Migrating between SIEMs can be broken down to 4 main phases: \r\n- Discovery \r\n- Design \r\n- Implementation \r\n- Operationalize \r\n
\r\n\r\nFor a deeper break down of each phase, please refer to https://docs.microsoft.com/azure/sentinel/migration \r\n\r\nFor a quick comparison between SIEM vendor terminology, please refer to https://docs.microsoft.com/azure/sentinel/migration-security-operations-center-processes#compare-siem-concepts \r\n\r\nFor insights on deploying side-by-side, please refer to https://docs.microsoft.com/azure/sentinel/deploy-side-by-side\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 8" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nNote: Confirm that the correct subscription and workspace are set at the top of the page. \r\n\r\nThis section is meant to view and update the goal tracking for the deployment. To do so:\r\n1. Make sure that the goal tracking Watchlist has been deployed. \r\n\ta. If the Watchlist has not been deployed, please check the Microsoft GitHub repository for the template under MigrationandDeployment. https://github.com/Azure/Azure-Sentinel/tree/master/Watchlists/DeploymentandMigration \r\n\tb. If it is not deployed, click the 'Deploy to Azure' button and complete the process to deploy. Instructions can be found in the readme file in GitHub.\r\n2. Click the 'Edit Deployment Watchlist' button in order to pivot to the Watchlist editor. \r\n3. Make the changes as needed. \r\n4. Click save. \r\n5. Refresh the workbook to reflect the changes. It may take a minute.\r\n\r\nIf filtering by priority is preferred, click on the Priority slider to change the view.\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 9" }, { "type": 1, "content": { "json": "# Your current deployment score is {CompletionScore} out of 100", "style": "info" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1a5a22f5-0c62-42cc-bd5c-9d486e9bb3fd", "version": "KqlParameterItem/1.0", "name": "Prioritize", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Action\", \"label\": \"Action\"},\r\n {\"value\": \"Priority\", \"label\": \"Priority\", \"selected\":true}\r\n]", "timeContext": { "durationMs": 86400000 }, "value": "Action" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('Deployment')\r\n| project Priority, Category, Action, Status, LastUpdate, Blocked, CompletionDate\r\n| sort by Priority asc", "size": 2, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Completed", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "In progress", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Started", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Blocked", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "No", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Yes", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Category" ] } }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Prioritize", "comparison": "isEqualTo", "value": "Action" }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('Deployment')\r\n| project Priority, Category, Action, Status, LastUpdate, Blocked, CompletionDate\r\n| sort by Priority asc", "size": 2, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Completed", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "In progress", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Started", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Blocked", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "No", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Yes", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Priority" ] } }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Prioritize", "comparison": "isEqualTo", "value": "Priority" }, "name": "query - 0 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "30afdc11-a79b-4262-b79c-233275d989f1", "linkTarget": "OpenBlade", "linkLabel": "Edit Deployment Watchlist", "style": "primary", "bladeOpenContext": { "bladeName": "EditWatchlist.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "parameter", "value": "subscriptionId" }, { "name": "resourceGroup", "source": "parameter", "value": "InternalRG" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" }, { "name": "watchlistAlias", "source": "static", "value": "Deployment" }, { "name": "itemsSearchKey", "source": "static", "value": "Action" }, { "name": "allWatchlistItemsCount", "source": "parameter", "value": "WatchlistCount" }, { "name": "isLargeWatchlistFeatureEnabled", "source": "static", "value": "false" }, { "name": "isConfidential", "source": "static", "value": "false" } ] } } ] }, "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('Deployment')\r\n| extend StartDate = datetime(01/15/2022 00:00:00)\r\n| where LastUpdatedTimeUTC between(StartDate .. now())\r\n| summarize count() by Action, bin(todatetime(CompletionDate), 1d)\r\n\r\n", "size": 0, "title": "Completed Tasks Over {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Action", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "CompletionDate" } }, "name": "query - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Summary of Progress", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize by DataType\r\n| sort by DataType asc", "size": 0, "title": "Data Tables Configured", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 500, "filter": true } }, "customWidth": "15", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| distinct DataType\r\n| summarize count()", "size": 4, "title": "Total Data Sources Reporting", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "card", "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "15", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize LastLog = arg_max(TimeGenerated, *), Count = count() by DataType\r\n| project DataType, Count, LastLog\r\n| sort by Count desc", "size": 0, "title": "Number of Logs per Table Over {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "blueOrange" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blueOrange" } } ], "filter": true } }, "customWidth": "60", "name": "query - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "d6c87839-0036-4c48-9898-d4ecdc79394a", "version": "KqlParameterItem/1.0", "name": "ActiveRules", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-10-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.properties.enabled\",\"columnid\":\"Enabled\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "10", "name": "Analytic rules - Parameter" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ActiveRules = print Enabled = dynamic({ActiveRules});\r\nActiveRules\r\n| mv-expand Enabled\r\n| summarize count() by tostring(Enabled)", "size": 4, "title": "Active Rules - Enabled", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "false", "color": "red" }, { "seriesName": "true", "color": "blue" } ] } }, "customWidth": "20", "name": "ActiveRules - Enabled" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ActiveRules = print Enabled = dynamic({ActiveRules});\r\nActiveRules\r\n| mv-expand Enabled\r\n| count", "size": 4, "title": "Active Rules", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "15", "name": "ActiveRules - Total" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources | where type == \"microsoft.insights/workbooks\" | extend Name = tostring(properties.displayName) | where Name has tostring('{Workspace:name}')| extend Name = properties.displayName | where Name has 'Intro to KQL' | summarize count() | extend Workbook = 'Intro to KQL'| extend isEnabled = iff(count_ > 0, 'True', 'False')\r\n| union (resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Advanced KQL for Microsoft Sentinel' | summarize count() | extend Workbook = 'Advanced KQL for Microsoft Sentinel' | extend isEnabled = iff(count_ > 0, 'True', 'False')),(resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Azure AD Sign-in Logs' | summarize count() | extend Workbook = 'Azure AD Sign-in Logs' | extend isEnabled = iff(count_ > 0, 'True', 'False')) | project Workbook, isEnabled\r\n", "size": 1, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "greenDark", "text": "True" }, { "operator": "==", "thresholdValue": "0", "representation": "redBright", "text": "False" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ] }, "sortBy": [] }, "customWidth": "33", "conditionalVisibility": { "parameterName": "test", "comparison": "isEqualTo", "value": "1" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.sourceId | where Name has '{Workspace:name}' | extend Name = properties.displayName | where Name has 'Data Collection health monitoring' | summarize count() | extend Workbook = 'Data collection health monitoring' | extend isEnabled = iff(count_ > 0, 'True', 'False') \r\n| union (resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Insecure Protocols' | summarize count() | extend Workbook = 'Insecure Protocols' | extend isEnabled = iff(count_ > 0, 'True', 'False')),(resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Investigation Insights' | summarize count() | extend Workbook = 'Investigation Insights' | extend isEnabled = iff(count_ > 0, 'True', 'False')) | project Workbook, isEnabled\r\n", "size": 1, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ] } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "test", "comparison": "isEqualTo", "value": "1" }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.sourceId | where Name has '{Workspace:name}' | extend Name = properties.displayName | where Name has 'Microsoft Sentinel Cost' | summarize count() | extend Workbook = 'Microsoft Sentinel Cost' | extend isEnabled = iff(count_ > 0, 'True', 'False')\r\n| union (resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Security Operations Efficiency' | summarize count() | extend Workbook = 'Security Operations Efficiency' | extend isEnabled = iff(count_ > 0, 'True', 'False')), (resources | where type == \"microsoft.insights/workbooks\" | extend Name = properties.displayName | where Name has 'Workspace Usage Report' | summarize count() | extend Workbook = 'Workspace Usage Report' | extend isEnabled = iff(count_ > 0, 'True', 'False')) | project Workbook, isEnabled", "size": 1, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ] } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "test", "comparison": "isEqualTo", "value": "1" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let RecommendedWorkbooks = datatable(Workbook:string)\r\n['Intro to KQL', \r\n'Advanced KQL for Microsoft Sentinel',\r\n'Azure AD Sign-in Logs',\r\n'Data collection health monitoring',\r\n'Insecure Protocols',\r\n'Investigation Insights',\r\n'Microsoft Sentinel Cost',\r\n'Security Operations Efficiency',\r\n'Workspace Usage Report',\r\n'Insider Risk Management',\r\n'SOC Process Framework',\r\n'Zero Trust (TIC 3.0)'\r\n];\r\nRecommendedWorkbooks", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "test", "comparison": "isEqualTo", "value": "1" }, "name": "RecommendedWorkbook-MainList" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources | where type == \"microsoft.insights/workbooks\" \r\n| extend Name = properties.displayName \r\n| extend Workbook = case(\r\nName has 'Intro to KQL', 'Intro to KQL',\r\nName has 'Advanced KQL for Microsoft Sentinel', 'Advanced KQL for Microsoft Sentinel',\r\nName has 'Azure AD Sign-in Logs', 'Azure AD Sign-in Logs',\r\nName has 'Data collection health monitoring', 'Data collection health monitoring',\r\nName has 'Insecure Protocols', 'Insecure Protocols',\r\nName has 'Investigation Insights' , 'Investigation Insights',\r\nName has 'Microsoft Sentinel Cost', 'Microsoft Sentinel Cost',\r\nName has 'Security Operations Efficiency', 'Security Operations Efficiency',\r\nName has 'Workspace Usage Report' , 'Workspace Usage Report',\r\nName has 'Insider Risk Management', 'Insider Risk Management',\r\nName has 'SOC Process Framework', 'SOC Process Framework',\r\nName has 'Zero Trust (TIC 3.0)', 'Zero Trust (TIC 3.0)', \"Not in list\"\r\n)\r\n| extend isEnabled = iif (Workbook == \"Not in list\" , 'False', 'True' )\r\n| where Workbook != \"Not in list\"\r\n| distinct Workbook, isEnabled\r\n\r\n\r\n\r\n\r\n\r\n", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "test", "comparison": "isEqualTo", "value": "1" }, "name": "RecommendedWorkbook-FindEnabled" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"a16556c1-804a-497f-87ba-54dbc34b30cf\",\"mergeType\":\"leftouter\",\"leftTable\":\"RecommendedWorkbook-MainList\",\"rightTable\":\"RecommendedWorkbook-FindEnabled\",\"leftColumn\":\"Workbook\",\"rightColumn\":\"Workbook\"}],\"projectRename\":[{\"originalName\":\"[RecommendedWorkbook-MainList].Workbook\",\"mergedName\":\"Workbook\",\"fromId\":\"a16556c1-804a-497f-87ba-54dbc34b30cf\"},{\"originalName\":\"[RecommendedWorkbook-FindEnabled].isEnabled\",\"mergedName\":\"isEnabled\",\"fromId\":\"a16556c1-804a-497f-87ba-54dbc34b30cf\"},{\"originalName\":\"[RecommendedWorkbook-FindEnabled].Workbook\"}]}", "size": 0, "title": "Recommended Workbooks Deployed", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "True" }, { "operator": "Default", "thresholdValue": null, "representation": "red", "text": "False" } ] } } ] } }, "showPin": false, "name": "RecommendedWorkbook-Merge" } ] }, "customWidth": "30", "name": "RWorkbooks" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has '{Workspace}'\r\n| summarize count()", "size": 4, "title": "Total Workbooks Deployed", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "10", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.logic/workflows\"\r\n| where resourceGroup == '{InternalRG}'\r\n| summarize count()", "size": 4, "title": "Logic Apps Deployed", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "card", "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "10", "name": "query - 7" } ] }, "name": "Summary", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Deploy" }, "name": "Deployment" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "225f3627-ce8a-41fd-ba3e-727f7034f73f", "version": "KqlParameterItem/1.0", "name": "View", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n {\"value\": \"Monitor\", \"label\": \"Monitor\", \"selected\":true},\r\n {\"value\": \"Configure\", \"label\": \"Configure\"}\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 8" }, { "type": 1, "content": { "json": "### Please note that any deployment performed in this section will apply to the current Microsoft Sentinel instance, it will not apply to a different instance or workspace chosen above.", "style": "warning" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "text - 12" }, { "type": 1, "content": { "json": "### General Best Practices for Migrating Data\r\nFor general recommended practices, please refer to this document on migrating to Microsoft Sentinel: https://docs.microsoft.com/azure/sentinel/migration#migrate-your-data
\r\n\r\n### Splunk\r\n\r\n*Streaming*\r\nIf looking to continuously stream data from Splunk to Microsoft Sentinel, consider using the Splunk app for Microsoft Sentinel: https://splunkbase.splunk.com/app/5312/
\r\n\r\n*Collector Based*\r\nIf collecting data via collectors, migrating those pipelines to Microsoft Sentinel is as simple as deploying and configuring either the Microsoft Monitoring Agent or the Azure Monitoring Agent. Please refer to the following documents: \r\nFor Windows Event: https://docs.microsoft.com/azure/azure-monitor/agents/log-analytics-agent, https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama \r\nFor Syslog/CEF: https://docs.microsoft.com/azure/sentinel/connect-syslog, https://docs.microsoft.com/azure/sentinel/connect-common-event-format \r\n\r\n
