Trend stavu zranitelností v čase
let scantimes = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| summarize LatestScan = max(scan_started_at_t) by scan_schedule_uuid_s,
asset_hostname_s, port_port_d;
let Plugintop = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname_s,
plugin_name_s, port_port_d;
let startDate = datetime(2025-1 -1);
let Months = range dt from startDate to now() step 1 d
| extend MonthStart = startofmonth(dt), MonthEnd = endofmonth(dt)
| summarize by MonthStart, MonthEnd
| extend join_key = 1;
let VulnState = Security_Vulnerabilities_Log
| where last_found_t > startDate and severity_s in ("critical", "high")
I join kind = inner (scantimes) on scan_schedule_uuid_s, asset_hostname_s, port_port_d
| join kind = inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| extend join_key = 1
| join kind = inner (Months) on join_key
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t) by plugin_name_s,
asset_hostname_s, LatestScan, port_port_d, plugin_vpr_updated_t_max, MonthStart,
MonthEnd
| where FirstSeen <= MonthEnd and LastSeen >= MonthStart
| extend State = case(
(LastSeen >= MonthStart and LastSeen <= MonthEnd) and (LastSeen < LatestScan), "Closed",
"Opened"
)
| summarize VulnCount = count() by MonthStart, State;
let AUStates = datatable(State: string) ["Opened", "Closed"]
| extend join_key = 1;
let MonthGrid = Months
I project MonthStart, join_key
| distinct MonthStart, join_key;
MonthGrid
| join kind = inner (AUStates) on join_key
| join kind = leftouter (VulnState) on MonthStart, State
| project MonthStart, State, VulnCount = coalesce(VulnCount, 0)
| order by MonthStart asc
| render columnchart
SLA plnění pro závažné zranitelnosti
let Plugintop = Security_Vulnerabilities_Log
I where TimeGenerated > datetime(2025-1 -1)
| summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname_s,
plugin_name_s, port_port_d;
let startDate = datetime(2025-1 -1);
let Months = range dt from startDate to now() step 1 d
| extend MonthStart = startofmonth(dt), MonthEnd = endofmonth(dt)
| summarize by MonthStart, MonthEnd
| extend join_key = 1;
Security_Vulnerabilities_Log
| where last_found_t > startDate and severity_s in ("critical", "high")
| join kind = inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| extend join_key = 1
| join kind = inner (Months) on join_key
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t) by plugin_name_s,
asset_hostname_s, port_port_d, plugin_vpr_updated_t_max, MonthStart, MonthEnd, severity_s
| extend TimelnSystem = datetime_diff("day", LastSeen, FirstSeen)
| extend TimeCategory = case(
TimelnSystem <= 3 and severity_s == "critical", "SLA_OK",
TimelnSystem <= 35 and severity_s == "high", "SLA_OK",
"SLA_NOT_OK"
)
I where FirstSeen <= MonthEnd and LastSeen >= MonthStart
I summarize count() by MonthStart, TimeCategory
I render columnchart
Délka výskytu zranitelností podle serveru
let Plugintop = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname_s,
plugin_name_s, port_port_d;
Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| where severity_s == "critical" or severity_s == "high"
I join kind=inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t)
by
plugin_name_s,
asset_hostname_s,
port_port_d,
plugin_vpr_updated_t_max,
severity_s
| extend TimelnSystem = datetime_diff('day', LastSeen, FirstSeen)
| summarize avg(Time InSystem) by asset_hostname_s
| sort by avg_TimelnSystem desc
| render barchart
Deset nejčastějších zranitelnostív infrastruktuře
let Plugintop = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
I summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname
plugin_name_s, port_port_d;
Security_Vulnerabilities_Log
I where TimeGenerated > datetime(2025-1 -1)
| where severity_s == "critical" or severity_s == "high"
| join kind=inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t)
by
plugin_name_s,
asset_hostname_s,
port_port_d,
plugin_vpr_updated_t_max,
severity_s
| summarize CountVulns = count() by plugin_name_s
| top 10 by CountVulns desc
Průměrná míra zranitelnosti infrastruktury
let Plugintop = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname
plugin_name_s, port_port_d;
Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| where severity_s == "critical" or severity_s == "high"
I join kind=inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t)
by
plugin_name_s,
asset_hostname_s,
port_port_d,
plugin_vpr_updated_t_max,
severity_s
I summarize AUVulns = count(), HostCount = dcount(asset_hostname_s)
I extend VulnsPerHost =1.0* AUVulns / HostCount
Měsíční přehled otevřených zranitelností
let scantimes = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
I summarize LatestScan = max(scan_started_at_t) by scan_schedule_uuid_s,
asset_hostname_s, port_port_d;
let Plugintop = Security_Vulnerabilities_Log
| where TimeGenerated > datetime(2025-1 -1)
| summarize plugin_vpr_updated_t_max = max(plugin_vpr_updated_t) by asset_hostname_s,
plugin_name_s, port_port_d;
let startDate = datetime(2025-1 -1);
let Months = range dt from startDate to now() step 1 d
| extend MonthStart = startofmonth(dt), MonthEnd = endofmonth(dt)
| summarize by MonthStart, MonthEnd
| extend join_key = 1;
Security_Vulnerabilities_Log
| where TimeGenerated > startDate and severity_s in ("critical", "high")
| join kind = inner (scantimes) on scan_schedule_uuid_s, asset_hostname_s, port_port_d
| join kind = inner (Plugintop) on asset_hostname_s, plugin_name_s, port_port_d
| extend join_key = 1
| join kind = inner (Months) on join_key
| summarize LastSeen = max(last_found_t), FirstSeen = min(first_found_t) by plugin_name_s,
asset_hostname_s, LatestScan, port_port_d, plugin_vpr_updated_t_max, MonthStart,
MonthEnd, severity_s
| where FirstSeen <= MonthEnd and LastSeen >= MonthStart
| extend State = case(
(LastSeen >= MonthStart and LastSeen <= MonthEnd) and (LastSeen < LatestScan), "Closed",
"Opened"
)
I where State == "Opened"
I summarize count() by MonthStart, severity_s
I render columnchart
Počet detekovaných útoků v měsíčním členění
Web_AppUcation_Firewall_Log
| where TimeGenerated > datetime(2024-12-31)
| where (isnotempty(attack_type_s) and attack_type_s != "N/A") or request_status_s == "blocked"
| summarize AttackCount= count() by Month = startofmonth(TimeGenerated)
| order by Month asc
| render timechart
Rozdělení útoků podle typu a jejich blokování
Web_AppUcation_Firewall_Log
| where TimeGenerated >= datetime(2024-12-31)
| where isnotempty(attack_type_s) and attack_type_s != "N/A"
| summarize
BlockedAttacks = countif(request_status_s == "blocked"),
AllowedAttacks = countif(request_status_s != "blocked")
by attack_type_s
| project attack_type_s, BlockedAttacks, AllowedAttacks, TotalAttacks = BlockedAttacks +
AllowedAttacks
| order by TotalAttacks desc
Počet unikátních IP adres
Web_Application_Firewall_Log
| where TimeGenerated > datetime(2024-12-31)
| where isnotempty(ip_client_s) and ip_client_s != "N/A"
| summarize UniquelPs = dcount(ip_client_s) by Month = startofmonth(TimeGenerated)
| render timechart
IP adresy podle počtu nebezpečných požadavků
Web_AppUcation_Firewall_Log
I where TimeGenerated > datetime(2025-1 -1)
| where request_status_s == "blocked" or (isnotempty(attack_type_s) and attack_type_s != "N/A")
| where isnotempty(ip_client_s) and ip_client_s != "N/A"
| summarize count() by ip_client_s, Month = startofmonth(TimeGenerated)
| order by count_ desc
Vývoj akcífirewallu podle typu v čase
CommonSecurityLog
| where TimeGenerated >= datetime(2025-01-01)
| where isnotempty(DeviceAction)
| summarize count() by DeviceAction, bin(TimeGenerated, startofmonth(TimeGenerated))
| render columnchart
Měsíční objem síťového provozu
CommonSecurityLog
| where TimeGenerated >= datetime(2025-01-01)
| summarize InGb = sum(ReceivedBytes)/1000000,
OutGb = sum(SentBytes)/1000000
by Month = startofmonth(TimeGenerated)
| order by Month asc
| render timechart
Seznam nejčastěji blokovaných aktivit
CommonSecurityLog
| where TimeGenerated >= datetime(2025-01-01) and DeviceAction == "Drop"
I summarize count_ = count() by Activity
I order by count_ desc
Nejčastěji blokovaní uživatelé
CommonSecurityLog
I where TimeGenerated >= datetime(2025-01-01) and DeviceAction == "Drop"
| summarize count_ = count() by SourceUserName
| order by count_ desc
Blokace provozu dle úrovně závažnosti
CommonSecurityLog
| where TimeGenerated > datetime(2025-1 -1)
| where LogSeverity in ("High", "Very-High", "Medium", "Low", "Unknown")
I summarize
Total = count(),
Dropped = countif(DeviceAction == "Drop")
by LogSeverity
| order by LogSeverity desc
Měsíční výskyt událostí dle závažnosti
CommonSecurityLog
| where TimeGenerated > datetime(2025-1 -1)
| where LogSeverity inf'High", "Very-High", "Medium")
| summarize count() by LogSeverity, bin(TimeGenerated, startofmonth(TimeGenerated))
| render timechart
Zachycené vysoce rizikové webové aktivity
CommonSecurityLog
I where TimeGenerated > datetime(2025-1 -1)
I where AdditionalExtensions has "app_category=Web"
I where LogSeverity contains "High"
I count