{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Firewall\n---\nThis workbook requires the following data connectors:\n\n| Log | Requirements | Steps |\n|:------------- |:-------------|:-----|\n| Windows Firewall | Sentinel connector, DCR, Agent, Firewall log| Install Windows Firewall via AMA connector, Create Windows Firewall DCR, install Azure Monitor Agent (AMA), Enable firewall logging on host|\n| Windows Security Events | Sentinel connector, DCR, Agent | Install Security Events via AMA connector, Create Windows Security Log DCR, install Azure Monitor Agent (AMA) |\n| Azure Signin | Sentinel connector, Diagnostics setting| Create Diagnostics setting for signinlogs|\n\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "24bfb86e-cf14-4585-a8fc-21f1f7f2227a", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] } }, { "id": "7a206eb7-2655-42d5-a7d7-2e42bd04709b", "version": "KqlParameterItem/1.0", "name": "Computers", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "ASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| distinct Computer", "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| summarize arg_max(TimeGenerated, *) by Computer\r\n| project Computer, ['Last update'] = TimeGenerated\r\n| top 10 by ['Last update'] desc \r\n", "size": 4, "title": "Active connected computers (10 most recent firewall log uploads)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Computer", "formatter": 1, "formatOptions": { "showIcon": true } }, "subtitleContent": { "columnMatch": "OSInfo", "formatter": 1, "formatOptions": { "showIcon": true }, "dateFormat": { "formatName": "shortDateTimePattern" } }, "secondaryContent": { "columnMatch": "Last update", "formatter": 6, "formatOptions": { "showIcon": true }, "dateFormat": { "formatName": "shortDateTimePattern" } }, "showBorder": true, "sortCriteriaField": "Last update", "sortOrderField": 2 } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| summarize dcount(Computer), ActiveComputers = makeset(Computer) by bin(TimeGenerated, 15m)", "size": 4, "title": "Active connected computers timeline", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "ySettings": { "min": 0 } } }, "customWidth": "33", "name": "query - 4" }, { "type": 1, "content": { "json": "----\r\n## Firewall events\r\n\r\nGeneral information about firewall port, IP's, protocols and actions" }, "name": "text - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let commonPorts = dynamic({\"443\": \"HTTPS\", \"80\":\"HTTP\", \"3389\":\"RDP\", \"53\":\"DNS\", \"389\":\"LDAP\", \"445\":\"SMB\", \"135\":\"RPC\", \"47001\":\"WinRM\",\"22\":\"ssh\", \"21\": \"ftp\"}); // Set of common portnames\r\nlet param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where isnotempty(DstPortNumber) and (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers)) // Filter given computers from parameter\r\n| summarize Dropped = countif(DvcAction =~ \"Drop\"), Allowed = countif(DvcAction =~ \"Allow\"), Total = count() by tostring(DstPortNumber), NetworkProtocol\r\n| extend portName = iff(commonPorts contains DstPortNumber, commonPorts[DstPortNumber],DstPortNumber)\r\n| sort by Total desc\r\n| project [\"Destination Port\"] = DstPortNumber,['Core Protocol'] = NetworkProtocol , [\"Default Protocol\"] = portName, Total, Allowed, Dropped", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Total", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "Allowed", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "Dropped", "formatter": 4, "formatOptions": { "showIcon": true } } ] } }, "customWidth": "60", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where isnotempty(DstPortNumber) and (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers))// Filter giver computers from parameter\r\n| summarize Allowed = count() by tostring(DstPortNumber)\r\n| sort by Allowed desc\r\n| project DstPortNumber, Allowed", "size": 0, "title": "Allowed Connections by Port", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "40", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let commonPorts = dynamic({\"443\": \"HTTPS\", \"80\":\"HTTP\", \"3389\":\"RDP\", \"53\":\"DNS\", \"389\":\"LDAP\", \"445\":\"SMB\", \"135\":\"RPC\", \"47001\":\"WinRM\",\"22\":\"ssh\", \"21\": \"ftp\"}); // Set of common portnames\r\nlet param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where isnotempty(DstPortNumber) and isnotempty(DstPortNumber) and (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers))// Filter giver computers from parameter\r\n| summarize Allowed = count() by tostring(DstPortNumber)\r\n| extend portName = iff(commonPorts contains DstPortNumber, commonPorts[DstPortNumber],DstPortNumber)\r\n| sort by Allowed desc\r\n| project portName, Allowed", "size": 0, "title": "Piechart by protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let commonPorts = dynamic({\"443\": \"HTTPS\", \"80\":\"HTTP\", \"3389\":\"RDP\", \"53\":\"DNS\", \"389\":\"LDAP\", \"445\":\"SMB\", \"135\":\"RPC\", \"47001\":\"WinRM\",\"22\":\"ssh\", \"21\": \"ftp\"}); // Set of common portnames\r\nlet param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where isnotempty(DstPortNumber) and (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers))\r\n| extend DstPortNumber = tostring(DstPortNumber)\r\n| extend protocolName = iff(commonPorts has DstPortNumber, commonPorts[DstPortNumber],NetworkProtocol)\r\n| summarize Events = count() by bin(TimeGenerated,30m), protocolName", "size": 0, "title": "Timechart by protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "66", "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where (Computer == param_Computers or param_Computers contains Computer or param_Computers == \"\")\r\n| summarize Events = count() by DvcAction\r\n", "size": 0, "title": "Piechart by firewall action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where (Computer == param_Computers or param_Computers contains Computer or param_Computers == \"\")\r\n| summarize Events = count() by bin(TimeGenerated,30m), DvcAction", "size": 0, "title": "Timechart by firewall action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "66", "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nSecurityEvent\r\n| extend ComputerName = split(Computer, \".\", 0)\r\n| extend ComputerName = tostring (ComputerName[0])\r\n| where AccountType == \"User\" and isnotempty(IpAddress) and (ComputerName == param_Computers or param_Computers contains ComputerName or param_Computers == \"\")\r\n| summarize EventCount = count(), DistinctIPCount = dcount(IpAddress),IPAddresses = makeset(IpAddress) by Account, Computer, ComputerName\r\n| top 10 by DistinctIPCount desc\r\n| extend machineAccount = strcat(Account,\" - \",ComputerName)\r\n| project Account, Computer, ['Distinct IP Count'] = DistinctIPCount, ['Event Count'] = EventCount, IPAddresses", "size": 0, "title": "Windows Security Events by Account", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Distinct IP Count", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "Event Count", "formatter": 4, "formatOptions": { "showIcon": true } } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Account", "formatter": 1 }, "leftContent": { "columnMatch": "Tries", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 8 } }, "name": "query - 11" }, { "type": 1, "content": { "json": "----\r\n## Correlation\r\n\r\nThese visuals give a representation of the Windows firewall, security log and Azure signins events.\r\n\r\nResults below could mean a targeted attack to an organization's private and public cloud.