\r\n\r\n*API Based*\r\nIf collecting API based data sources, Microsoft Sentinel supports API collection via built-in connectors or custom methods. Please refer to the documents below: \r\nData Collection Endpoints: https://docs.microsoft.com/azure/azure-monitor/essentials/data-collection-endpoint-overview \r\nData Collector API: https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api \r\n\r\n\r\n
\r\n", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "Splunk" }, { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" } ], "name": "text - 13" }, { "type": 1, "content": { "json": "### General Best Practices for Migrating Data\r\nFor general recommended practices, please refer to this document on migrating to Microsoft Sentinel: https://docs.microsoft.com/azure/sentinel/migration#migrate-your-data
\r\n\r\n### QRadar\r\n*Collector Based*\r\nIf collecting data via collectors, migrating those pipelines to Microsoft Sentinel is as simple as deploying and configuring either the Microsoft Monitoring Agent or the Azure Monitoring Agent. Please refer to the following documents: \r\nFor Windows Event: https://docs.microsoft.com/azure/azure-monitor/agents/log-analytics-agent, https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama \r\nFor Syslog/CEF: https://docs.microsoft.com/azure/sentinel/connect-syslog, https://docs.microsoft.com/azure/sentinel/connect-common-event-format \r\n\r\n
\r\n\r\n*API Based*\r\nIf collecting API based data sources, Microsoft Sentinel supports API collection via built-in connectors or custom methods. Please refer to the documents below: \r\nData Collection Endpoints: https://docs.microsoft.com/azure/azure-monitor/essentials/data-collection-endpoint-overview \r\nData Collector API: https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api \r\n\r\n\r\n
", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "QRadar" } ], "name": "text - 18" }, { "type": 1, "content": { "json": "### General Best Practices for Migrating Data\r\nFor general recommended practices, please refer to this document on migrating to Microsoft Sentinel: https://docs.microsoft.com/azure/sentinel/migration#migrate-your-data
\r\n\r\n### ArcSight\r\n*Collector Based*\r\nIf collecting data via collectors, migrating those pipelines to Microsoft Sentinel is as simple as deploying and configuring either the Microsoft Monitoring Agent or the Azure Monitoring Agent. Please refer to the following documents: \r\nFor Windows Event: https://docs.microsoft.com/azure/azure-monitor/agents/log-analytics-agent, https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama \r\nFor Syslog/CEF: https://docs.microsoft.com/azure/sentinel/connect-syslog, https://docs.microsoft.com/azure/sentinel/connect-common-event-format \r\n\r\n
\r\n\r\n*API Based*\r\nIf collecting API based data sources, Microsoft Sentinel supports API collection via built-in connectors or custom methods. Please refer to the documents below: \r\nData Collection Endpoints: https://docs.microsoft.com/azure/azure-monitor/essentials/data-collection-endpoint-overview \r\nData Collector API: https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api \r\n\r\n\r\n
", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "ArcSight" } ], "name": "text - 24" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThe buttons below are programmed to move to the connector pages as needed. To deploy:\r\n1. Click on the button to navigate to the connector page. \r\n2. Once on the connector page, review the steps listed under 'Configuration'. \r\n3. Once performed, data should begin flowing into the workspace. \r\n4. If there are connectors needed that are not listed below, please use the buttons for the connector gallery or Content Hub to deploy the desired connector.\r\n\r\nIf desired, related workbooks and analytic rules can also be deployed by going to the 'Next Steps' tab.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" } ], "name": "text - 19" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Free Tier Connectors", "expandable": true, "expanded": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6a86eb8d-5487-4aad-ae7b-b526e68a249f", "linkTarget": "OpenBlade", "linkLabel": "Open O365 Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Office365" } ] } }, { "id": "d17f28d6-18cf-4986-9db5-d3bd821951f0", "linkTarget": "OpenBlade", "linkLabel": "Open M365D Alerts Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } }, { "id": "56600b70-0e55-433a-be86-b7c561bced8b", "linkTarget": "OpenBlade", "linkLabel": "Open Defender for Cloud Alerts Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSecurityCenter" } ] } }, { "id": "58cc25ab-a9af-4516-99e1-fa22e0637a76", "linkTarget": "OpenBlade", "linkLabel": "Open Azure Activity Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActivity" } ] } } ] }, "customWidth": "30", "name": "links - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SharePoint = (OfficeActivity | where OfficeWorkload has 'SharePoint' | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'SharePoint' | project Table, isEnabled);\r\nlet Exchange = (OfficeActivity | where OfficeWorkload has 'Exchange' | summarize count()| extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'Exchange' | project Table, isEnabled);\r\nlet Teams = (OfficeActivity | where OfficeWorkload has 'MicrosoftTeams' | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False')| extend Table = 'Teams' | project Table, isEnabled);\r\nlet OneDrive = (OfficeActivity | where OfficeWorkload has 'OneDrive' | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False')| extend Table = 'OneDrive' | project Table, isEnabled);\r\nlet AA = (AzureActivity | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'AzureActivity' | project Table, isEnabled);\r\nlet DFC = (SecurityAlert | where ProviderName has 'Azure Security Center' | summarize count() | extend Table = 'Defender for Cloud Alerts' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet MCAS = (SecurityAlert | where ProviderName has 'MCAS' | summarize count() | extend Table = 'Defender for Cloud Apps Alerts' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet MDE = (SecurityAlert | where ProviderName has 'MDATP' | summarize count() | extend Table = 'Defender for Endpoint Alerts' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet MDO = (SecurityAlert | where ProviderName has 'OATP' | summarize count() | extend Table = 'Defender for Office Alerts' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet MDI = (SecurityAlert | where ProviderName has 'Azure Advanced Threat Protection' | summarize count() | extend Table = 'Defender for Identity Alerts' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nSharePoint\r\n| union Exchange, Teams, OneDrive, AA, DFC, MCAS, MDE, MDO, MDI\r\n| order by Table asc\r\n", "size": 0, "title": "Free Tier Connector Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ] } }, "customWidth": "70", "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "FT" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9fcd36a1-758b-46c0-b01d-f70f4e201a7b", "version": "KqlParameterItem/1.0", "name": "link", "type": 1, "value": "id/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 25" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Paid Tier Connectors", "expandable": true, "expanded": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "5252e79e-711f-4d8c-9194-c0d57f2dc226", "linkTarget": "OpenBlade", "linkLabel": "Open Microsoft Entra ID", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActiveDirectory" } ] } }, { "id": "423b442c-2f11-4e52-93af-a4dc16f210c2", "linkTarget": "OpenBlade", "linkLabel": "Open Windows Security Event (MMA)", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "SecurityEvents" } ] } }, { "id": "6c550017-1ddb-48a5-97e5-a2147b61ce52", "linkTarget": "OpenBlade", "linkLabel": "Open Windows Security Event (AMA)", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsSecurityEvents" } ] } }, { "id": "d830f81b-0d4c-4b9b-b9e9-0abc967122ab", "linkTarget": "OpenBlade", "linkLabel": "Open M365D Hunting Logs", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } }, { "id": "6593338e-58f1-4846-a607-d8b855720373", "linkTarget": "OpenBlade", "linkLabel": "Open Syslog", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Syslog" } ] } }, { "id": "05e7166b-f040-49a8-b610-9297f384e7e7", "linkTarget": "OpenBlade", "linkLabel": "Open CEF", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } }, { "id": "096e5ed0-d98c-43c6-92fc-79a583560027", "linkTarget": "OpenBlade", "linkLabel": "Open TAXII Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligenceTaxii" } ] } }, { "id": "12fa4f98-6fa5-4954-90d5-1889fd34119a", "linkTarget": "OpenBlade", "linkLabel": "Open TIP Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligence" } ] } }, { "id": "14c5e4c1-a15f-44c3-809d-b48ef872f16c", "linkTarget": "OpenBlade", "linkLabel": "Open Connector Gallery", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorsBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "86825f88-45e6-45fa-9b23-2b95b32a3416", "linkTarget": "OpenBlade", "linkLabel": "Open Content Hub", "style": "primary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "static", "value": "{Subscription:id}" }, { "name": "resourceGroup", "source": "static", "value": "{Workspace:resourcegroup}" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" } ] } } ] }, "customWidth": "30", "name": "links - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SignIns = (SigninLogs | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'SigninLogs' | project Table, isEnabled);\r\nlet Audits = (AuditLogs | summarize count()| extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'AuditLogs' | project Table, isEnabled);\r\nlet NonInt = (AADNonInteractiveUserSignInLogs | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False')| extend Table = 'AADNonInteractive' | project Table, isEnabled);\r\nlet SPS = (AADServicePrincipalSignInLogs | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False')| extend Table = 'Service Princpal Sign-in' | project Table, isEnabled);\r\nlet SPR = (AADServicePrincipalRiskEvents | summarize count() | extend isEnabled = iff(count_ > 0, 'True', 'False') | extend Table = 'Service Principal Risk Events' | project Table, isEnabled);\r\nlet PL = (AADProvisioningLogs | summarize count() | extend Table = 'Provisioning logs' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet MI = (AADManagedIdentitySignInLogs | summarize count() | extend Table = 'Managed Identity logs' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet ADFS = (ADFSSignInLogs | summarize count() | extend Table = 'ADFS Sign-ins' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet UR = (AADUserRiskEvents | summarize count() | extend Table = 'User Risk Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet RU = (AADRiskyUsers | summarize count() | extend Table = 'Risky User Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet SE = (SecurityEvent | summarize count() | extend Table = 'Windows Security Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet WE = (WindowsEvent | summarize count() | extend Table = 'Windows Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet SL = (Syslog | summarize count() | extend Table = 'Syslog' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet CS = (CommonSecurityLog | where DeviceVendor has 'Cisco' | summarize count() | extend Table = 'Cisco' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet CP = (CommonSecurityLog | where DeviceVendor has 'Check Point' | summarize count() | extend Table = 'Check Point' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet PA = (CommonSecurityLog | where DeviceVendor has 'Palo Alto' | summarize count() | extend Table = 'Palo Alto' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet F5 = (CommonSecurityLog | where DeviceVendor has 'F5' | summarize count() | extend Table = 'F5' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet FT = (CommonSecurityLog | where DeviceVendor has 'Fortinet' | summarize count() | extend Table = 'Fortinet' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet BC = (CommonSecurityLog | where DeviceVendor has 'Barracuda' | summarize count() | extend Table = 'Barracuda' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet EH = (CommonSecurityLog | where DeviceVendor has 'ExtraHop' | summarize count() | extend Table = 'ExtraHop' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet OI = (CommonSecurityLog | where DeviceVendor has 'OneIdentity' | summarize count() | extend Table = 'OneIdentity' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet ZS = (CommonSecurityLog | where DeviceVendor has 'Zscaler' | summarize count() | extend Table = 'Zscaler' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet FR = (CommonSecurityLog | where DeviceVendor has 'ForgeRock' | summarize count() | extend Table = 'ForgeRock' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet CA = (CommonSecurityLog | where DeviceVendor has 'CyberArk' | summarize count() | extend Table = 'CyberArk' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet IL = (CommonSecurityLog | where DeviceVendor has 'Illusive' | summarize count() | extend Table = 'Illusive' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet VN = (CommonSecurityLog | where DeviceVendor has 'Vectra Networks' | summarize count() | extend Table = 'Vectra Networks' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet CX = (CommonSecurityLog | where DeviceVendor has 'Citrix' | summarize count() | extend Table = 'Citrix' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DVI = (DeviceInfo | summarize count() | extend Table = 'MDE Device Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DNI = (DeviceNetworkInfo | summarize count() | extend Table = 'MDE Device Network Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DPE = (DeviceProcessEvents | summarize count() | extend Table = 'MDE Device Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DNE = (DeviceNetworkEvents | summarize count() | extend Table = 'MDE Device Network Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DFE = (DeviceFileEvents | summarize count() | extend Table = 'MDE Device File Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DRE = (DeviceRegistryEvents | summarize count() | extend Table = 'MDE Device Registry Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DLE = (DeviceLogonEvents | summarize count() | extend Table = 'MDE Device Logon Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DILE = (DeviceImageLoadEvents | summarize count() | extend Table = 'MDE Device Image Load Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DE = (DeviceEvents | summarize count() | extend Table = 'MDE Device Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet DFCI = (DeviceFileCertificateInfo | summarize count() | extend Table = 'MDE Device File Certifciate Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet EV = (EmailEvents | summarize count() | extend Table = 'MDO Email Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet EUI = (EmailUrlInfo | summarize