KQL_Jobs/zsSampleData at main · MitchellGulledge3/KQL_Jobs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
// ========================================
// Zscaler NSSWeblog → CommonSecurityLog
// Sample migration job for Sentinel Data Lake
// ========================================

let ZscalerSampleData = datatable(
    TimeGenerated:datetime,
    DeviceVendor:string,
    DeviceProduct:string,
    DeviceVersion:string,
    DeviceEventClassID:string,
    Activity:string,
    LogSeverity:string,
    DeviceAction:string,
    ApplicationProtocol:string,
    SourceIP:string,
    DestinationIP:string,
    DestinationPort:int,
    SourceUserName:string,
    DestinationDnsDomain:string,
    RequestURL:string,
    ReceivedBytes:long,
    SentBytes:long,
    EventOutcome:string,
    DeviceHostname:string,
    DeviceOS:string,
    DeviceType:string,
    CloudName:string,
    Company:string,
    Datacenter:string,
    DatacenterCountry:string,
    RiskScore:int,
    UrlCategory:string,
    Module:string
)
[
datetime(2026-02-09T15:12:10Z), "Zscaler", "NSSWeblog", "5.7", "Allowed", "HTTP Request", "3", "Allowed", "HTTP",
"103.214.223.191", "103.2.116.9", 80, "azure@zs-labs.net", "us-v20.events.data.microsoft.com",
"/filestreamingservice/files/415693a1-fb34-41a6-bf95-e747063c1639",
1048576, 463, "Success", "HYBD-FeBmYJ1oao", "Windows OS", "Zscaler Client Connector",
"zscalertwo.net", "Paul Lopez-Internal", "SYD3", "AU", 0, "General Browsing", "General Browsing"
];

// ========================================
// Project into CommonSecurityLog
// ========================================

ZscalerSampleData
| project
    TimeGenerated,
    DeviceVendor,
    DeviceProduct,
    DeviceVersion,
    DeviceEventClassID,
    Activity,
    LogSeverity,
    DeviceAction,
    ApplicationProtocol,
    SourceIP,
    DestinationIP,
    DestinationPort,
    SourceUserName,
    DestinationDnsDomain,
    RequestURL,
    ReceivedBytes,
    SentBytes,
    EventOutcome,
    DeviceHostname,
    DeviceOS,
    DeviceType,
    // --- CSL Normalized Fields ---
    DeviceName = DeviceHostname,
    Computer = DeviceHostname,
    Protocol = ApplicationProtocol,
    Action = DeviceAction,
    EventResult = EventOutcome,
    // --- Preserve vendor-specific fields ---
    AdditionalExtensions = strcat(
        "CloudName=", CloudName,
        ";Company=", Company,
        ";Datacenter=", Datacenter,
        ";DatacenterCountry=", DatacenterCountry,
        ";RiskScore=", tostring(RiskScore),
        ";UrlCategory=", UrlCategory,
        ";Module=", Module
    )