\r\nThis can also be used to monitor the organization's most used IP's " }, "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers))\r\n| extend SourceIP = tostring (SrcIpAddr)\r\n| summarize FirewallEvents = count() by SourceIP\r\n| join kind = inner(\r\n SigninLogs\r\n | summarize\r\n SuccessAzureLogin = countif(ResultType == 0),\r\n FailedAzureLogin = countif(ResultType != 0)\r\n by SourceIP = IPAddress\r\n )\r\n on SourceIP\r\n| join kind = inner(\r\n SecurityEvent\r\n | extend ComputerName = split(Computer, \".\", 0)\r\n | extend ComputerName = tostring (ComputerName[0])\r\n | where LogonType == 10 \r\n | summarize\r\n SuccessRDPLogin = countif(EventID == 4624),\r\n FailedRDPlogin = countif(EventID == 4625)\r\n by SourceIP = IpAddress, ComputerName\r\n )\r\n on SourceIP\r\n| project\r\n SourceIP,\r\n ComputerName,\r\n ['Firewall events']=FirewallEvents,\r\n ['Success Azure logins']=SuccessAzureLogin,\r\n ['Failed Azure logins']=FailedAzureLogin,\r\n ['Success RDP logins']=SuccessRDPLogin,\r\n ['Failed RDP logins']=FailedRDPlogin\r\n| sort by ['Failed RDP logins'], ['Failed Azure logins'] desc", "size": 1, "title": "Correlating events between Windows firewall, security logs and Azure signins", "noDataMessage": "No links between Windows firewall and Azure logins (positive)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nSecurityEvent\r\n| extend ComputerName = split(Computer, \".\", 0)\r\n| extend ComputerName = tostring (ComputerName[0])\r\n| where AccountType == \"User\" and LogonType == 10 and (ComputerName == param_Computers or param_Computers contains ComputerName or isempty(param_Computers))\r\n| summarize FailedRDPLogins = countif(EventID == 4625), SuccessRDPLogins = countif(EventID == 4624) by IpAddress, Computer, ComputerName\r\n| join kind= inner (\r\n ASimNetworkSessionLogs\r\n | where EventProduct == \"Windows Firewall\"\r\n | extend Computer = split(_ResourceId, \"/\", 8)\r\n | extend Computer = tostring (Computer[0])\r\n | where DstPortNumber == 3389 and (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers))\r\n | summarize FirewallDropped = countif(DvcAction =~ \"Drop\"), FirewallAllowed = countif(DvcAction =~ \"Allow\") by SrcIpAddr\r\n) on $left.IpAddress == $right.SrcIpAddr\r\n| extend SourceIpAddress = IpAddress \r\n| project Computer, SourceIpAddress, FailedRDPLogins, SuccessRDPLogins, FirewallDropped, FirewallAllowed\r\n| sort by SuccessRDPLogins, FailedRDPLogins desc", "size": 0, "title": "Correlating RDP events between Windows firewall and security logs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "FailedRDPLogins", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "SuccessRDPLogins", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "FirewallDropped", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "FirewallAllowed", "formatter": 4, "formatOptions": { "showIcon": true } } ] } }, "customWidth": "50", "name": "query - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let param_Computers = \"{Computers}\";\r\nASimNetworkSessionLogs\r\n| where EventProduct == \"Windows Firewall\"\r\n| extend Computer = split(_ResourceId, \"/\", 8)\r\n| extend Computer = tostring (Computer[0])\r\n| where (Computer == param_Computers or param_Computers contains Computer or isempty(param_Computers)) and SrcIpAddr !in (\"::1\",\"-\")\r\n| summarize FirewallEvents = count() by SrcIpAddr\r\n| join(\r\nSecurityEvent\r\n| extend ComputerName = split(Computer, \".\", 0)\r\n| extend ComputerName = tostring (ComputerName[0])\r\n| where isnotempty(IpAddress) and (ComputerName == param_Computers or param_Computers contains ComputerName or isempty(param_Computers))\r\n| summarize SecurityEvents = count() by SrcIpAddr = IpAddress\r\n) on SrcIpAddr\r\n| top 15 by FirewallEvents desc\r\n| project SrcIpAddr, SecurityEvents, FirewallEvents", "size": 0, "title": "Correlating IPs between Windows firewall and security logs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SecurityEvents", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "FirewallEvents", "formatter": 4, "formatOptions": { "showIcon": true } } ] } }, "customWidth": "50", "name": "query - 13" } ], "styleSettings": {}, "fromTemplateId": "sentinel-WindowsFirewallViaAMA", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }