count() by DeviceEventClassID
// Sort in a descending order- most used DeviceEventClassID comes first
| sort by count_events desc

Statistik volume peristiwa perangkat

Perangkat mengirim sebagian besar peristiwa.

CommonSecurityLog
| top-nested 15 of DeviceVendor by Vendor=count(),
  top-nested 5 of DeviceProduct by Product=count(),
  top-nested 5 of DeviceVersion by Version=count()