count() | extend Table = 'MDO Email URL Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet EAI = (EmailAttachmentInfo | summarize count() | extend Table = 'MDO Email Attachment Info' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet EPDE = (EmailPostDeliveryEvents | summarize count() | extend Table = 'MDO Email Post-Delivery Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet ILE = (IdentityLogonEvents | summarize count() | extend Table = 'MDI Logon Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet IQE = (IdentityQueryEvents | summarize count() | extend Table = 'MDI Query Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet IDE = (IdentityDirectoryEvents | summarize count() | extend Table = 'MDI Directory Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet CAE = (CloudAppEvents | summarize count() | extend Table = 'MDCA Cloud App Events' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nlet TI = (ThreatIntelligenceIndicator | summarize count() | extend Table = 'ThreatIntelligenceIndicator' | extend isEnabled = iff(count_ > 0, 'True', 'False') | project Table, isEnabled);\r\nSignIns\r\n| union Audits, NonInt, SPS, SPR, PL, MI, ADFS, UR, RU, SE, WE, SL, CS, CP, PA, F5, FT, BC, EH, OI, ZS, FR, CA, IL, VN, CX, DVI, DNI, DPE, DNE, DFE, DRE, DLE, DILE, DE, DFCI, EV, EUI, ILE, IQE, IDE, CAE, TI\r\n| order by Table asc\r\n", "size": 0, "title": "Commonly Used Paid Tier Connector Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ] } }, "customWidth": "70", "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "PT" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union *\r\n| where TimeGenerated > startofday(ago(31d))\r\n| summarize GBytes = sum(_BilledSize)/(1024*1024*1024) by bin(TimeGenerated, 1d)", "size": 0, "title": "Data Ingestion Over Last {TimeRange}", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRange", "timeBrushExportOnlyWhenBrushed": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 *\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\"second\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by TableName1, _IsBillable\r\n| project ['Table Name'] = TableName1, ['Table Size'] = Size, ['Table Entries'] = Entries,\r\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable, ['Latest Record Created'] = last_log //, ['Latest Record Recieved'] =last_ingestion\r\n | order by ['Table Size'] desc\r\n\r\n ", "size": 0, "showAnalytics": true, "title": "{Workspace:name} Status for {TimeRange:label}, Billable Tables have an average use of: {GiBperday} GiB per day, Billable Tables have a Total size of {GiBtotal} GiB", "timeContextFromParameter": "TimeRange", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Size per Entry", "formatter": 3, "formatOptions": { "min": 0, "palette": "orange" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Latest Record Created", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Time when record was created at data source" } }, { "columnMatch": "Latest Record Recieved", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Time when Record stored in workspace and available for queries" } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "Table Size", "label": "", "comment": "Capacity of the Table" }, { "columnId": "Table Entries", "comment": "Count of Rows in the Table" }, { "columnId": "Size per Entry", "comment": "Capacity of the Rows" }, { "columnId": "IsBillable", "comment": "Is the Table Free or Billable?" } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize by DataType\r\n| sort by DataType asc", "size": 0, "title": "Data Tables Configured", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 500, "filter": true } }, "customWidth": "15", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| distinct DataType\r\n| summarize count()", "size": 0, "title": "Total Data Sources", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "card", "tileSettings": { "showBorder": false } }, "customWidth": "15", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 1" }, { "type": 1, "content": { "json": "----------------------------------------------------------------------------------------------------\r\n\r\n# Health" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SE = SecurityEvent | summarize count() by Computer | extend Table = 'SecurityEvent';\r\nlet SL = Syslog | summarize count() by Computer | extend Table = 'Syslog';\r\nlet CEF = CommonSecurityLog | summarize count() by Computer | extend Table = 'SecurityEvent';\r\nSE\r\n| union SL, CEF\r\n| project Computer, CountofLogs = count_, Table\r\n| order by CountofLogs desc", "size": 0, "title": "SecurityEvents, Syslogs, and CEF Logs by Device", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "CountofLogs", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "rowLimit": 1000, "filter": true } }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where \"{Subscription:Id}\" has subscriptionId or \"{Subscription}\" == \"\"\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' \r\n| extend Server = extract('(.*)/extensions',1,id)\r\n| extend Subscription = extract('(/subscriptions/.*)/resource.*',1,id)\r\n| extend RG = extract('/resourceGroups/(.*)/providers', 1, id)\r\n| where RG == '{InternalRG}'\r\n| summarize count() by Server, subscriptionId, resourceGroup, Subscription\r\n| project Server, resourceGroup, Subscription\r\n| sort by Server asc", "size": 0, "title": "Azure or Arc Machines with MMA in {InternalRG}", "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 500, "filter": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, { "parameterName": "1", "comparison": "isEqualTo", "value": "2" } ], "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'AzureMonitorWindowsAgent' or name has 'AzureMonitorLinuxAgent' \r\n| extend VM = extract('(/subscriptions.*)/extensions',1,id)\r\n| extend Subscription = extract('(/subscriptions/.*)/resource.*',1,id)\r\n| extend RG = extract('/resourceGroups/(.*)/providers', 1, id)\r\n| where RG == '{InternalRG}'\r\n| summarize count() by VM, subscriptionId, resourceGroup, Subscription\r\n| project VM, resourceGroup, Subscription\r\n| sort by VM asc", "size": 0, "title": "Machines with AMA in {InternalRG}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "rowLimit": 500, "filter": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, { "parameterName": "1", "comparison": "isEqualTo", "value": "2" } ], "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"c192961c-800c-454e-b3b4-89c78d390374\",\"mergeType\":\"leftouter\",\"leftTable\":\"query - 1\",\"rightTable\":\"query - 21\",\"leftColumn\":\"Server\",\"rightColumn\":\"Computer\"}],\"projectRename\":[{\"originalName\":\"[query - 1].Server\",\"mergedName\":\"Server\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d390374\"},{\"originalName\":\"[query - 1].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d390374\"},{\"originalName\":\"[query - 1].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d390374\"},{\"originalName\":\"[query - 21].Computer\",\"mergedName\":\"Computer\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d390374\"},{\"originalName\":\"[query - 21].count_\",\"mergedName\":\"count_\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d390374\"},{\"originalName\":\"[query - 21].CountofLogs\",\"mergedName\":\"CountofLogs\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 1].RG\",\"mergedName\":\"RG\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21].Table\",\"mergedName\":\"Table\",\"fromId\":\"unknown\"}]}", "size": 0, "title": "Devices with MMA in {InternalRG}", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "Computer", "formatter": 5 } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "showPin": false, "name": "query - 22" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"c192961c-800c-454e-b3b4-89c78d39037e\",\"mergeType\":\"leftouter\",\"leftTable\":\"query - 2\",\"rightTable\":\"query - 21\",\"leftColumn\":\"VM\",\"rightColumn\":\"Computer\"}],\"projectRename\":[{\"originalName\":\"[query - 2].VM\",\"mergedName\":\"VM\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d39037e\"},{\"originalName\":\"[query - 2].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d39037e\"},{\"originalName\":\"[query - 2].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d39037e\"},{\"originalName\":\"[query - 21].Computer\",\"mergedName\":\"Computer\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d39037e\"},{\"originalName\":\"[query - 21].CountofLogs\",\"mergedName\":\"CountofLogs\",\"fromId\":\"c192961c-800c-454e-b3b4-89c78d39037e\"},{\"originalName\":\"[query - 21].Table\",\"mergedName\":\"Table\",\"fromId\":\"unknown\"}]}", "size": 0, "title": "Devices with AMA in {InternalRG}", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "Computer", "formatter": 5 } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "showPin": false, "name": "query - 23" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' or name has 'AzureMonitorWindowsAgent' or name has 'AzureMonitorLinuxAgent'\r\n| extend RG = extract('/resourceGroups/(.*)/providers', 1, id)\r\n| where RG == '{InternalRG}'\r\n| extend AzureVM = extract('virtualmachines|virtualMachines/(.*)/extensions',1,id), ArcVM = extract('machines/(.*)/extensions',1,id)\r\n| summarize count() by AzureVM=tolower(AzureVM), ArcVM=tolower(ArcVM), subscriptionId, resourceGroup \r\n| extend hasBoth = iff(count_ > 1, 'Yes', 'No') | where count_ > 1 \r\n| join (resources | where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' \r\n| extend AzureVM = extract('virtualmachines|virtualMachines/(.*)/extensions',1,id)) on AzureVM \r\n| project AzureVM, ArcVM, resourceGroup, MMAVersion=name, hasBoth", "size": 0, "title": "Machines with Both Agents Under {InternalRG}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "showPin": false, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{subscriptionId}/resourceGroups/{InternalRG}/providers/Microsoft.Insights/dataCollectionRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2019-11-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"Name\"},{\"path\":\"$..workspaceResourceId\",\"columnid\":\"Workspace\"},{\"path\":\"kind\",\"columnid\":\"OS\"},{\"path\":\"properties.dataFlows[*].streams[0]\",\"columnid\":\"Streams\",\"substringRegexMatch\":\"(Microsoft-)*(\\\\w+)\",\"substringReplace\":\"$2\"},{\"path\":\"$..xPathQueries\",\"columnid\":\"xPath\"},{\"path\":\"location\",\"columnid\":\"Location\"},{\"path\":\"$..facilityNames\",\"columnid\":\"SyslogFacilities\"}]}}]}", "size": 0, "title": "Get all DCRs under {Subscription:label}", "exportedParameters": [ { "fieldName": "Name", "parameterName": "dcrName", "parameterType": 1 }, { "fieldName": "resourceGroup", "parameterName": "resourceGroup", "parameterType": 1 } ], "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "workspace2", "formatter": 5 } ] } }, "conditionalVisibility": { "parameterName": "0", "comparison": "isEqualTo", "value": "0" }, "name": "Get DCRs and associations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.insights/datacollectionrules'\r\n| where resourceGroup == '{InternalRG}'\r\n| extend Subscription = extract('(/subscriptions/.*)/resource.*',1,id)\r\n| project name, Subscription, resourceGroup", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "value::all" ] }, "conditionalVisibility": { "parameterName": "0", "comparison": "isEqualTo", "value": "0" }, "name": "Get DCRs from Graph" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\",\"mergeType\":\"leftouter\",\"leftTable\":\"Get DCRs and associations\",\"rightTable\":\"Get DCRs from Graph\",\"leftColumn\":\"Name\",\"rightColumn\":\"name\"}],\"projectRename\":[{\"originalName\":\"[Get DCRs and associations].Name\",\"mergedName\":\"Name\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].Workspace\",\"mergedName\":\"Workspace\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].OS\",\"mergedName\":\"OS\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].Streams\",\"mergedName\":\"Streams\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].xPath\",\"mergedName\":\"xPath\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].Location\",\"mergedName\":\"Location\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs and associations].SyslogFacilities\",\"mergedName\":\"SyslogFacilities\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs from Graph].id\",\"mergedName\":\"id\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs from Graph].name\",\"mergedName\":\"name\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs from Graph].kind\",\"mergedName\":\"kind\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs from Graph].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"bee4471d-99cc-4c86-9f3a-1e4f0a05e32a\"},{\"originalName\":\"[Get DCRs from Graph].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].type\",\"mergedName\":\"type\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].tenantId\",\"mergedName\":\"tenantId\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].location\",\"mergedName\":\"location\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].managedBy\",\"mergedName\":\"managedBy\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].sku\",\"mergedName\":\"sku\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].plan\",\"mergedName\":\"plan\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].properties\",\"mergedName\":\"properties\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].tags\",\"mergedName\":\"tags\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].identity\",\"mergedName\":\"identity\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].zones\",\"mergedName\":\"zones\",\"fromId\":\"unknown\"},{\"originalName\":\"[Get DCRs from Graph].extendedLocation\",\"mergedName\":\"extendedLocation\",\"fromId\":\"unknown\"}]}", "size": 0, "title": "Select a DCR to view associated VMs", "exportedParameters": [ { "fieldName": "Name", "parameterName": "DCR", "parameterType": 1 }, { "fieldName": "resourceGroup", "parameterName": "DCRrg", "parameterType": 1 } ], "queryType": 7, "gridSettings": { "rowLimit": 1000, "filter": true } }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "Merge - DCRs and RG" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/resourceGroups/{DCRrg}/providers/Microsoft.Insights/dataCollectionRules/{DCR}/associations\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2019-11-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"id\",\"columnid\":\"VMs\",\"columnType\":\"string\",\"substringRegexMatch\":\"(\\\\/subscriptions.*)(\\\\/providers.*|Providers.*)\",\"substringReplace\":\"$1\"}]}}]}", "size": 0, "title": "VMs associated to the selected DCR", "noDataMessage": "No VMs found or no DCR selected above", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "VMs", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true, "bladeOpenContext": { "bladeParameters": [] } } } ] } }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelHealth\r\n| where OperationName has 'data fetch status change' or OperationName has 'data fetch failure summary'\r\n| summarize count() by OperationName, bin(TimeGenerated, 1d)", "size": 0, "title": "Data Connector Changes and Failures Over Last {TimeRange}", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelHealth\r\n| where SentinelResourceType has 'Data connector'\r\n| project TimeGenerated, OperationName, SentinelResourceName, Status, Description\r\n| order by TimeGenerated desc\r\n", "size": 0, "title": "Data Connector Health Logs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true } }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 23" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DC" }, "name": "DC", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d6c87839-0036-4c48-9898-d4ecdc79394a", "version": "KqlParameterItem/1.0", "name": "ActiveRules", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-10-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.properties.enabled\",\"columnid\":\"Enabled\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "pills", "queryType": 12 }, "name": "Analytic rules - Parameter" }, { "type": 1, "content": { "json": "### Splunk\r\n\r\n*General Tips and Guidance*\r\n\r\n- Evaluate and document most important rules \r\n- Review built-in templates and confirm if templates exist for most important rules \r\n- Identify rules that are lower priority or have not generated alerts in last 6 - 12 months \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential rules, consider translating the SPL to KQL. Please see the following resources for assistance:\r\n[SPL to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/SPL to KQL.md) \r\nhttps://uncoder.io/ \r\n\r\nLooking for help on KQL? Deploy the **Intro to KQL workbook** or the **Advanced KQL for Microsoft Sentinel workbook** on the Workbooks tab.\r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-splunk-detection-rules \r\n\r\nFor tips on analyst workflow, please refer to https://docs.microsoft.com/azure/sentinel/migration-security-operations-center-processes\r\n\r\nFor insights on deploying side-by-side, please refer to https://docs.microsoft.com/azure/sentinel/deploy-side-by-side", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "Splunk" }, { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 13" }, { "type": 1, "content": { "json": "### QRadar\r\n\r\n*General Tips and Guidance*\r\n
