Network

← All KQL categories

Platform

Network

5 queries tagged with this platform.

• Analytics Rules Detect Vpn Session Without Prior Authentication

  PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.

• Cost & Ingest / Cost By Table Top 10 Common Security Logs By Reason With Cost Enhanced

  Top `CommonSecurityLog` rows by `Reason` and `LogSeverity` (90d), ranked by event count, with an emoji cost-tier column. Filters out empty/`N/A` reasons.

• Cost & Ingest / Cost By Table Top 10 Common Security Logs By Severity With Cost

  Top `CommonSecurityLog` groupings by `DeviceVendor`, `DeviceProduct`, and `LogSeverity` (30d), with numeric `CostUSD`.

• Cost & Ingest / Ingest Trends 30 60 90 Day Common Security Log Ingest Trends

  Compare `CommonSecurityLog` volume by `DeviceAction` across 30-, 60-, and 90-day periods to spot which actions are driving growth.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog

  Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.