\r\n- Evaluate and document most important rules \r\n- Review built-in templates and confirm if templates exist for most important rules \r\n- Identify rules that are lower priority or have not generated alerts in last 6 - 12 months \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential rules, consider translating the QRadar to Microsoft Sentinel. Please see the following resources for assistance:\r\n[QRadar to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/Rule%20Logic%20Mappings.md#qradar) \r\nhttps://uncoder.io/ \r\n\r\nLooking for help on KQL? Deploy the **Intro to KQL workbook** or the **Advanced KQL for Microsoft Sentinel workbook** on the Workbooks tab.\r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-qradar-detection-rules \r\n\r\nFor tips on analyst workflow, please refer to https://docs.microsoft.com/azure/sentinel/migration-security-operations-center-processes\r\n\r\nFor insights on deploying side-by-side, please refer to https://docs.microsoft.com/azure/sentinel/deploy-side-by-side", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "QRadar" } ], "name": "text - 14" }, { "type": 1, "content": { "json": "### ArcSight\r\n\r\n*General Tips and Guidance*\r\n
\r\n- Evaluate and document most important rules \r\n- Review built-in templates and confirm if templates exist for most important rules \r\n- Identify rules that are lower priority or have not generated alerts in last 6 - 12 months \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential rules, consider translating ArcSight detections to Microsoft Sentinel. Please see the following resources for assistance:\r\n[ArcSight to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/Rule%20Logic%20Mappings.md#arcsight) \r\nhttps://uncoder.io/ \r\n\r\nLooking for help on KQL? Deploy the **Intro to KQL workbook** or the **Advanced KQL for Microsoft Sentinel workbook** on the Workbooks tab. \r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-arcsight-detection-rules \r\n\r\nFor tips on analyst workflow, please refer to https://docs.microsoft.com/azure/sentinel/migration-security-operations-center-processes\r\n\r\nFor insights on deploying side-by-side, please refer to https://docs.microsoft.com/azure/sentinel/deploy-side-by-side", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "ArcSight" }, { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 19" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThis page is built into multiple sections:\r\n- Analytic rule status\r\n- Detections and incidents\r\n- Connector health\r\n\r\nFor reviewing analytics:\r\n1. Review the list of analytics below. Use the search bar if looking for a single template status. \r\n2. Use the buttons to open the MITRE blade to review coverage or the analytics gallery to deploy the templates of interest. \r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ActiveRules = print Enabled = dynamic({ActiveRules});\r\nActiveRules\r\n| mv-expand Enabled\r\n| count", "size": 4, "title": "Active Rules", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "20", "name": "ActiveRules - Total" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ActiveRules = print Enabled = dynamic({ActiveRules});\r\nActiveRules\r\n| mv-expand Enabled\r\n| summarize count() by tostring(Enabled)", "size": 4, "title": "Active Rules - Enabled", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "false", "color": "red" }, { "seriesName": "true", "color": "blue" } ] } }, "customWidth": "25", "name": "ActiveRules - Enabled" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-10-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.properties.displayName\",\"columnid\":\"RuleName\"},{\"path\":\"$.properties.description\",\"columnid\":\"Description\"},{\"path\":\"$.name\",\"columnid\":\"AlertRuleID\"},{\"path\":\"$.kind\",\"columnid\":\"Kind\"},{\"path\":\"$.properties.productFilter\",\"columnid\":\"ProductName\"},{\"path\":\"$.properties.tactics\",\"columnid\":\"Tactics\"},{\"path\":\"$.properties.enabled\",\"columnid\":\"Status\"},{\"path\":\"$.properties\",\"columnid\":\"prop\"},{\"path\":\"$.properties.tactics\",\"columnid\":\"Tactic\"},{\"path\":\"$.properties.techniques\",\"columnid\":\"Techniques\"}]}}]}", "size": 0, "noDataMessage": "No analytic rules are defined ", "exportedParameters": [ { "fieldName": "AlertRuleID", "parameterName": "AlertRuleID", "parameterType": 1 }, { "fieldName": "ProductName", "parameterName": "ProductName", "parameterType": 1 }, { "fieldName": "Tactics", "parameterName": "Tactics", "parameterType": 1 }, { "fieldName": "RuleName", "parameterName": "RuleName", "parameterType": 1 }, { "fieldName": "Status", "parameterName": "Status", "parameterType": 1 }, { "fieldName": "prop", "parameterName": "prop", "parameterType": 1 }, { "fieldName": "Kind", "parameterName": "Kind", "parameterType": 1 }, { "fieldName": "id", "parameterName": "id", "parameterType": 1 } ], "exportToExcelOptions": "all", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "Kind", "formatter": 1 }, { "columnMatch": "ProductName", "formatter": 5 }, { "columnMatch": "Tactics", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "0ch" } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "enabled" }, { "operator": "==", "thresholdValue": "0", "representation": "disabled", "text": "disabled" }, { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "enabled" } ] } }, { "columnMatch": "prop", "formatter": 5 }, { "columnMatch": "enabled", "formatter": 3, "formatOptions": { "min": 0, "max": 1, "palette": "redGreen", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "enabled", "color": "green" } ] } } } ], "rowLimit": 1000, "filter": true, "sortBy": [ { "itemKey": "RuleName", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "RuleName", "label": "Rule name" }, { "columnId": "AlertRuleID", "label": "Alert rule ID" }, { "columnId": "Kind", "label": "Rule type" }, { "columnId": "ProductName", "label": "Product name" } ] }, "sortBy": [ { "itemKey": "RuleName", "sortOrder": 1 } ], "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "LatLong" } }, "name": "Analytic rules" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "89bacf5f-5a82-4acf-b86c-98f85e8f13c5", "linkTarget": "OpenBlade", "linkLabel": "Open Analytics Blade", "style": "primary", "bladeOpenContext": { "bladeName": "AlertRulesV2Blade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "521d368e-c46e-41b5-bea0-fd07dc96b511", "linkTarget": "OpenBlade", "linkLabel": "Review MITRE Coverage", "style": "primary", "bladeOpenContext": { "bladeName": "MitrePage.ReactView", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "name": "links - 8" }, { "type": 1, "content": { "json": "------------------------------------------------------" }, "name": "text - 12" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThe section below lists the volume of incidents that have been generated and by whom. Use this section to monitor SOC operations and culprits for alerts/incidents.\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| extend Source = case(ProviderName has 'ASI Scheduled Alerts', 'Microsoft Sentinel',\r\n ProviderName has 'MDATP', 'Defender for Endpoint',\r\n ProviderName has 'Azure Security Center', 'Defender for Cloud',\r\n ProviderName has 'Azure Advanced Threat Protection', 'Defender for Identity',\r\n ProviderName has 'OATP', 'Defender for Office',\r\n ProviderName has 'MCAS', 'Defender for Cloud Apps',\r\n ProviderName)\r\n| summarize count() by Source, bin(TimeGenerated, 1d)", "size": 0, "title": "Incident Frequency by Product", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| extend Source = case(ProviderName has 'ASI Scheduled Alerts', 'Microsoft Sentinel',\r\n ProviderName has 'MDATP', 'Defender for Endpoint',\r\n ProviderName has 'Azure Security Center', 'Defender for Cloud',\r\n ProviderName has 'Azure Advanced Threat Protection', 'Defender for Identity',\r\n ProviderName has 'OATP', 'Defender for Office',\r\n ProviderName has 'MCAS', 'Defender for Cloud Apps',\r\n ProviderName)\r\n| summarize Count = count() by DisplayName, Source\r\n| order by Count desc", "size": 0, "title": "Number of Alerts Raised by Product", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Alert Source", "formatter": 1 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "customWidth": "40", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where Status == 'Closed'\n| extend Owner = todynamic(Owner.assignedTo) \n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \n| extend feedback =strcat(Classification,\" \",ClassificationReason)\n| summarize dcount(IncidentNumber) by feedback\n", "size": 1, "title": "Incidents Closed with Classification", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "28", "name": "Incidents by classification - headline" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident \n| summarize arg_max(TimeGenerated,Status, Severity, Owner, AdditionalData) by IncidentNumber\n| extend Owner = todynamic(Owner.assignedTo) \n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \n| summarize dcount(IncidentNumber) by Severity", "size": 1, "title": "Incidents created by severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Classification", "formatter": 1 }, "leftContent": { "columnMatch": "dcount_IncidentNumber", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Informational", "color": "gray" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "red" } ] } }, "customWidth": "28", "name": "By severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SecurityProducts = datatable(ProviderName:string, Product:string, Portal:string)\r\n[\r\n \"ASI Scheduled Alerts\", \"Microsoft Sentinel\", \"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\",\r\n \"MCAS\", \"Microsoft Defender for Cloud Apps\", \"https://portal.cloudappsecurity.com/#/policy\",\r\n \"MDATP\", \"Microsoft Defender for Endpoint\", \"https://security.microsoft.com/alertpolicies\",\r\n \"Azure Security Center\", \"Microsoft Defender for Cloud\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/7\",\r\n \"Detection-WarmPathV2\", \"Microsoft Defender for Cloud\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/7\",\r\n \"MicrosoftThreatProtection\", \"Microsoft 365 Defender\", \"https://security.microsoft.com/alertpolicies\",\r\n \"IPC\", \"Azure Active Directory Identity Protection\", \"https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/UsersAtRiskAlerts\",\r\n \"Detection-Fusion\", \"Machine Learning Fusion Alert\", \"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\",\r\n \"Sentinel Fusion\", \"Machine Learning Fusion Alert\", \"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\",\r\n \"Azure Advanced Threat Protection\", \"Microsoft Defender for Identity\", \"https://portal.atp.azure.com/\",\r\n \"Threat Intelligence Alerts\", \"Threat Intelligence\", \"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\",\r\n \"IoTSecurity\", \"Microsoft Defender for IoT\", \"https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Alerts\",\r\n \"MSTIC\", \"Microsoft Intelligent Security Graph\", \"https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade\",\r\n \"AntimalwarePublisher\", \"Microsoft Anti-Malware\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/7\",\r\n \"OATP\", \"Microsoft Defender for Office 365\", \"https://security.microsoft.com/alertpolicies\",\r\n \"AdaptiveNetworkHardenings\", \"Microsoft Defender for Cloud\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/GenericRecommendationDetailsBlade/assessmentKey/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"StorageThreatDetection\", \"Azure Defender for Storage\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/7\",\r\n \"CloudNetworkSecurity\", \"Azure Network Security\", \"https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview\",\r\n \"SQLThreatDetection\", \"Azure Defender for SQL\", \"https://portal.azure.com/#blade/Microsoft_Azure_Security/SqlVaServersRecommendationDetailsBlade/assessmentKey/82e20e14-edc5-4373-bfc4-f13121257c37\"\r\n];\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| where Status==\"Closed\"\r\n| mv-expand AlertIds\r\n| extend SystemAlertId=strcat(AlertIds)\r\n| join kind=inner (SecurityAlert | extend SystemAlertId=strcat(SystemAlertId)) on SystemAlertId\r\n| summarize\r\n TruePositive = countif(Classification == \"TruePositive\"),\r\n BenignPositive = countif(Classification == \"BenignPositive\"),\r\n FalsePositive = countif(Classification == \"FalsePositive\"),\r\n Undetermined = countif(Classification == \"Undetermined\"),\r\n Total = countif(Classification == \"TruePositive\" or Classification == \"BenignPositive\" or Classification == \"FalsePositive\") by AlertName, ProviderName1\r\n| extend EfficiencyRating = (TruePositive / todouble(Total)) * 100\r\n| join kind=inner(SecurityProducts) on $left.ProviderName1 == $right.ProviderName\r\n| project AlertName, EfficiencyRating, Portal, Product, Total, TruePositive, BenignPositive, FalsePositive, Undetermined\r\n| sort by EfficiencyRating, Total desc\r\n", "size": 0, "showAnalytics": true, "title": "Security Alert Efficiency", "noDataMessage": "No Alerts Observed Within These Thresholds", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "EfficiencyRating", "formatter": 4, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 0 } } }, { "columnMatch": "Portal", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Tune Alert >>", "bladeOpenContext": { "bladeParameters": [] } } }, { "columnMatch": "Product", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Defense Evasion", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "TruePositive", "color": "green" }, { "columnName": "BenignPositive", "color": "orange" }, { "columnName": "FalsePositive", "color": "redBright" } ] } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_EfficiencyRating_1", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_bar_EfficiencyRating_1", "sortOrder": 1 } ] }, "name": "query - 3" }, { "type": 1, "content": { "json": "----------------------------------------------------------------------------------------------------\r\n\r\n# Analytic Rule Health" }, "name": "text - 6" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThis graph lists the number of:\r\n- Runs for scheduled rules\r\n- Runs for NRT rules\r\n- Failures for rules\r\n\r\nThis information can be used to track:\r\n- How many times rules are running\r\n- How many times rules are failing\r\n\r\nDetails around the rules can be used in correlation with the volume of alerts/incidents being generated by Microsoft Sentinel. If the volume is too much, the logs and graph can help pinpoint when it's occurring and which rules are responsible for generating the incidents.", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelHealth\r\n| where SentinelResourceType has 'analytics rule'\r\n| summarize count() by OperationName, bin (TimeGenerated, 1d)", "size": 0, "title": "Analytic Rule Triggering and Failures {TimeRange}", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelHealth\r\n| where SentinelResourceType has 'analytics rule'\r\n| project TimeGenerated, OperationName, Status, SentinelResourceName, Description, Reason, SentinelResourceKind\r\n| order by TimeGenerated desc", "size": 0, "title": "Analytics Health Logs", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query - 18" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "AR" }, "name": "AR" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "225f3627-ce8a-41fd-ba3e-727f7034f73f", "version": "KqlParameterItem/1.0", "name": "View", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Monitor\", \"label\": \"Monitor\", \"selected\":true},\r\n {\"value\": \"Configure\", \"label\": \"Configure\"}\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 8" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\n1. Click on one of the workbook names in the list below. \r\n2. The id will be fetched for opening. \r\n3. Click the 'Open Selected Workbook' button to open the workbook of interest.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| project Workbook, id\r\n| order by Workbook asc", "size": 0, "title": "Current Deployed Workbooks", "exportFieldName": "id", "exportParameterName": "id", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 1000, "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| summarize count()", "size": 0, "title": "Number of Workbooks Deployed", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "30", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "query - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "525e9ce8-b38b-442d-9f59-92211466056d", "version": "KqlParameterItem/1.0", "name": "WorkbookID", "type": 1, "query": "let id = dynamic('{id}');\r\nprint id", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "parameters - 12" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "73ab1852-68e7-45c5-89c9-43fb693758e7", "cellValue": "{WorkbookID}", "linkTarget": "Resource", "linkLabel": "Open Selected Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Monitor" }, "name": "links - 13" }, { "type": 1, "content": { "json": "### Please note that any deployment performed in this section will apply to the current Microsoft Sentinel instance, it will not apply to a different instance or workspace chosen above.", "style": "warning" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "text - 12" }, { "type": 1, "content": { "json": "### Splunk\r\n\r\n*General Tips and Guidance*\r\n
\r\n- Evaluate and document most important dashboards \r\n- Review built-in templates and confirm if templates exist for most important dashboards \r\n- Identify dashboards that are lower priority or are not used frequently \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential dashboards, consider translating the SPL to KQL. Please see the following resources for assistance:\r\n[SPL to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/SPL to KQL.md) \r\nhttps://uncoder.io/ \r\n[Intro to KQL](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/get-hands-on-kql-practice-with-this-microsoft-sentinel-workbook/ba-p/3055600) \r\n[Advanced KQL Framework](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/advanced-kql-framework-workbook-empowering-you-to-become-kql/ba-p/3033766) \r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-convert-dashboards", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "Splunk" }, { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" } ], "name": "text - 10" }, { "type": 1, "content": { "json": "### QRadar\r\n\r\n*General Tips and Guidance*\r\n
\r\n- Evaluate and document most important dashboards \r\n- Review built-in templates and confirm if templates exist for most important dashboards \r\n- Identify dashboards that are lower priority or are not used frequently \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential dashboards, consider translating the items to KQL. Please see the following resources for assistance:\r\n[QRadar to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/Rule%20Logic%20Mappings.md#qradar) \r\nhttps://uncoder.io/ \r\n[Intro to KQL](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/get-hands-on-kql-practice-with-this-microsoft-sentinel-workbook/ba-p/3055600) \r\n[Advanced KQL Framework](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/advanced-kql-framework-workbook-empowering-you-to-become-kql/ba-p/3033766) \r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-convert-dashboards", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "QRadar" } ], "name": "text - 17" }, { "type": 1, "content": { "json": "### ArcSight\r\n\r\n*General Tips and Guidance*\r\n
\r\n- Evaluate and document most important dashboards \r\n- Review built-in templates and confirm if templates exist for most important dashboards \r\n- Identify dashboards that are lower priority or are not used frequently \r\n\r\n[Migrate to Microsoft Sentinel from a SIEM](https://docs.microsoft.com/azure/sentinel/migration#migrate-analytics-rules)
\r\n\r\n\r\n*Translating Existing Rules* \r\nIf there are not templates available for essential rules, consider translating the items to KQL. Please see the following resources for assistance:\r\n[ArcSight to KQL Mapping](https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RuleMigration/Rule%20Logic%20Mappings.md#arcsight) \r\nhttps://uncoder.io/ \r\n[Intro to KQL](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/get-hands-on-kql-practice-with-this-microsoft-sentinel-workbook/ba-p/3055600) \r\n[Advanced KQL Framework](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/advanced-kql-framework-workbook-empowering-you-to-become-kql/ba-p/3033766) \r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-convert-dashboards", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "ArcSight" } ], "name": "text - 19" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nUse this tab to deploy and open key workbooks of interest. Make sure to switch to the 'Monitor' view to see all of the workbooks that are in the environment and to open them. \r\n\r\nTo deploy:\r\n1. Click on the buttons below to open the workbook gallery that is filtered.\r\n2. Click on the workbook.\r\n3. Click save.\r\n4. Return to this workbook.\r\n5. If looking to jump right into the workbook that was deployed, click the 'open' button.\r\n\r\nIf there are any workbooks of interest that are not listed as a button, please use the buttons to open the workbook gallery or Content Hub to deploy the items of interest.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" } ], "name": "text - 18" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Office 365", "expandable": true, "expanded": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "47b9e714-fca9-4e61-8858-dc97f1ab69c7", "linkTarget": "OpenBlade", "linkLabel": "Deploy Exchange Online Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Exchange Online" } ] } }, { "id": "c7a908fa-8b4a-4cd3-88b3-98166607a58a", "linkTarget": "OpenBlade", "linkLabel": "Deploy Sharepoint & OneDrive Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "SharePoint & OneDrive" } ] } }, { "id": "f52ad648-56cb-48c9-aaf1-d59266a4c088", "linkTarget": "OpenBlade", "linkLabel": "Deploy O365 Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Office 365" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "ac9e37bd-ef74-4c4a-a677-d3327a0fb599", "version": "KqlParameterItem/1.0", "name": "ExchangeWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Exchange Online'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "6b111634-564e-4198-b5cf-c3710380f414", "version": "KqlParameterItem/1.0", "name": "SharePointWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'SharePoint & OneDrive'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "32458f16-ace3-4b3b-ba22-8bdad066abd2", "version": "KqlParameterItem/1.0", "name": "O365WB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Office 365'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "858c6ec5-5cc1-49f0-b2df-67b5dbb56bd3", "cellValue": "{ExchangeWB}", "linkTarget": "Resource", "linkLabel": "Open Exchange Online Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "ExchangeWB", "resourceIdsSource": "parameter", "resourceIds": "ExchangeWB", "templateIdSource": "parameter", "templateId": "ExchangeWB", "typeSource": "parameter", "type": "ExchangeWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Log Analytics workspace", "source": "static", "value": "Use Default Resources" } ] } }, { "id": "5e8117e6-c16c-4817-ba0d-1b686e835c69", "cellValue": "{SharePointWB}", "linkTarget": "Resource", "linkLabel": "Open SharePoint and OneDrive Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "SharePointWB", "resourceIdsSource": "parameter", "resourceIds": "SharePointWB", "templateIdSource": "parameter", "templateId": "SharePointWB", "typeSource": "parameter", "type": "SharePointWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "Workspace" } ] } }, { "id": "a017fbcb-6715-4529-aec9-45a11952b434", "cellValue": "{O365WB}", "linkTarget": "Resource", "linkLabel": "Open O365 Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "O365WB", "resourceIdsSource": "parameter", "resourceIds": "O365WB", "templateIdSource": "parameter", "templateId": "O365WB", "typeSource": "parameter", "type": "O365WB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "Workspace" } ] } } ] }, "customWidth": "30", "name": "links - 1" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "O365" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "M365 Defender", "expandable": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "7e266e7b-0456-427b-8965-f16940b195b0", "linkTarget": "OpenBlade", "linkLabel": "Deploy Investigation Insights", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Investigation Insights" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "288b926d-0c74-42b9-8b2c-61f1a0ad1648", "version": "KqlParameterItem/1.0", "name": "IIWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Investigation Insights'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "c5eebe8a-7310-4570-b94b-08668a85fea7", "cellValue": "IIWB", "linkTarget": "Resource", "linkLabel": "Open Investigation Insights", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "IIWB", "resourceIdsSource": "parameter", "resourceIds": "IIWB", "templateIdSource": "parameter", "templateId": "IIWB", "typeSource": "parameter", "type": "IIWB", "gallerySource": "workbook", "locationSource": "default" } } ] }, "customWidth": "30", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "M365D" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Defender for Cloud", "expandable": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "8a1957e6-6731-4df6-970e-2e482b91f4d6", "linkTarget": "OpenBlade", "linkLabel": "Deploy Compliance and Protection", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "ASC Compliance and Protection" } ] } }, { "id": "5d5cf052-f1d1-4e0c-a3c1-a497e39c3d88", "linkTarget": "OpenBlade", "linkLabel": "Deploy AKS Security Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Azure Kubernetes Service (AKS) Security" } ] } }, { "id": "631b3da7-7325-4377-9cd9-7c57bbd1f097", "linkTarget": "OpenBlade", "linkLabel": "Deploy Azure Key Vault Security Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Azure Key Vault Security" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "c78ad33c-49c4-47bc-959d-d61f8edc55b5", "version": "KqlParameterItem/1.0", "name": "CnPWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Compliance and Protection'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "6a4e117d-513a-4f78-995c-700ec94af52e", "version": "KqlParameterItem/1.0", "name": "AKSWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Azure Kubernetes Service'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "052e9502-4e27-4fda-b381-bd375bd7680c", "version": "KqlParameterItem/1.0", "name": "AKVWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Azure Key Vault'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "da2c5acb-c92e-4df9-ae28-64bfe5cc2cb9", "cellValue": "{CnPWB}", "linkTarget": "Resource", "linkLabel": "Open Compliance and Protection", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "CnPWB", "resourceIdsSource": "parameter", "resourceIds": "CnPWB", "templateIdSource": "parameter", "templateId": "CnPWB", "typeSource": "parameter", "type": "CnPWB", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "ab65aed6-e6a9-48fe-ae7c-ecd7a0bb9307", "cellValue": "{AKSWB}", "linkTarget": "Resource", "linkLabel": "Open AKS Security Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "AKSWB", "resourceIdsSource": "parameter", "resourceIds": "AKSWB", "templateIdSource": "parameter", "templateId": "AKSWB", "typeSource": "parameter", "type": "AKSWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Subscription", "source": "parameter", "value": "Subscription" } ] } }, { "id": "843a6432-8204-461a-990f-46aa44849b11", "cellValue": "{AKVWB}", "linkTarget": "Resource", "linkLabel": "Open Azure Key Vault Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "AKVWB", "resourceIdsSource": "parameter", "resourceIds": "AKVWB", "templateIdSource": "parameter", "templateId": "AKVWB", "typeSource": "parameter", "type": "AKVWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "Workspace" } ] } } ] }, "customWidth": "30", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Azure Activity", "expandable": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "debce5b9-cc9b-4df8-8713-9e62f7bcfeec", "linkTarget": "OpenBlade", "linkLabel": "Deploy Azure Activity Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Azure Activity" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "462043cf-5804-4fc9-b6d9-f454de2d7ed9", "version": "KqlParameterItem/1.0", "name": "AAWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Azure Activity'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "f0a589fd-d365-4e67-b8de-94ea6492fbbc", "cellValue": "{AAWB}", "linkTarget": "Resource", "linkLabel": "Open Azure Activity Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "AAWB", "resourceIdsSource": "parameter", "resourceIds": "AAWB", "templateIdSource": "parameter", "templateId": "AAWB", "typeSource": "parameter", "type": "AAWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Resource Group", "source": "parameter", "value": "InternalRG" } ] } } ] }, "customWidth": "30", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Microsoft Entra ID", "expandable": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "b4469f44-ad11-4e8c-bb81-cd138bb30b2a", "linkTarget": "OpenBlade", "linkLabel": "Deploy Azure AD Sign-in Logs Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Azure AD Sign-in logs" } ] } }, { "id": "a4b076fe-a46e-4f93-86f7-0090fdf2fb9b", "linkTarget": "OpenBlade", "linkLabel": "Deploy Azure AD Audit Logs Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Azure AD Audit logs" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "cc63e67f-ea85-49a6-9d95-48ce801d9073", "version": "KqlParameterItem/1.0", "name": "AADSWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Sign-in logs'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "cb98929a-5002-4cb6-8a54-ca868b900bf1", "version": "KqlParameterItem/1.0", "name": "AADAWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Audit Logs'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "ee4d8d9d-20fe-4f6c-bca1-19491c00c23f", "cellValue": "{AADSWB}", "linkTarget": "Resource", "linkLabel": "Open Entra ID Sign-in Logs Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "AADSWB", "resourceIdsSource": "parameter", "resourceIds": "AADSWB", "templateIdSource": "parameter", "templateId": "AADSWB", "typeSource": "parameter", "type": "AADSWB", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "ada780e3-4682-4376-916b-adef870fc196", "cellValue": "{AADAWB}", "linkTarget": "Resource", "linkLabel": "Open Entra ID Audit Logs Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "AADAWB", "resourceIdsSource": "parameter", "resourceIds": "AADAWB", "templateIdSource": "parameter", "templateId": "AADAWB", "typeSource": "parameter", "type": "AADAWB", "gallerySource": "workbook", "locationSource": "default" } } ] }, "customWidth": "30", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Security Events", "expandable": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "50207b45-50b9-46de-abfe-9ae6a4bd784f", "linkTarget": "OpenBlade", "linkLabel": "Deploy Identity and Access Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Identity & Access" } ] } }, { "id": "47c8f4a6-fc0e-4e7e-90cc-769683090c58", "linkTarget": "OpenBlade", "linkLabel": "Deploy Insecure Protocols Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Insecure Protocols" } ] } }, { "id": "743c0e13-3704-404f-a4de-cabe6ee485bd", "linkTarget": "OpenBlade", "linkLabel": "Deploy Windows Firewall Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Windows Firewall" } ] } }, { "id": "32f966c6-193a-40d7-ae21-3e532d3d7a12", "linkTarget": "OpenBlade", "linkLabel": "Deploy Event Analyzer Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Event Analyzer" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "d12df23b-9855-49d3-bf9b-3c1a1a212622", "version": "KqlParameterItem/1.0", "name": "IAWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Identity & Access'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "5f3a41cd-909d-401d-807c-15e0a559a04e", "version": "KqlParameterItem/1.0", "name": "IPWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Insecure Protocols'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "6945e225-45fb-4510-9ed3-3f69cbe31014", "version": "KqlParameterItem/1.0", "name": "WFWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Windows Firewall'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "2a8d85fd-12ac-4451-a602-d2f0db24e153", "version": "KqlParameterItem/1.0", "name": "EAWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Event Analyzer'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "be0a8548-39fb-40e6-94f5-0d341c122998", "cellValue": "{IAWB}", "linkTarget": "Resource", "linkLabel": "Open Identity and Access Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "IAWB", "resourceIdsSource": "parameter", "resourceIds": "IAWB", "templateIdSource": "parameter", "templateId": "IAWB", "typeSource": "parameter", "type": "IAWB", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "Workspace" } ] } }, { "id": "f92f796d-78eb-4365-8435-e41d71a79f7f", "cellValue": "{IPWB}", "linkTarget": "Resource", "linkLabel": "Open Insecure Protocols Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "IPWB", "resourceIdsSource": "parameter", "resourceIds": "IPWB", "templateIdSource": "parameter", "templateId": "IPWB", "typeSource": "parameter", "type": "IPWB", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "9a4fdfcb-05f6-4e1a-a46c-2939354972ab", "cellValue": "{WFWB}", "linkTarget": "Resource", "linkLabel": "Open Windows Firewall Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "WFWB", "resourceIdsSource": "parameter", "resourceIds": "WFWB", "templateIdSource": "parameter", "templateId": "WFWB", "typeSource": "parameter", "type": "WFWB", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "7040815f-dfea-44e6-9fee-9a0d01530362", "cellValue": "{EAWB}", "linkTarget": "Resource", "linkLabel": "Open Event Analyzer Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "EAWB", "resourceIdsSource": "parameter", "resourceIds": "EAWB", "templateIdSource": "parameter", "templateId": "EAWB", "typeSource": "parameter", "type": "EAWB", "gallerySource": "workbook", "locationSource": "default" } } ] }, "customWidth": "30", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Recommended Workbooks", "expandable": true, "expanded": true, "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "f1315142-2222-4a73-9c18-2409ff72d7b3", "linkTarget": "OpenBlade", "linkLabel": "Deploy Security Operations Efficiency", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Security Operations Efficiency" } ] } }, { "id": "cec58a12-3603-4428-9b35-72d4430d6cef", "linkTarget": "OpenBlade", "linkLabel": "Deploy Workspace Usage Report", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Workspace Usage Report" } ] } }, { "id": "10749f0e-e359-413e-a69b-e9263d05199c", "linkTarget": "OpenBlade", "linkLabel": "Deploy Data Collection Health Monitoring", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Data Collection Health Monitoring" } ] } }, { "id": "c5b13ff1-2f91-426b-8d10-e82a40d740cd", "linkTarget": "OpenBlade", "linkLabel": "Deploy Microsoft Sentinel Cost Workbook", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Microsoft Sentinel Cost" } ] } }, { "id": "49fd8232-47c0-45c3-90b5-ed71755b5a5c", "linkTarget": "OpenBlade", "linkLabel": "Deploy Intro to KQL", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Intro to KQL" } ] } }, { "id": "8bc0edac-b0c0-4157-9e94-2cd3fa63be9c", "linkTarget": "OpenBlade", "linkLabel": "Deploy Advanced KQL", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "Advanced KQL for Microsoft Sentinel" } ] } }, { "id": "b26e19db-5dc1-4890-920e-b36bc961c4f8", "linkTarget": "OpenBlade", "linkLabel": "Deploy SOC Process Framework", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "itemNameToOpen", "source": "static", "value": "SOC Process Framework" } ] } }, { "id": "382e867e-5147-4ca0-ac99-fb7b061b1efb", "linkTarget": "OpenBlade", "linkLabel": "Deploy CyberSecurity Maturity Model", "style": "primary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "static", "value": "{Subscription:id}" }, { "name": "resourceGroup", "source": "static", "value": "{Workspace:resourcegroup}" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" } ] } }, { "id": "302c071b-258c-4e27-91ee-0f4386fa36e3", "linkTarget": "OpenBlade", "linkLabel": "Deploy Zero Trust Solution", "style": "primary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "static", "value": "{Subscription:id}" }, { "name": "resourceGroup", "source": "static", "value": "{Workspace:resourcegroup}" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" } ] } }, { "id": "6439828d-b6e9-4c59-bc91-6cfe4612475c", "linkTarget": "OpenBlade", "linkLabel": "Deploy Insider Risk Management", "style": "primary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "static", "value": "{Subscription:id}" }, { "name": "resourceGroup", "source": "static", "value": "{Workspace:resourcegroup}" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" } ] } } ] }, "customWidth": "25", "name": "links - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "c5079bc2-933f-49da-97f5-0a55462924c6", "version": "KqlParameterItem/1.0", "name": "SOCWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Security Operations Efficiency'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "cacce9d4-0b2a-473c-ba0d-ebca1e581c4e", "version": "KqlParameterItem/1.0", "name": "WUWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Workspace Usage Report'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "4a7aac98-d643-4d1c-8eb6-3256dd10c394", "version": "KqlParameterItem/1.0", "name": "MSCWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Microsoft Sentinel Cost'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "62f2d4bd-d98d-4a4a-956a-2881f1328076", "version": "KqlParameterItem/1.0", "name": "DCHWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Data collection health monitoring'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "2b8133ef-032e-4155-835c-98a16a4844c9", "version": "KqlParameterItem/1.0", "name": "KQLWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Intro to KQL'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "17c5f260-f802-4f1c-b005-d541f02b904e", "version": "KqlParameterItem/1.0", "name": "AKQLWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Sentinel Cost'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "fbc180e3-bb37-4db5-a4a0-b59e68624c09", "version": "KqlParameterItem/1.0", "name": "SOCPWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'SOC Process Framework'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "69a975dc-55fa-40af-9b8a-5ea8ef01306d", "version": "KqlParameterItem/1.0", "name": "CMMC", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'CybersecurityMaturityModelCertificationCMMC'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "c9676ae0-6adf-4890-9172-530a2b208fb5", "version": "KqlParameterItem/1.0", "name": "ZTWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'Zerotrust'\r\n| project id\r\n| take 1\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "074f39b0-0b1a-4144-b6e9-5f1965b5b53a", "version": "KqlParameterItem/1.0", "name": "IRMWB", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| where Workbook has 'MicrosoftInsiderRiskManagement'\r\n| project id\r\n| take 1", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "5", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "3702b087-4c72-458c-9e92-6e05721c296c", "cellValue": "{SOCWB}", "linkTarget": "Resource", "linkLabel": "Open Security Operations Efficiency", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "SOCWB", "resourceIdsSource": "parameter", "resourceIds": "SOCWB", "templateIdSource": "parameter", "templateId": "SOCWB", "typeSource": "parameter", "type": "SOCWB", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "99b541d8-7a07-49d4-9672-ede85f670f36", "cellValue": "{WUWB}", "linkTarget": "Resource", "linkLabel": "Open Workspace Usage Report", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "80fd9f6d-8705-4425-b548-595b15adece4", "cellValue": "{DCHWB}", "linkTarget": "Resource", "linkLabel": "Open Data Collection Health Monitoring", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "1b4cd3df-3fd7-4d36-92d8-0f3d1f135523", "cellValue": "{MSCWB}", "linkTarget": "Resource", "linkLabel": "Open Microsoft Sentinel Cost Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "72ce1fd4-f755-4168-b6e7-320f1ba07fdc", "cellValue": "{KQLWB}", "linkTarget": "Resource", "linkLabel": "Open Intro to KQL", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "e15acc74-8031-4cf9-894f-bed15114a80f", "cellValue": "{AKQLWB}", "linkTarget": "Resource", "linkLabel": "Open Advanced KQL", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "26dcc230-eeb5-4942-ba11-e49ec51d94be", "cellValue": "{SOCPWB}", "linkTarget": "Resource", "linkLabel": "Open SOC Process Framework", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "38704821-60bd-4f58-b5dc-475789b96c01", "cellValue": "{CMMC}", "linkTarget": "Resource", "linkLabel": "Open CMMC Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "04b393b0-ae94-4370-ba0f-9d9d64f614e2", "cellValue": "{ZTWB}", "linkTarget": "Resource", "linkLabel": "Open Zero Trust Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true }, { "id": "b480216e-d489-44a0-8927-354049b2c6ad", "cellValue": "{IRMWB}", "linkTarget": "Resource", "linkLabel": "Open Insider Risk Management Workbook", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true } ] }, "customWidth": "50", "name": "links - 2" } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "Recommended" }, { "type": 1, "content": { "json": "## If there is a workbook that is of interest that is not listed above, please refer to the Workbook Gallery or Content Hub." }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "text - 8" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "4c8f6a2b-d1db-49b7-9446-0549adaeece4", "linkTarget": "OpenBlade", "linkLabel": "Go to Workbooks Gallery", "style": "primary", "bladeOpenContext": { "bladeName": "WorkbooksBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "6b6fb692-df3b-4057-8049-32431b7e2450", "linkTarget": "OpenBlade", "linkLabel": "Go to Content Hub", "style": "primary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "static", "value": "{Subscription:id}" }, { "name": "resourceGroup", "source": "static", "value": "{Workspace:resourcegroup}" }, { "name": "workspaceName", "source": "static", "value": "{Workspace:name}" } ] } } ] }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "links - 0" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Wb" }, "name": "Workbooks" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "*General Best Practices* \r\n\r\n- Identify key automation required for operations \r\n- Review out-of-the-box templates for existing coverage \r\n- Recreate automation by using out-of-the-box actions in Playbooks\r\n- Review manual processes that can be transformed by using SOAR\r\n\r\nFor more information and mappings between platforms, please refer to *DOCUMENT LINK HERE WHEN GA* \r\n\r\n*Considerations Post-Migration* \r\n- Test the automation to confirm that it works. \r\n- Periodically review the automations over time to review if new actions are available to make the automation more efficient or strong. \r\n- Monitor automation performance and health using the Playbook Health Workbook. \r\n- Utilize managed identities and service principals to authenticate within the automation. Azure Key Vault can be utilized to store any sercret needed for automation. For more information, see [here](https://docs.microsoft.com/azure/logic-apps/create-managed-service-identity?tabs=consumption) \r\n\r\n*SIEM Based Guidance* \r\n\r\nFor more information on migrating automation from Splunk, please refer to https://docs.microsoft.com/azure/sentinel/migration-splunk-automation\r\nFor more information on migrating automation from QRadar, please refer to https://docs.microsoft.com/azure/sentinel/migration-qradar-automation\r\nFor more information on migrating automation from ArcSight, please refer to https://docs.microsoft.com/azure/sentinel/migration-arcsight-automation\r\n\r\nFor insights on deploying side-by-side, please refer to https://docs.microsoft.com/azure/sentinel/deploy-side-by-side", "style": "info" }, "conditionalVisibility": { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 6" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThis tab lists the deployed playbooks within the resource group as well as which automation rules are deployed and have connected playbooks. \r\n\r\nTo review playbook health:\r\n1. Make sure that the Playbook Health workbook is deployed.\r\n2. Click on the 'Check Playbook Health' button.\r\n3. When the context pane opens, click on Workbook.\r\n4. The workbook will be displayed for usage.\r\n\r\nTo review or deploy new automation resources:\r\n1. Click on the 'Deploy Automation Resources' button to open the Automation blade.\r\n2. Navigate the different tabs to review or deploy automation resources as needed.\r\n\r\nRecommended: Look at the Playbooks Gallery to find out-of-the-box templates that are available.", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.logic/workflows\"\r\n| where resourceGroup == '{InternalRG}'\r\n| extend Name = name\r\n| project Name, ResourceGroup = resourceGroup, Link = id\r\n| sort by Name asc", "size": 0, "title": "Current Deployed Playbooks in {InternalRG}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "id", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true } } ], "rowLimit": 500, "filter": true } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourceGroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/automationRules?api-version=2022-07-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$..displayName\",\"columnid\":\"Name\"},{\"path\":\"$..isEnabled\",\"columnid\":\"Enabled\"},{\"path\":\"$..actionType\",\"columnid\":\"Action\"},{\"path\":\"$..actionConfiguration.logicAppResourceId\",\"columnid\":\"LogicApp\"},{\"path\":\"$..lastModifiedTimeUtc\",\"columnid\":\"Modified\"},{\"path\":\"$..lastModifiedBy.name\",\"columnid\":\"Modifier\"},{\"path\":\"$..createdTimeUtc\",\"columnid\":\"Created\"},{\"path\":\"$..createdBy.name\",\"columnid\":\"Creator\"},{\"path\":\"$..actionConfiguration\",\"columnid\":\"ActionConfig\"}]}}]}", "size": 0, "title": "Automation Rules", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "success", "text": "True" }, { "operator": "==", "thresholdValue": "false", "representation": "4", "text": "False" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "id", "formatter": 7, "formatOptions": { "linkTarget": "Resource", "linkLabel": "Open Resource", "linkIsContextBlade": true, "bladeOpenContext": { "bladeParameters": [] } } } ] } }, "conditionalVisibility": { "parameterName": "2", "comparison": "isEqualTo", "value": "3" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"7503a3dc-3c59-491f-9af0-1e307879130e\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - 0\",\"rightTable\":\"query - 4\",\"leftColumn\":\"Link\",\"rightColumn\":\"LogicApp\"}],\"projectRename\":[{\"originalName\":\"[query - 4].LogicApp\",\"mergedName\":\"LogicApp\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 0].Link\",\"mergedName\":\"Link\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 0].ResourceGroup\",\"mergedName\":\"ResourceGroup\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Name\",\"mergedName\":\"AutomationRule\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Enabled\",\"mergedName\":\"Enabled\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Action\",\"mergedName\":\"Action\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Modified\",\"mergedName\":\"Modified\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Modifier\",\"mergedName\":\"Modifier\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Created\",\"mergedName\":\"Created\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].Creator\",\"mergedName\":\"Creator\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 4].ActionConfig\",\"mergedName\":\"ActionConfig\",\"fromId\":\"7503a3dc-3c59-491f-9af0-1e307879130e\"},{\"originalName\":\"[query - 0].Name\"}]}", "size": 0, "title": "Logic Apps Tied to Automation Rules", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "Link", "formatter": 5 }, { "columnMatch": "ActionConfig", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkLabel": "Additional Details", "linkIsContextBlade": true } } ] } }, "showPin": false, "name": "query - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "39c11cab-7e6e-4c17-91e2-b596b3f72aa2", "version": "KqlParameterItem/1.0", "name": "PlaybookPath", "type": 1, "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.displayName has 'Playbooks health'\r\n| project id", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "698ca8f3-3f97-4b77-a29c-d760df9c35ab", "cellValue": "{PlaybookPath}", "linkTarget": "Resource", "linkLabel": "Check Playbook Health", "subTarget": "Workbook", "style": "primary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "parameter", "componentId": "PlaybookPath", "resourceIdsSource": "parameter", "resourceIds": "PlaybookPath", "templateIdSource": "parameter", "templateId": "PlaybookPath", "typeSource": "parameter", "type": "PlaybookPath", "gallerySource": "workbook", "locationSource": "default" } }, { "id": "ae10c129-5ced-4e14-969c-14ff79304403", "linkTarget": "OpenBlade", "linkLabel": "Deploy Automation Resources", "style": "primary", "bladeOpenContext": { "bladeName": "AutomationBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "name": "links - 1" }, { "type": 1, "content": { "json": "### Please note that any deployment performed in this section will apply to the current Microsoft Sentinel instance, it will not apply to a different instance or workspace chosen above.", "style": "warning" }, "conditionalVisibility": { "parameterName": "View", "comparison": "isEqualTo", "value": "Configure" }, "name": "text - 12" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "LA" }, "name": "Automation" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Instructions\r\n\r\nThis tab lists buttons for managing entity pages as well as a quick glimpse at entity behavior related tables. \r\n\r\nTo configure UEBA: \r\n1. Click on the 'Enable UEBA' button.\r\n2. A context pane will open, click the toggle to 'On'.\r\n3. Select the data sources that should be used for the entity pages.\r\n4. Click save.\r\n\r\nTo customize entity timelines:\r\n1. Click the 'Customize Entity Timeline'.\r\n2. Select a template of interest and go through the deployment wizard.\r\n3. If looking to create custom events, click 'add activity' and complete the wizard process.\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "1327ace5-dfc9-48c9-9ff3-6153ed00bb17", "linkTarget": "OpenBlade", "linkLabel": "Enable UEBA", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "EntityDataSourcesBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "8be12fe8-3cbd-4eb2-a047-e8803fed5303", "linkTarget": "OpenBlade", "linkLabel": "Customize Entity Timeline", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "EntitySettingsBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "static", "value": "EntitySettingsBlade" } ] } } ] }, "name": "links - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let BA = (BehaviorAnalytics | summarize count() | extend Table = 'BehaviorAnalytics' | extend isEnabled = iff(count_ > 0, 'True', 'False'));\r\nlet II = (IdentityInfo | summarize count() | extend Table = 'IdentityInfo' | extend isEnabled = iff(count_ > 0, 'True', 'False'));\r\nlet UAA = (UserAccessAnalytics | summarize count() | extend Table = 'UserAccessAnalytics' | extend isEnabled = iff(count_ > 0, 'True', 'False'));\r\nlet UPA = (UserPeerAnalytics | summarize count() | extend Table = 'UserPeerAnalytics' | extend isEnabled = iff(count_ > 0, 'True', 'False'));\r\nBA \r\n| union II, UAA, UPA\r\n| project Table, isEnabled\r\n| sort by Table asc", "size": 1, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "query - 0" }, { "type": 1, "content": { "json": "## If tables are listed as false:\r\n\r\n- Make sure that the right data sources are enabled that are required for the tables to be ingested.\r\n- Review when UEBA was enabled as certain enrichment tables require a few days to generate data.\r\n- Make sure the time range is set to a higher number. Some tables generate insights on a schedule which may have not been included in a smaller time range.\r\n\r\nFor the IdentityInfo table:\r\n- Changes made to your user profiles in Azure AD are updated in the IdentityInfo table within 15 minutes.\r\n- Group and role information is synchronized between the IdentityInfo table and Azure AD daily.\r\n- Every 21 days, Microsoft Sentinel re-synchronizes with your entire Azure AD to ensure that stale records are fully updated.\r\n- Default retention time in the IdentityInfo table is 30 days.\r\n", "style": "info" }, "name": "text - 2" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "UE" }, "name": "UEBA" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Looking to Migrate Splunk Data? \r\n
General Information: \r\n- [Select a Target Azure Platform to Host Exported Historical Data](https://docs.microsoft.com/azure/sentinel/migration-ingestion-target-platform)\r\n- [Consider Using a Data Ingestion Tool](https://docs.microsoft.com/azure/sentinel/migration-ingestion-tool)\r\n- [Ingest Historical Data into Target Azure Platform](https://docs.microsoft.com/azure/sentinel/migration-export-ingest)\r\n\r\n*Items to Consider:* \r\n- Usage and value of migrated data \r\n- Speed of migrating data \r\n- Available tooling to assist \r\n\r\nTo export Splunk data, use one of the [Splunk export options](https://docs.splunk.com/Documentation/Splunk/8.2.5/Search/Exportsearchresults) \r\n\r\n*CLI Example* \r\n\r\nThis CLI command exports data recorded between 23:59 and 01:00 on September 14, 2021 to a CSV file:\r\n\r\nsplunk search \"index=_internal earliest=09/14/2021:23:59:00 latest=09/16/2021:01:00:00 \" -output csv > c:/data.csv\r\n\r\n*Log Dump Example* \r\n\r\nThis dump command exports data recorded on the specified date to a CSV file:\r\n\r\nindex=bigdata | eval _dstpath=strftime(_time, \"%Y%m%d/%H\") + \"/\" + host | dump basefilename=MyExport format=csv\r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-splunk-historical-data", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "Splunk" } ], "name": "text - 9" }, { "type": 1, "content": { "json": "### Looking to Migrate QRadar Data? \r\n
General Information: \r\n- [Select a Target Azure Platform to Host Exported Historical Data](https://docs.microsoft.com/azure/sentinel/migration-ingestion-target-platform)\r\n- [Consider Using a Data Ingestion Tool](https://docs.microsoft.com/azure/sentinel/migration-ingestion-tool)\r\n- [Ingest Historical Data into Target Azure Platform](https://docs.microsoft.com/azure/sentinel/migration-export-ingest)\r\n\r\n*Items to Consider:* \r\n- Usage and value of migrated data \r\n- Speed of migrating data \r\n- Available tooling to assist \r\n\r\nFollow the steps in these sections to export your historical data to Microsoft Sentinel with [QRadar forwarding destination](https://www.ibm.com/docs/en/qsip/7.5?topic=administration-forward-data-other-systems) \r\n\r\n*Configure QRadar Forwarding Destination* \r\n\r\nConfigure the QRadar forwarding destination, including your profile, rules, and destination address:\r\n1. [Configure a forwarding profile](https://www.ibm.com/docs/en/qsip/7.5?topic=systems-configuring-forwarding-profiles)\r\n2. [Add a forwarding destination](https://www.ibm.com/docs/en/qsip/7.5?topic=systems-adding-forwarding-destinations): \r\n\ta. Set the Event Format to JSON. \r\n\tb. Set the Destination Address to a server that has syslog running on TCP port 5141 and stores the ingested logs to a local folder path. \r\n\tc. Select the forwarding profile created in step 1. \r\n\td. Enable the forwarding destination configuration. \r\n\r\n*Configure Routing Rules* \r\n\r\n1. [Configure routing rules to forward data](https://www.ibm.com/docs/en/qsip/7.5?topic=systems-configuring-routing-rules-forward-data)\r\n2. Set the Mode to Offline.\r\n3. Select the relevant Forwarding Event Processor.\r\n4. Set the Data Source to Events.\r\n5. Select Add Filter to add filter criteria for data that needs to be exported. For example, use the Log Source Time field to set a timestamp range.\r\n6. Select Forward and select the forwarding destination created when you [configured the QRadar forwarding destination in step 2](https://docs.microsoft.com/azure/sentinel/migration-qradar-historical-data?#configure-qradar-forwarding-destination)\r\n7. [Enable the routing rule configuration](https://www.ibm.com/docs/en/qsip/7.5?topic=systems-viewing-managing-routing-rules)\r\n8. Repeat steps 1-7 for each event processor from which you need to export data.\r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-qradar-historical-data\r\n", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "QRadar" } ], "name": "text - 10" }, { "type": 1, "content": { "json": "### Looking to Migrate ArcSight Data? \r\n
General Information: \r\n- [Select a Target Azure Platform to Host Exported Historical Data](https://docs.microsoft.com/azure/sentinel/migration-ingestion-target-platform)\r\n- [Consider Using a Data Ingestion Tool](https://docs.microsoft.com/azure/sentinel/migration-ingestion-tool)\r\n- [Ingest Historical Data into Target Azure Platform](https://docs.microsoft.com/azure/sentinel/migration-export-ingest)\r\n\r\n\r\n*Items to Consider:* \r\n- Usage and value of migrated data \r\n- Speed of migrating data \r\n- Available tooling to assist \r\n\r\n*Event Data Transfer Tool*\r\n\r\n
To flexibly combine your analysis with unstructured data, in addition to the structured CEF data, use Enterprise Security Manager (ESM) events. The Event Data Transfer Tool exports ESM events in three formats: CEF, CSV, and key-value pairs. To export your data with the Event Data Transfer Tool:\r\n\r\n1. [Install and configure the Event Transfer Tool](https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.6/ESM_AdminGuide/#ESM_AdminGuide/EventDataTransfer/EventDataTransfer.htm) \r\n2. Configure the logs export to use a CSV format. For example, this command exports data recorded between 15:45 and 16:45 on May 4, 2016 to a CSV file:\r\n\r\narcsight event_transfer -dtype File -dpath <***path***> -format csv -start \"05/04/2016 15:45:00\" -end \"05/04/2016 16:45:00\"\r\n\r\n*Lacat Utility* \r\n\r\nUse this tool for any volume of data smaller than than a TB. lacat is a simple utility that exports CEF records from a logger archive file, and prints them the records to stdout by design. You can then redirect the records to a file or pipe them for further manipulation, such as grep, awk, and so on. To export data with the lacat utility:\r\n\r\n1. [Download the lacat utility](https://github.com/hpsec/lacat) \r\n2. [Follow the examples in the lacat repository on how to run the script](https://github.com/hpsec/lacat)\r\n\r\nFor the full document, please refer to https://docs.microsoft.com/azure/sentinel/migration-arcsight-historical-data\r\n", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "MigrationTips", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "SIEM", "comparison": "isEqualTo", "value": "ArcSight" } ], "name": "text - 7" }, { "type": 1, "content": { "json": "### Instructions\r\n\r\nThis tab lists tables within the workspace and their current configuration for retention and archive. \r\n\r\nTo configure archive:\r\n1. Click on one one of the tables.\r\n2. A section will appear below, within the box provided enter the desired total retention for the table. \r\n\tNote: Archive retention is found by taking TotalRetention and subtracting WorkspaceRetention. So if a table is set to 400 days of total retention and the workspace is only 90 days, the archive retention will be 310 days.\r\n3. Once the total retention is ready, click 'Update Retention'. \r\n4. A context pane will appear to confirm the changes to be made. If all is set, click 'Update Retention' again.\r\n5. To see the changes, refresh the workbook and view the table again.", "style": "info" }, "conditionalVisibility": { "parameterName": "Instructions", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"Workspace Retention (days)\"},{\"path\":\"$.sku.name\",\"columnid\":\"Workspace Plan\"},{\"path\":\"$.workspaceCapping.dailyQuotaGb\",\"columnid\":\"Workspace Daily Quota (GB)\",\"substringRegexMatch\":\"^-?[1]\\\\d*(\\\\.\\\\d+)?$\",\"substringReplace\":\"None\"}]}}]}", "size": 4, "title": "Current Workspace Settings", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Workspace Retention (days)", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "90", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] }, "tooltipFormat": { "tooltip": "Microsoft Sentinel provides 90 days of data retention for free" } }, { "columnMatch": "Workspace Daily Quota", "formatter": 0, "tooltipFormat": { "tooltip": "You can control your costs by applying a cap to the amount of data that you collect per day" } }, { "columnMatch": "RetentionSetting", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "90", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "WorkspaceRetention", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "90", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, "showBorder": true } }, "name": "query - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**Basic Logs**\r\n\r\nThere are two supported plan types, Analytics and Basic. All tables in your Log Analytics are Analytics tables, by default. \r\n\r\nYou can configure particular tables to use **Basic Logs** at reduced priced that have the following limitations:\r\n- Table retention fixed at 8 days\r\n- Alerts are not supported\r\n- Limited KQL language support\r\n\r\nYou can currently configure the following tables for Basic Logs:\r\n\r\n- All tables created with the Data Collection Rule (DCR)-based custom logs API.\r\n- ContainerLog and ContainerLogV2, which Container Insights uses and which include verbose text-based log records.\r\n- AppTraces, which contains freeform log records for application traces in Application Insights.\r\n\r\n[More Information on Basic Logs](https://docs.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview?WT.mc_id=modinfra-0000-rotrent#log-data-plans-preview)\r\n\r\n[Which tables support Basic Logs?](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1#which-tables-support-basic-logs)\r\n\r\n[Sending Custom Logs](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview)\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Basic" }, "name": "text - 6 - Copy" }, { "type": 1, "content": { "json": "**Data Retention and Archive**\r\n\r\nData in each table in a Log Analytics workspace is retained for a specified period of time after which it's either removed or archived with a reduced retention fee. \r\n\r\n- Set the retention time to balance your requirement for having data available with reducing your cost for data retention.\r\n\r\n[More Information on Data retention and archive](https://docs.microsoft.com/azure/azure-monitor/logs/data-retention-archive)\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Archive" }, "name": "text - 10 - Copy" }, { "type": 1, "content": { "json": "**Search and Restore**\r\n\r\nThis tab shows current Search and Restore Tables. For more information on Search and Restore please refer to:\r\n\r\n[Search across long time spans in large datasets](https://docs.microsoft.com/azure/sentinel/search-jobs)\r\n\r\n[Restore archived logs from search](https://docs.microsoft.com/azure/sentinel/restore)\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Search" }, "name": "text - 6" }, { "type": 1, "content": { "json": "You may receive a \"Could not find column 'TableName' in table 'TableRetentionQuery'\" error below, indicating your workspace doesn't currently have any tables that support Basic Plans. \r\n\r\nFor more information on what tables support Basic Logs please refer to:\r\n\r\n[Which tables support Basic Logs?](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1#which-tables-support-basic-logs)", "style": "info" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Archive" }, "name": "text - 3" } ] }, "conditionalVisibility": { "parameterName": "ShowHelp", "comparison": "isEqualTo", "value": "Yes" }, "name": "Help" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ff66d7b3-6ecd-4d76-9677-7c9496681c58", "version": "KqlParameterItem/1.0", "name": "tablePlanFilter", "label": "Filter by Table Plan and Archive Tier", "type": 10, "isRequired": true, "isGlobal": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"(@.properties.plan=='Basic') || (@.properties.plan=='Analytics')\", \"label\":\"All\", \"selected\":true},\r\n { \"value\":\"(@.properties.plan=='Basic')\", \"label\":\"Basic Logs\"},\r\n { \"value\":\"(@.properties.plan=='Analytics')\", \"label\":\"Analytic Logs\"},\r\n { \"value\":\"(@.properties.archiveRetentionInDays > 0)\", \"label\":\"Archived Tables\"},\r\n { \"value\":\"(@.properties.archiveRetentionInDays == 0)\", \"label\":\"Default Retention Tables\"}\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "eceba9b6-6afa-456c-acf1-fa1e02c3d182", "version": "KqlParameterItem/1.0", "name": "basicTablePlanFilter", "type": 10, "isRequired": true, "isGlobal": true, "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"(@.properties.schema.tableSubType=='DataCollectionRuleBased' || @.properties.schema.name=='AppTraces' || @.properties.schema.name=='ContainerLog' || @.properties.schema.nam=='ContainerLogV2')\", \"label\":\"Supported Basic Logs\", \"selected\":true }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" } ], "exportParameters": true }, "name": "Basic Log Filters" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6431576b-55b8-4ab1-8c44-59f052268f36", "version": "KqlParameterItem/1.0", "name": "tableFilter", "type": 1, "isRequired": true, "isGlobal": true, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "==", "rightValType": "static", "rightVal": "Archive", "resultValType": "param", "resultVal": "tablePlanFilter" } }, { "criteriaContext": { "leftOperand": "Tab", "operator": "==", "rightValType": "static", "rightVal": "Basic", "resultValType": "param", "resultVal": "basicTablePlanFilter" } }, { "criteriaContext": { "operator": "Default", "resultValType": "param", "resultVal": "tablePlanFilter" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Select a table below to update settings", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{InternalRG}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?({tableFilter})]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 4, "title": "Retention settings for All Tables", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "ShowHiddenObjects", "comparison": "isEqualTo", "value": "Yes" }, "name": "TableRetentionQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize arg_max(TimeGenerated, *) by DataType\r\n| project DataType, Quantity, QuantityUnit, IsBillable\r\n| order by DataType asc", "size": 0, "title": "Tables Found in the {WorkspaceName} workspace", "timeContext": { "durationMs": 604800000 }, "exportFieldName": "DataType", "exportParameterName": "DataType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "sortBy": [ { "itemKey": "DataType", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "DataType", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "ShowHiddenObjects", "comparison": "isEqualTo", "value": "Yes" }, "name": "LAWTableQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"DataType\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Quantity\",\"mergedName\":\"TableSize\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].QuantityUnit\",\"mergedName\":\"SizeUnit\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"unknown\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].DataType\"}]}", "size": 1, "noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TableName", "parameterName": "TableName", "parameterType": 1 }, { "fieldName": "TablePlan", "parameterName": "TablePlan", "parameterType": 1 }, { "fieldName": "InteractiveRetention", "parameterName": "InteractiveRetention", "parameterType": 1 }, { "fieldName": "ArchiveRetention", "parameterName": "ArchiveRetention", "parameterType": 1 }, { "fieldName": "TotalRetention", "parameterName": "TotalRetention", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "38.5714ch" } }, { "columnMatch": "TableType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "TablePlan", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "TableSize", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "SizeUnit", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "InteractiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22.8571ch" } }, { "columnMatch": "ArchiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20.8571ch" } }, { "columnMatch": "TotalRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18.2857ch" } }, { "columnMatch": "Last Updated Time", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26ch" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "TotalRetention", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TotalRetention", "sortOrder": 2 } ] }, "name": "query - 9 - Copy" } ], "exportParameters": true }, "name": "TableReport" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{InternalRG}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables/{TableName}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.schema.name\",\"columnid\":\"Name\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.retentionInDays\",\"columnid\":\"InteractiveRetentionPeriod\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionPeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"}]}}]}", "size": 4, "title": "Retention for the {TableName} Table in Days", "showRefreshButton": true, "queryType": 12, "sortBy": [] }, "conditionalVisibility": { "parameterName": "TableName", "comparison": "isNotEqualTo" }, "name": "query - 1" }, { "type": 1, "content": { "json": "You are about to modify the settings of the **{TableName}** table to enable **Archive Logs**.\r\n\r\nThis will modify the **{TableName}** table with a different retention period from the default workspace retntion period of {workspaceRetention} days up to 7 years (2,555 days)\r\n\r\n> **Note:** Tables will inherit the retention of workspace unless changed. \r\n- If a retention is set on a table and the workspace retention is changed, the table retention will not be affected. \r\n- To **reset** the table retention to the workspace retention, select the **Reset Retention** button\r\n- You can access archived data by running a **search job** or **restoring archived logs**\r\n- You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. \r\n", "style": "warning" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "TableName", "comparison": "isNotEqualTo" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ca66bbc0-8300-419d-9baf-2add3c5f2c37", "version": "KqlParameterItem/1.0", "name": "totalRetentionInDays", "label": "Total Retention in Days", "type": 1, "description": "The table's total data retention including archive period. Set this property to null if you don't want to archive data.", "isRequired": true, "value": "100", "timeContext": { "durationMs": 86400000 } } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "conditionalVisibility": { "parameterName": "TableName", "comparison": "isNotEqualTo" }, "name": "parameters - 7", "styleSettings": { "margin": "0px", "padding": "0px" } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d0307859-0760-4b9a-972f-297a5be4efda", "linkTarget": "ArmAction", "linkLabel": "Update Retention", "postText": "", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}", "headers": [], "params": [ { "key": "api-version", "value": "2021-12-01-preview" } ], "body": "{\r\n\t\"properties\":{\r\n\t\t\"retentionInDays\": null,\r\n\t\t\"totalRetentionInDays\": \"{totalRetentionInDays}\"\r\n\t}\r\n}", "httpMethod": "PATCH", "title": "Caution", "description": "## ARM actions can potentially modify resources.\n\n You are updating the **{TableName}** table to the Archive tier with a total retention period of **{totalRetentionInDays} days** \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}", "actionName": "Update Table Retention Settings", "runLabel": "Update Retention" } }, { "id": "c633cc9c-af9a-484e-9a68-a5519ffd6374", "linkTarget": "OpenBlade", "linkLabel": "Update Retenion in UI", "style": "primary", "bladeOpenContext": { "bladeName": "TablesBlade", "extensionName": "Microsoft_OperationsManagementSuite_Workspace", "bladeParameters": [ { "name": "workspaceResourceId", "source": "parameter", "value": "Workspace" } ] } }, { "id": "4a94621f-22d3-4330-8340-5624503fd3ea", "linkTarget": "ArmAction", "linkLabel": "Reset Retention", "style": "secondary", "linkIsContextBlade": true, "armActionContext": { "path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}", "headers": [], "params": [ { "key": "api-version", "value": "2021-12-01-preview" } ], "body": "{\r\n \"properties\": {\r\n \"retentionInDays\": -1,\r\n \"totalRetentionInDays\": -1\r\n }\r\n}", "httpMethod": "PATCH", "title": "Caution", "description": "## ARM actions can potentially modify resources.\n\n You are reseting the **{TableName}** table to the workspace default retention period pf {InteractiveRetention} days \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}", "actionName": "Update Table Retention Settings", "runLabel": "Reset Retention" } } ] }, "customWidth": "25", "conditionalVisibility": { "parameterName": "TableName", "comparison": "isNotEqualTo" }, "name": "links - 4", "styleSettings": { "margin": "0px", "padding": "21px" } } ] }, "name": "Archive" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DM" }, "name": "DM" } ], "fallbackResourceIds": [ "" ], "fromTemplateId": "MicrosoftSentinelDeploymentandMigrationTracker", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }