{
"version": "Notebook/1.0",
"items": [
{
"type": 1,
"content": {
"json": "# User and Entity Behavior Analytics\n---\n\nWelcome to the User and Entity Behavior Analytics workbook. The workbook provides a guided investigation\nfor entities based on open incidents, alerts and anomalies identified by the UEBA engine."
},
"name": "Title Text"
},
{
"type": 1,
"content": {
"json": "> **Refreshed against Microsoft Learn on 2026-08-06.**\n\nThis workbook queries the classic `Anomalies` table populated by [Sentinel UEBA anomaly rules](https://learn.microsoft.com/azure/sentinel/anomalies-reference). Microsoft has since added a **UEBA behaviors layer (preview)** that stores contextual anomaly insights in the separate `BehaviorInfo` table under an `Insights.Explainability[]` array \u2014 see [Investigate anomalies on UEBA behaviors](https://learn.microsoft.com/azure/sentinel/ueba-anomalies-on-behaviors). The two capabilities are complementary; if you've enabled the behaviors layer, extend this workbook with a `BehaviorInfo | where Insights has \"FirstSeen\"` query for richer per-behavior context.\n\nRelated tables worth cross-referencing during investigation: [`IdentityInfo`](https://learn.microsoft.com/azure/sentinel/ueba-reference#identityinfo-table), [`BehaviorAnalytics`](https://learn.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics), [`UserPeerAnalytics`](https://learn.microsoft.com/azure/azure-monitor/reference/tables/userpeeranalytics).", "style": "info"
},
"name": "text - ueba-refresh-notice"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "36cdaf52-4303-405d-ac9c-de2037db99c3",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"label": "Time Range",
"type": 4,
"isRequired": true,
"typeSettings": {
"selectableValues": [
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2592000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
},
"value": {
"durationMs": 1209600000
}
},
{
"id": "c4470c37-5a8a-4ecd-8ece-5e98db8e8a92",
"version": "KqlParameterItem/1.0",
"name": "Help",
"label": "Show Help",
"type": 10,
"description": "This will show some help information to help you understand the page you are on",
"isRequired": true,
"value": "Yes",
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "TimeRangeParameterDefinition"
},
{
"type": 1,
"content": {
"json": "See below how many incidents and alerts were created during the time range selected in the time range picker above. Likewise, you will see the number of Anomalies that were triggered. To learn more about Anomalies, please click [here](https://learn.microsoft.com/azure/sentinel/anomaly-detection-rules).",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "General info help message"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "General Info",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "General Incident Summary",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| where Status == \"New\" or Status == \"Active\"\r\n| summarize IncidentCount=count() \r\n| project \"New or active incidents\", IncidentCount",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Column1"
},
"leftContent": {
"columnMatch": "IncidentCount",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "redDark"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
"showBorder": false,
"size": "auto"
}
},
"customWidth": "12",
"name": "GeneralInfo - Open Incidents",
"styleSettings": {
"maxWidth": "12"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TotalAlertsCount = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| where Status == \"New\" or Status == \"Active\"\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind= innerunique ( \r\nSecurityAlert | where TimeGenerated {TimeRange:query}) on $left.AlertId == $right.SystemAlertId\r\n| where Status != \"Resolved\" or Status != \"Dismissed\" \r\n| summarize hint.strategy = shuffle arg_max(TimeGenerated,*), NumberOfUpdates = count() by SystemAlertId\r\n| summarize AlertCount=count()\r\n| project \"New or active alerts\",AlertCount;\r\nTotalAlertsCount\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Column1",
"formatter": 1
},
"leftContent": {
"columnMatch": "AlertCount",
"formatter": 12,
"formatOptions": {
"palette": "redDark"
}
},
"showBorder": false,
"size": "auto"
}
},
"customWidth": "12",
"name": "GeneralInfo - Alert Count",
"styleSettings": {
"maxWidth": "12"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize AnomalyCount=count()\r\n| project \"Anomaly Count\", AnomalyCount",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Column1",
"formatter": 1
},
"leftContent": {
"columnMatch": "AnomalyCount",
"formatter": 12,
"formatOptions": {
"palette": "redDark"
}
},
"showBorder": false,
"size": "auto"
}
},
"customWidth": "12",
"name": "GeneralInfo - Anomaly Count",
"styleSettings": {
"maxWidth": "12"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TotalAnomaliesCount = Anomalies\r\n| summarize by TenantId, TimeGenerated\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d\r\n| extend series = \"Anomalies Trend\"\r\n| project series, count_, TimeGenerated ;\r\nlet TotalAlertsCount = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| where Status == \"New\" or Status == \"Active\"\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind= innerunique ( \r\nSecurityAlert | where TimeGenerated {TimeRange:query}\r\n) on $left.AlertId == $right.SystemAlertId\r\n| summarize hint.strategy = shuffle arg_max(TimeGenerated,*), NumberOfUpdates = count() by SystemAlertId\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d\r\n| extend series = \"Alerts Trend\"\r\n| project series, count_, TimeGenerated ;\r\nlet TotalIncidentsCount=SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| where Status == \"New\" or Status == \"Active\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d \r\n| extend series = \"Incidents Trend\"\r\n| project series, count_, TimeGenerated;\r\nTotalIncidentsCount | union TotalAlertsCount, TotalAnomaliesCount\r\n\r\n\r\n",
"size": 1,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "linechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Incidents Trend",
"label": "Incidents",
"color": "red"
},
{
"seriesName": "Alerts Trend",
"label": "Alerts",
"color": "orange"
},
{
"seriesName": "Anomalies Trend",
"label": "Anomalies",
"color": "blueDark"
}
]
}
},
"customWidth": "60",
"name": "GeneralInfo - TimeSeries",
"styleSettings": {
"maxWidth": "60"
}
}
]
},
"customWidth": "100",
"name": "General Incident Summary",
"styleSettings": {
"maxWidth": "100"
}
},
{
"type": 1,
"content": {
"json": "Below you will find the total number of anomalies, plus how many of those have an account or an IP entity. Note that we are also counting anomalies that involve known hosts, but these are currently not mapped as entities. The query for \"Anomalies with hosts\" counts the hosts that were parsed out of the following entity enrichments: \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\". See more about these [here](https://learn.microsoft.com/azure/sentinel/ueba-reference).\r\n",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Anomalies help"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Anomaly Summary",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| where TimeGenerated {TimeRange:query}\r\n| count",
"size": 4,
"title": "Total anomalies",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": false
}
},
"customWidth": "20",
"name": "AnomalyInfo - Anomalies"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| where TimeGenerated {TimeRange:query}\r\n| where tostring(Entities) contains '\"Type\":\"account\"'\r\n| count",
"size": 4,
"title": "Anomalies with account entity",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": false
}
},
"customWidth": "20",
"name": "AnomalyInfo - Account Anomaly"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| where TimeGenerated {TimeRange:query}\r\n| where tostring(Entities) contains '\"Type\":\"ip\"'\r\n| count",
"size": 4,
"title": "Anomalies with IP entity",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": false
}
},
"customWidth": "20",
"name": "AnomalyInfo - IP Anomaly"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Currently there is no mapping with hosts\r\n//We know that in the following anomalies there is a host present: \"FirstTimeUserConnectedFromDevice\", \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"FirstTimeDeviceObservedInTenant\", \"DeviceUncommonlyUsedInTenant\"\r\n//We only look for \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\" though since the other two only state PII instead of the host itself\r\nlet Name = dynamic([\"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\"]) ;\r\nAnomalies\r\n| where TimeGenerated {TimeRange:query}\r\n| mv-expand AnomalyReasons\r\n| where tostring(AnomalyReasons.Name) in (Name)\r\n| count",
"size": 4,
"title": "Anomalies with a host",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": false
}
},
"customWidth": "20",
"name": "AnomalyInfo - Host Anomaly"
}
]
},
"name": "Anomaly Summary"
}
]
},
"name": "General Info"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "Below you will find incidents that have entities involved in anomalies created up to 3 days prior to the incident creation.
Expand each entity to find the anomalies. When you click on the anomalies, you will visualize them on the right-hand side.
Finally, click on each of the anomalies to see anomaly reasons and device insights. Note that device insights are empty when there is no relevant information to show.",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Help text for incidents with entities"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TopUsersByAnomalies = Anomalies\r\n | mv-expand Entities\r\n | where tostring(Entities) contains '\"Type\":\"account\"'\r\n | project\r\n TimeGenerated,\r\n AnomalyID = Id,\r\n AadUserId=tostring(Entities.AadUserId),\r\n DisplayName=tostring(Entities.DisplayName),\r\n OriginalName=tostring(Entities.Name),\r\n AnomalyUPNSuffix=tostring(Entities.AnomalyUPNSuffix),\r\n OriginalUPNSuffix=tostring(Entities.UPNSuffix)\r\n | extend\r\n Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName),\r\n UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n | project-away OriginalName; \r\nlet TopIPsByAnomalies= Anomalies\r\n | mv-expand Entities\r\n | where tostring(Entities) contains '\"Type\":\"ip\"'\r\n | project TimeGenerated, IPentity=tostring(Entities.Address), AnomalyID = Id;\r\nlet DeviceAnomalyName = dynamic([\"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\"]);\r\nlet TopHostsByAnomalies =Anomalies\r\n | mv-expand AnomalyReasons\r\n | where tostring(AnomalyReasons.Name) in (DeviceAnomalyName)\r\n | extend DeviceRegex = tostring(extract(\"with ([A-Za-z0-9_.-]+) device\", 1, Description))\r\n | extend DeviceName = tolower(DeviceRegex)\r\n | project-rename AnomalyID = Id;\r\nlet IncidentsWithEntities = SecurityIncident\r\n | summarize TimeGenerated=max(TimeGenerated), AlertIds=make_set(AlertIds) by IncidentNumber, IncidentUrl, Title\r\n | mv-expand AlertIds\r\n | project IncidentNumber, AlertId = tostring(AlertIds), TimeGenerated, IncidentUrl, Title \r\n | join kind = inner ( \r\n SecurityAlert\r\n | distinct SystemAlertId, Entities\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n or Entities[\"Type\"] =~ \"ip\"\r\n or Entities[\"Type\"] =~ \"host\"\r\n | project\r\n SystemAlertId,\r\n IPentity = tostring(tolower(Entities.Address)),\r\n DeviceName = tostring(tolower(Entities.HostName)),\r\n OriginalName = tostring(tolower(Entities.Name)),\r\n OriginalUPNSuffix = tostring(Entities.UPNSuffix),\r\n AadUserId = tostring(Entities.AadUserId)\r\n | extend\r\n Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName),\r\n UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n | project-away OriginalName, OriginalUPNSuffix\r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | distinct\r\n TimeGenerated,\r\n IncidentNumber,\r\n IPentity,\r\n Name,\r\n AadUserId,\r\n DeviceName,\r\n UPNSuffix,\r\n IncidentUrl,\r\n Title\r\n;\r\nlet TopUserIncidents = IncidentsWithEntities\r\n | join kind= inner (TopUsersByAnomalies) on $left.Name == $right.Name\r\n | where datetime_diff('day', TimeGenerated, TimeGenerated1) < 3 and datetime_diff('day', TimeGenerated, TimeGenerated1) > 0\r\n | summarize listOfAnomalyID = make_list(AnomalyID)\r\n by\r\n AadUserId= coalesce(Name, Name1),\r\n DisplayName,\r\n Name= coalesce(Name, Name1),\r\n AnomalyUPNSuffix,\r\n UPNSuffix = coalesce(UPNSuffix, UPNSuffix1),\r\n TimeGenerated,\r\n IncidentNumber,\r\n Title,\r\n IncidentUrl;\r\nlet TopIPIncidents = IncidentsWithEntities\r\n | join kind= inner (TopIPsByAnomalies) on $left.IPentity == $right.IPentity\r\n | where datetime_diff('day', TimeGenerated, TimeGenerated1) < 3 and datetime_diff('day', TimeGenerated, TimeGenerated1) > 0\r\n | summarize listOfAnomalyID = make_list(AnomalyID)\r\n by\r\n IPentity = coalesce(IPentity, IPentity1),\r\n TimeGenerated,\r\n IncidentNumber,\r\n Title,\r\n IncidentUrl;\r\nlet TopHostsIncidents = IncidentsWithEntities\r\n | join kind= inner (TopHostsByAnomalies) on $left.DeviceName == $right.DeviceName\r\n | where datetime_diff('day', TimeGenerated, TimeGenerated1) < 3 and datetime_diff('day', TimeGenerated, TimeGenerated1) > 0\r\n | summarize listOfAnomalyID = make_list(AnomalyID)\r\n by\r\n DeviceName = coalesce(DeviceName, DeviceName1),\r\n TimeGenerated,\r\n IncidentNumber,\r\n Title,\r\n IncidentUrl;\r\nTopUserIncidents\r\n| union TopIPIncidents, TopHostsIncidents\r\n| extend Entity1 = coalesce(Name, AadUserId, IPentity, DeviceName)\r\n| project\r\n TimeGenerated,\r\n IncidentNumber1 = strcat('\ud83d\udcdd', IncidentNumber),\r\n Title,\r\n IncidentUrl,\r\n IPentity,\r\n DeviceName,\r\n AadUserId,\r\n Name, \r\n UPNSuffix,\r\n DisplayName,\r\n Entity = strcat('Entity \ud83d\udd0e', Entity1),\r\n listOfAnomalyID\r\n| sort by TimeGenerated desc",
"size": 0,
"title": "Incidents with entities present in anomalies created in the 3 preceding days",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "listOfAnomalyID",
"exportParameterName": "listOfAnomalyID",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeGenerated",
"formatter": 5
},
{
"columnMatch": "IncidentNumber",
"formatter": 5,
"formatOptions": {
"linkTarget": "Url"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "IncidentUrl",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url"
}
},
{
"columnMatch": "IPentity",
"formatter": 5,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "DeviceName",
"formatter": 5
},
{
"columnMatch": "AadUserId",
"formatter": 5
},
{
"columnMatch": "Name",
"formatter": 5,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "UPNSuffix",
"formatter": 5
},
{
"columnMatch": "DisplayName",
"formatter": 5
},
{
"columnMatch": "Entity",
"formatter": 5
},
{
"columnMatch": "listOfAnomalyID",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "Entity1",
"formatter": 1
},
{
"columnMatch": "AnomalyCount",
"formatter": 5,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"rowLimit": 500,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"IncidentNumber1",
"Entity"
],
"expandTopLevel": true,
"finalBy": "TimeGenerated"
},
"labelSettings": [
{
"columnId": "TimeGenerated",
"label": "Time Generated"
},
{
"columnId": "IncidentNumber1",
"label": "Incident number"
},
{
"columnId": "Title",
"label": "Incident name"
},
{
"columnId": "IncidentUrl",
"label": "Link to incident"
},
{
"columnId": "IPentity",
"label": "IPentity"
},
{
"columnId": "DeviceName",
"label": "DeviceName"
},
{
"columnId": "AadUserId",
"label": "AadUserId"
},
{
"columnId": "Name",
"label": "Name"
},
{
"columnId": "UPNSuffix",
"label": "UPNSuffix"
},
{
"columnId": "DisplayName",
"label": "DisplayName"
},
{
"columnId": "Entity",
"label": "Matching entity"
},
{
"columnId": "listOfAnomalyID",
"label": "List of Anomaly IDs"
}
]
},
"sortBy": []
},
"customWidth": "40",
"name": "Incidents with entities present in anomalies",
"styleSettings": {
"maxWidth": "40"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| where '{listOfAnomalyID}' contains Id\r\n| project Description, AnomalyTemplateName, RuleStatus, RuleName, Score, AnomalyReasons, DeviceInsights",
"size": 1,
"title": "Anomalies of selected incident",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "AnomalyReasons",
"parameterName": "AnomalyReasonsP",
"parameterType": 1
},
{
"fieldName": "DeviceInsights",
"parameterName": "DeviceInsightsP",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Description",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true,
"customColumnWidthSetting": "90%"
}
},
{
"columnMatch": "AnomalyTemplateName",
"formatter": 5,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "RuleStatus",
"formatter": 5
},
{
"columnMatch": "RuleName",
"formatter": 5
},
{
"columnMatch": "Score",
"formatter": 5
},
{
"columnMatch": "AnomalyReasons",
"formatter": 5
},
{
"columnMatch": "DeviceInsights",
"formatter": 5
}
]
},
"sortBy": []
},
"customWidth": "100",
"name": "Anomalies of selected incident",
"styleSettings": {
"maxWidth": "60"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{AnomalyReasonsP}\",\"transformers\":null}",
"size": 4,
"title": "Anomaly Reasons",
"queryType": 8,
"gridSettings": {
"formatters": [
{
"columnMatch": "Value",
"formatter": 1
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "IsAnomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "Yes"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "No"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TypicalObservations",
"formatter": 5
},
{
"columnMatch": "Anomalous?",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"customWidth": "50",
"name": "User Anomalies - AnomalyReasons"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{DeviceInsights}\",\"transformers\":null}",
"size": 4,
"title": "DeviceInsights",
"noDataMessage": "None available",
"queryType": 8
},
"customWidth": "50",
"name": "DeviceInsights"
}
]
},
"customWidth": "60",
"name": "InsideGroupForSelectedEntity",
"styleSettings": {
"maxWidth": "60"
}
}
]
},
"name": "Incidents with anomalies"
},
{
"type": 1,
"content": {
"json": "#### Use the tabs below to see users, IPs and hosts involved in incidents, alerts and anomalies. By selecting one user, IP or host from the list, you will visualize incidents and anomaly details from each one.",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Tabs help"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "3242e20b-3930-4c10-9c08-864eee8921b9",
"cellValue": "rankingTab",
"linkTarget": "parameter",
"linkLabel": "Users",
"subTarget": "Users",
"style": "link"
},
{
"id": "07d94953-ab1a-4d94-a1ac-a49c56370cc7",
"cellValue": "rankingTab",
"linkTarget": "parameter",
"linkLabel": "IPs",
"subTarget": "IPs",
"style": "link"
},
{
"id": "910b02fc-54d3-462a-a27b-dc5bdf2c3302",
"cellValue": "rankingTab",
"linkTarget": "parameter",
"linkLabel": "Hosts",
"subTarget": "Hosts",
"style": "link"
}
]
},
"name": "RankingTabParameterDefinition"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Top users to investigate - by Incidents, alerts & anomalies"
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
},
"name": "UserGroupTopIncidents - Title Text"
},
{
"type": 1,
"content": {
"json": "Click on a user from the list below to view incidents and anomalies where the user is present",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
},
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "UserGroupTopIncidents - Intro Text "
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TopUsersByAnomalies = Anomalies\r\n| mv-expand Entities\r\n| where tostring(Entities) contains '\"Type\":\"account\"'\r\n| project AadUserId=tostring(Entities.AadUserId), DisplayName=tostring(Entities.DisplayName), OriginalName=tostring(Entities.Name), AnomalyUPNSuffix=tostring(Entities.AnomalyUPNSuffix), OriginalUPNSuffix=tostring(Entities.UPNSuffix)\r\n| extend Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName), UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n| summarize hint.strategy = shuffle AnomalyCount=count() by AadUserId, DisplayName, Name, AnomalyUPNSuffix, UPNSuffix;\r\nlet TopUsers = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| project IncidentNumber, AlertId = tostring(AlertIds), TimeGenerated\r\n| join kind= innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"account\"\r\n| project SystemAlertId, OriginalName = tostring(tolower(Entities.Name)), OriginalUPNSuffix = tostring(Entities.UPNSuffix), AadUserId = tostring(Entities.AadUserId)\r\n | extend Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName), UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n | project-away OriginalName, OriginalUPNSuffix\r\n) on $left.AlertId == $right.SystemAlertId\r\n| union TopUsersByAnomalies\r\n| summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber), AlertCount=dcount(AlertId), AnomalyCount=sum(AnomalyCount), AadUserId = make_set_if(AadUserId, AadUserId != \"\") by Name, UPNSuffix;\r\nTopUsers\r\n| sort by IncidentCount, AlertCount, AnomalyCount desc",
"size": 0,
"title": "Top users by incidents, alerts and anomalies",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "Name",
"parameterName": "UserName",
"parameterType": 1
},
{
"fieldName": "AadUserId",
"parameterName": "UserObjectId",
"parameterType": 1
},
{
"fieldName": "UPNSuffix",
"parameterName": "UserUPN",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentCount",
"formatter": 8,
"formatOptions": {
"min": 1,
"palette": "redDark"
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"palette": "redDark"
}
},
{
"columnMatch": "AnomalyCount",
"formatter": 8,
"formatOptions": {
"palette": "redDark"
}
},
{
"columnMatch": "AadUserId",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
}
}
],
"rowLimit": 1000,
"filter": true,
"sortBy": [
{
"itemKey": "$gen_heatmap_AnomalyCount_4",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_AnomalyCount_4",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
},
"name": "UserGroupTopIncidents - Overview Query"
},
{
"type": 1,
"content": {
"json": "Select a user to view Incidents & Alerts & Anomalies breakdown",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Select user text"
},
{
"type": 1,
"content": {
"json": "## Incidents Breakdown: {UserName}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Incident"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f3097a1b-3aad-4a82-8a8a-19e2725b4ecb",
"version": "KqlParameterItem/1.0",
"name": "Severity",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"Low\",\"Medium\",\"High\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
},
{
"id": "994e7321-0462-4367-aae3-a69c6d61bf26",
"version": "KqlParameterItem/1.0",
"name": "Status",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"New\",\"Active\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Parameter Incident Selection"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let IncidentUser = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds), SecOpsOwner=tostring(Owner.assignedTo)\r\n| join kind= innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"account\"\r\n| project SystemAlertId, OriginalName = tostring(tolower(Entities.Name)), OriginalUPNSuffix = tostring(Entities.UPNSuffix), AadUserId = tostring(Entities.AadUserId)\r\n| extend Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName), UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n| project-away OriginalName, OriginalUPNSuffix\r\n) on $left.AlertId == $right.SystemAlertId\r\n| where (Name == '{UserName}' and Name != \"\" and UPNSuffix == '{UserUPN}') or (AadUserId == '{UserObjectId}')\r\n| where (Severity == '{Severity:value}' or '{Severity:value}' == \"All\") and (Status == '{Status:value}' or '{Status:value}' == \"All\");\r\nIncidentUser\r\n| summarize AlertCount=count(SystemAlertId) by TimeGenerated, Title, Description, Severity, Status, SecOpsOwner, IncidentUrl, IncidentNumber",
"size": 0,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Low",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "High",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "pending",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "stopped",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Owner",
"formatter": 5
},
{
"columnMatch": "IncidentUrl",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkIsContextBlade": false
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"min": 1,
"palette": "orangeDark"
}
},
{
"columnMatch": "Comments",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
},
{
"columnMatch": "Labels",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
}
],
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 1
}
]
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - User Incident Close Up"
},
{
"type": 1,
"content": {
"json": "## Anomalies Breakdown: {UserName}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Anomaly"
},
{
"type": 1,
"content": {
"json": "Select an anomaly to view all the related details below",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
}
],
"name": "Anomalies help"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| mv-expand Entities\r\n| where tostring(Entities) contains '\"Type\":\"account\"'\r\n| extend AadUserId=tostring(Entities.AadUserId), DisplayName=tostring(Entities.DisplayName), OriginalName=tostring(Entities.Name), AnomalyUPNSuffix=tostring(Entities.AnomalyUPNSuffix), OriginalUPNSuffix=tostring(Entities.UPNSuffix)\r\n| extend Name = iff(OriginalName contains '@', extract('(.*)@', 1, OriginalName), OriginalName), UPNSuffix = iff(OriginalUPNSuffix != \"\", OriginalUPNSuffix, extract('(.*)@(.*)', 2, OriginalName))\r\n| where (Name == '{UserName}' and Name != \"\" and UPNSuffix == '{UserUPN}') or (AadUserId == '{UserObjectId}')\r\n| project TimeGenerated, AnomalyRule=AnomalyTemplateName, Description, Score, RuleStatus, Tactics, Techniques, Entities, AnomalyReasons, AnomalyDetails, ExtendedProperties, ActivityInsights, DeviceInsights, UserInsights, ExtendedLinks\r\n",
"size": 1,
"noDataMessage": "No anomalies associated with this user",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "AnomalyReasons",
"parameterName": "AnomalyReasons",
"parameterType": 1
},
{
"fieldName": "AnomalyDetails",
"parameterName": "AnomalyDetails",
"parameterType": 1
},
{
"fieldName": "ActivityInsights",
"parameterName": "ActivityInsights",
"parameterType": 1
},
{
"fieldName": "ExtendedProperties",
"parameterName": "ExtendedProperties",
"parameterType": 1
},
{
"fieldName": "DeviceInsights",
"parameterName": "DeviceInsights",
"parameterType": 1
},
{
"fieldName": "UserInsights",
"parameterName": "UserInsights",
"parameterType": 1
},
{
"fieldName": "ExtendedLinks",
"parameterName": "ExtendedLinks",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Description",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "Score",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 1,
"palette": "purpleDark"
}
},
{
"columnMatch": "RuleStatus",
"formatter": 1,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Techniques",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AnomalyDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object containing general information about the rule and algorithm that generated the anomaly as well as explanations for the anomaly."
}
},
{
"columnMatch": "AnomalyReasons",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "The detailed explanation of the generated anomaly as JSON."
}
},
{
"columnMatch": "ExtendedProperties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object with additional data on the anomaly as key-value pairs."
}
},
{
"columnMatch": "ActivityInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the activities corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "DeviceInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the devices corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "UserInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the users corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "ExtendedLinks",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "List of links pointing to the data that generated the anomaly."
}
},
{
"columnMatch": "TenantId",
"formatter": 5
},
{
"columnMatch": "Id",
"formatter": 5
},
{
"columnMatch": "WorkspaceId",
"formatter": 5
},
{
"columnMatch": "VendorName",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateId",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateVersion",
"formatter": 5
},
{
"columnMatch": "RuleId",
"formatter": 5
},
{
"columnMatch": "RuleName",
"formatter": 5
},
{
"columnMatch": "RuleConfigVersion",
"formatter": 5
},
{
"columnMatch": "StartTime",
"formatter": 5
},
{
"columnMatch": "EndTime",
"formatter": 5
},
{
"columnMatch": "UserPrincipalName",
"formatter": 5
},
{
"columnMatch": "SourceIpAddress",
"formatter": 5
},
{
"columnMatch": "SourceLocation",
"formatter": 5
},
{
"columnMatch": "SourceDevice",
"formatter": 5
},
{
"columnMatch": "DestinationIpAddress",
"formatter": 5
},
{
"columnMatch": "DestinationLocation",
"formatter": 5
},
{
"columnMatch": "DestinationDevice",
"formatter": 5
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "DisplayName",
"formatter": 1
},
{
"columnMatch": "OriginalName",
"formatter": 5
},
{
"columnMatch": "AnomalyUPNSuffix",
"formatter": 5
},
{
"columnMatch": "OriginalUPNSuffix",
"formatter": 5
},
{
"columnMatch": "Name",
"formatter": 5
},
{
"columnMatch": "UPNSuffix",
"formatter": 5
}
]
}
},
"conditionalVisibility": {
"parameterName": "UserName",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - User Anomaly Close Up "
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{AnomalyReasons}\",\"transformers\":null}",
"size": 4,
"title": "User Anomalies - AnomalyReasons",
"queryType": 8,
"gridSettings": {
"formatters": [
{
"columnMatch": "Value",
"formatter": 1
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "IsAnomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "Yes"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "No"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TypicalObservations",
"formatter": 5
},
{
"columnMatch": "Anomalous?",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"customWidth": "50",
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
},
"name": "User Anomalies - AnomalyReasons"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{DeviceInsights}\",\"transformers\":null}",
"size": 4,
"title": "User anomalies - DeviceInsights",
"noDataMessage": "None available",
"queryType": 8
},
"customWidth": "50",
"name": "User anomalies - DeviceInsights"
}
]
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Users"
},
"name": "UserGroupTopIncidents"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Top hosts to investigate - by Incidents, alerts & anomalies\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
"name": "UserGroupTopIncidents - Title Text"
},
{
"type": 1,
"content": {
"json": "Clicking on an entity should load anomalies and incidents where the entity is present",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "UserGroupTopIncidents - Intro Text"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Currently there is no mapping for hosts\r\n//We know that in the following anomalies there is a host present: \"FirstTimeUserConnectedFromDevice\", \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"FirstTimeDeviceObservedInTenant\", \"DeviceUncommonlyUsedInTenant\"\r\n//We only look for \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\" though since the other two only state PII instead of the host itself\r\nlet Name = dynamic([\"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\"]) ;\r\nlet TopHostsByAnomalies =\r\nAnomalies\r\n| mv-expand AnomalyReasons\r\n| where tostring(AnomalyReasons.Name) in (Name)\r\n| extend DeviceRegex = tostring(extract(\"with ([A-Za-z0-9_.-]+) device\", 1, Description))\r\n| extend DeviceName = tolower(DeviceRegex)\r\n| summarize hint.strategy = shuffle AnomalyCount=count() by DeviceName;\r\nlet TopHostsIncidents = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| project IncidentNumber, AlertId = tostring(AlertIds), TimeGenerated\r\n| join kind= innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"host\"\r\n| project SystemAlertId, DeviceName = tostring(tolower(Entities.HostName))\r\n) on $left.AlertId == $right.SystemAlertId\r\n| union TopHostsByAnomalies\r\n| summarize IncidentCount=dcount(IncidentNumber), AlertCount=dcount(AlertId), AnomalyCount=sum(AnomalyCount) by DeviceName;\r\nTopHostsIncidents\r\n| where isnotempty(DeviceName)\r\n| sort by IncidentCount, AlertCount, AnomalyCount, DeviceName desc",
"size": 0,
"title": "Top hosts by incidents, alerts and anomalies",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "DeviceName",
"exportParameterName": "Host",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentCount",
"formatter": 8,
"formatOptions": {
"min": 1,
"palette": "redDark"
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"palette": "redDark"
}
},
{
"columnMatch": "AnomalyCount",
"formatter": 8,
"formatOptions": {
"palette": "redDark"
}
},
{
"columnMatch": "AadUserId",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
}
}
],
"filter": true,
"sortBy": [
{
"itemKey": "$gen_heatmap_AnomalyCount_3",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_AnomalyCount_3",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
"name": "HostsGroupTopIncidents - Overview Query"
},
{
"type": 1,
"content": {
"json": "Select a host to view Incidents & Alerts & Anomalies breakdown",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Select user text"
},
{
"type": 1,
"content": {
"json": "## Incidents Breakdown: {Host}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Incident"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f3097a1b-3aad-4a82-8a8a-19e2725b4ecb",
"version": "KqlParameterItem/1.0",
"name": "Severity",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"Low\",\"Medium\",\"High\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
},
{
"id": "994e7321-0462-4367-aae3-a69c6d61bf26",
"version": "KqlParameterItem/1.0",
"name": "Status",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"New\",\"Active\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Parameter Incident Selection"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let IncidentswithHosts = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds), SecOpsOwner=tostring(Owner.assignedTo)\r\n| join kind= innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"host\"\r\n| project SystemAlertId, HostEntity = tostring(tolower(Entities.HostName))\r\n) on $left.AlertId == $right.SystemAlertId\r\n| where (HostEntity == '{Host}' and HostEntity != \"\")\r\n| where (Severity == '{Severity:value}' or '{Severity:value}' == \"All\") and (Status == '{Status:value}' or '{Status:value}' == \"All\");\r\nIncidentswithHosts\r\n| summarize AlertCount=count(SystemAlertId) by TimeGenerated, Title, Description, Severity, Status, SecOpsOwner, IncidentUrl, IncidentNumber",
"size": 0,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Low",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "High",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "pending",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "stopped",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Owner",
"formatter": 5
},
{
"columnMatch": "IncidentUrl",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkIsContextBlade": false
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"min": 1,
"palette": "orangeDark"
}
},
{
"columnMatch": "Comments",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
},
{
"columnMatch": "Labels",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
}
],
"sortBy": [
{
"itemKey": "$gen_heatmap_AlertCount_8",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_AlertCount_8",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "HostTopIncidents - Host Incident Close Up"
},
{
"type": 1,
"content": {
"json": "## Anomalies Breakdown: {Host}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Anomaly"
},
{
"type": 1,
"content": {
"json": "Currently, hosts are not mapped as entities in anomalies. In this workbook, they are being extracted from the Anomaly description.",
"style": "warning"
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
"name": "Host anomalies warning"
},
{
"type": 1,
"content": {
"json": "Hover over each field on the anomalies below to see what it means",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
}
],
"name": "Host anomalies help"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Currently there is no mapping for hosts\r\n//We know that in the following anomalies there is a host present: \"FirstTimeUserConnectedFromDevice\", \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"FirstTimeDeviceObservedInTenant\", \"DeviceUncommonlyUsedInTenant\"\r\n//We only look for \"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\" though since the other two only state PII instead of the host itself\r\nlet Name = dynamic([\"DeviceUncommonlyUsedByUser\", \"DeviceUncommonlyUsedAmongPeers\", \"DeviceUncommonlyUsedInTenant\"]) ;\r\nAnomalies\r\n| mv-expand AnomalyReasons\r\n| where tostring(AnomalyReasons.Name) in (Name)\r\n| extend DeviceName = tostring(extract(\"with ([A-Za-z0-9_.-]+) device\", 1, Description))\r\n| project TimeGenerated, Anomaly=Description, Score, RuleStatus, Tactics, Techniques, Entities, AnomalyDetails, AnomalyReasons, ExtendedProperties, ActivityInsights, DeviceInsights, UserInsights, ExtendedLinks\r\n",
"size": 1,
"noDataMessage": "No anomalies associated with this host",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "AnomalyReasons",
"parameterName": "AnomalyReasons",
"parameterType": 1
},
{
"fieldName": "DeviceInsights",
"parameterName": "DeviceInsights",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Score",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 1,
"palette": "purpleDark"
}
},
{
"columnMatch": "Techniques",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AnomalyDetails",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object containing general information about the rule and algorithm that generated the anomaly as well as explanations for the anomaly."
}
},
{
"columnMatch": "AnomalyReasons",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "The detailed explanation of the generated anomaly as JSON."
}
},
{
"columnMatch": "ExtendedProperties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object with additional data on the anomaly as key-value pairs."
}
},
{
"columnMatch": "ExtendedLinks",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "List of links pointing to the data that generated the anomaly."
}
},
{
"columnMatch": "ActivityInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the activities corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "DeviceInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the devices corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "UserInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the users corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "TenantId",
"formatter": 5
},
{
"columnMatch": "Id",
"formatter": 5
},
{
"columnMatch": "WorkspaceId",
"formatter": 5
},
{
"columnMatch": "VendorName",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateId",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateVersion",
"formatter": 5
},
{
"columnMatch": "RuleId",
"formatter": 5
},
{
"columnMatch": "RuleName",
"formatter": 5
},
{
"columnMatch": "RuleConfigVersion",
"formatter": 5
},
{
"columnMatch": "Description",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "StartTime",
"formatter": 5
},
{
"columnMatch": "EndTime",
"formatter": 5
},
{
"columnMatch": "UserPrincipalName",
"formatter": 5
},
{
"columnMatch": "SourceIpAddress",
"formatter": 5
},
{
"columnMatch": "SourceLocation",
"formatter": 5
},
{
"columnMatch": "SourceDevice",
"formatter": 5
},
{
"columnMatch": "DestinationIpAddress",
"formatter": 5
},
{
"columnMatch": "DestinationLocation",
"formatter": 5
},
{
"columnMatch": "DestinationDevice",
"formatter": 5
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "DisplayName",
"formatter": 5
},
{
"columnMatch": "OriginalName",
"formatter": 5
},
{
"columnMatch": "AnomalyUPNSuffix",
"formatter": 5
},
{
"columnMatch": "OriginalUPNSuffix",
"formatter": 5
},
{
"columnMatch": "Name",
"formatter": 5
},
{
"columnMatch": "UPNSuffix",
"formatter": 5
}
]
}
},
"conditionalVisibility": {
"parameterName": "Host",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - User Anomaly Close Up "
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{AnomalyReasons}\",\"transformers\":null}",
"size": 4,
"title": "Host Anomalies - AnomalyReasons",
"queryType": 8,
"gridSettings": {
"formatters": [
{
"columnMatch": "Value",
"formatter": 1
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "IsAnomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "Yes"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "No"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TypicalObservations",
"formatter": 5
},
{
"columnMatch": "Anomalous?",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"customWidth": "50",
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
"name": "Host Anomalies - AnomalyReasons"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{DeviceInsights}\",\"transformers\":null}",
"size": 4,
"title": "Host anomalies - DeviceInsights",
"noDataMessage": "None available",
"queryType": 8
},
"customWidth": "50",
"name": "Host anomalies - DeviceInsights"
}
]
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "Hosts"
},
"name": "HostsGroupTopIncidents"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Top IPs to investigate - by Incidents, alerts & anomalies\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
},
"name": "IPGroupTopIncidents - Title Text"
},
{
"type": 1,
"content": {
"json": "Clicking on an entity should load anomalies and incidents where the entity is present",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
},
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "IPGroupTopIncidents - Intro Text"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TopIPsByAnomalies= Anomalies\r\n| mv-expand Entities\r\n| where tostring(Entities) contains '\"Type\":\"ip\"'\r\n| project IPentity=tostring(Entities.Address)\r\n| summarize hint.strategy = shuffle AnomalyCount=count() by IPentity;\r\nlet TopIPs = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| project IncidentNumber, AlertId = tostring(AlertIds), TimeGenerated\r\n| join kind = innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"ip\"\r\n| project SystemAlertId, IPentity = tostring(tolower(Entities.Address))\r\n) on $left.AlertId == $right.SystemAlertId\r\n| union TopIPsByAnomalies\r\n| summarize IncidentCount=dcount(IncidentNumber), AlertCount=dcount(AlertId), AnomalyCount=sum(AnomalyCount) by IPentity;\r\nTopIPs\r\n| sort by IncidentCount, AlertCount, AnomalyCount, IPentity desc",
"size": 0,
"title": "Top IPs by incidents, alerts and anomalies",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "IPentity",
"exportParameterName": "IP",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentCount",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "redDark"
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "redDark"
}
},
{
"columnMatch": "AnomalyCount",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "redDark"
}
},
{
"columnMatch": "AadUserId",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
}
}
],
"rowLimit": 1000,
"filter": true
},
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
},
"name": "IPGroupTopIncidents - Overview Query"
},
{
"type": 1,
"content": {
"json": "Select an IP to view Incidents & Alerts & Anomalies breakdown",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isEqualTo",
"value": "None"
},
"name": "IPGroupTopIncidents - Select IP text"
},
{
"type": 1,
"content": {
"json": "## Incidents Breakdown: {IP}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Incident"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f3097a1b-3aad-4a82-8a8a-19e2725b4ecb",
"version": "KqlParameterItem/1.0",
"name": "Severity",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"Low\",\"Medium\",\"High\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
},
{
"id": "994e7321-0462-4367-aae3-a69c6d61bf26",
"version": "KqlParameterItem/1.0",
"name": "Status",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"New\",\"Active\", \"All\"]",
"timeContext": {
"durationMs": 86400000
},
"value": "All"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Parameter Incident Selection"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let IncidentIP = SecurityIncident\r\n| summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds), SecOpsOwner=tostring(Owner.assignedTo)\r\n| join kind= innerunique ( \r\nSecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] =~ \"ip\"\r\n| project SystemAlertId, IPEntity = tostring(tolower(Entities.Address))\r\n) on $left.AlertId == $right.SystemAlertId\r\n| where (IPEntity == '{IP}' and IPEntity != \"\")\r\n| where (Severity == '{Severity:value}' or '{Severity:value}' == \"All\") and (Status == '{Status:value}' or '{Status:value}' == \"All\");\r\nIncidentIP\r\n| summarize AlertCount=count(SystemAlertId) by TimeGenerated, Title, Description, Severity, Status, SecOpsOwner, IncidentUrl, IncidentNumber",
"size": 0,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Low",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "High",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "pending",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "stopped",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Owner",
"formatter": 5
},
{
"columnMatch": "IncidentUrl",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkIsContextBlade": false
}
},
{
"columnMatch": "AlertCount",
"formatter": 8,
"formatOptions": {
"min": 1,
"palette": "orangeDark"
}
},
{
"columnMatch": "Comments",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
},
{
"columnMatch": "Labels",
"formatter": 7,
"formatOptions": {
"linkIsContextBlade": true
}
}
],
"sortBy": [
{
"itemKey": "$gen_heatmap_AlertCount_8",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_AlertCount_8",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - User Incident Close Up"
},
{
"type": 1,
"content": {
"json": "## Anomalies Breakdown: {IP}\r\n---\r\n"
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - Selected User Text Anomaly"
},
{
"type": 1,
"content": {
"json": "Hover over each field on the anomalies below to see what it means",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
{
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
}
],
"name": "IP anomalies help"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Anomalies\r\n| mv-expand Entities\r\n| where tostring(Entities) contains '\"Type\":\"ip\"'\r\n| extend IPentity=tostring(Entities.Address)\r\n| where (IPentity == '{IP}' and IPentity != \"\" )\r\n| project TimeGenerated, AnomalyRule=AnomalyTemplateName, Description, Score, RuleStatus, Tactics, Techniques, Entities, AnomalyDetails, AnomalyReasons, ExtendedProperties, ActivityInsights, DeviceInsights, UserInsights, ExtendedLinks\r\n",
"size": 1,
"noDataMessage": "No anomalies associated with this IP",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "AnomalyReasons",
"parameterName": "AnomalyReasons",
"parameterType": 1
},
{
"fieldName": "DeviceInsights",
"parameterName": "DeviceInsights",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Score",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 1,
"palette": "purpleDark"
}
},
{
"columnMatch": "Techniques",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AnomalyDetails",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object containing general information about the rule and algorithm that generated the anomaly as well as explanations for the anomaly."
}
},
{
"columnMatch": "AnomalyReasons",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "The detailed explanation of the generated anomaly as JSON."
}
},
{
"columnMatch": "ExtendedProperties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "JSON object with additional data on the anomaly as key-value pairs."
}
},
{
"columnMatch": "ExtendedLinks",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "List of links pointing to the data that generated the anomaly."
}
},
{
"columnMatch": "ActivityInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the activities corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "DeviceInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the devices corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "UserInsights",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
},
"emptyValCustomText": "None available"
},
"tooltipFormat": {
"tooltip": "Insights about the users corresponding to the generated anomaly as JSON."
}
},
{
"columnMatch": "TenantId",
"formatter": 5
},
{
"columnMatch": "Id",
"formatter": 5
},
{
"columnMatch": "WorkspaceId",
"formatter": 5
},
{
"columnMatch": "VendorName",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateId",
"formatter": 5
},
{
"columnMatch": "AnomalyTemplateVersion",
"formatter": 5
},
{
"columnMatch": "RuleId",
"formatter": 5
},
{
"columnMatch": "RuleName",
"formatter": 5
},
{
"columnMatch": "RuleConfigVersion",
"formatter": 5
},
{
"columnMatch": "Description",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "StartTime",
"formatter": 5
},
{
"columnMatch": "EndTime",
"formatter": 5
},
{
"columnMatch": "UserPrincipalName",
"formatter": 5
},
{
"columnMatch": "SourceIpAddress",
"formatter": 5
},
{
"columnMatch": "SourceLocation",
"formatter": 5
},
{
"columnMatch": "SourceDevice",
"formatter": 5
},
{
"columnMatch": "DestinationIpAddress",
"formatter": 5
},
{
"columnMatch": "DestinationLocation",
"formatter": 5
},
{
"columnMatch": "DestinationDevice",
"formatter": 5
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "DisplayName",
"formatter": 5
},
{
"columnMatch": "OriginalName",
"formatter": 5
},
{
"columnMatch": "AnomalyUPNSuffix",
"formatter": 5
},
{
"columnMatch": "OriginalUPNSuffix",
"formatter": 5
},
{
"columnMatch": "Name",
"formatter": 5
},
{
"columnMatch": "UPNSuffix",
"formatter": 5
}
]
}
},
"conditionalVisibility": {
"parameterName": "IP",
"comparison": "isNotEqualTo",
"value": "None"
},
"name": "UserGroupTopIncidents - User Anomaly Close Up "
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{AnomalyReasons}\",\"transformers\":null}",
"size": 4,
"title": "IP Anomalies - AnomalyReasons",
"queryType": 8,
"gridSettings": {
"formatters": [
{
"columnMatch": "Value",
"formatter": 1
},
{
"columnMatch": "Type",
"formatter": 5
},
{
"columnMatch": "IsAnomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "Yes"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "No"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TypicalObservations",
"formatter": 5
},
{
"columnMatch": "Anomalous?",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "True",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "Name",
"sortOrder": 1
}
]
},
"customWidth": "50",
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
},
"name": "User Anomalies - AnomalyReasons"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"1.0.0\",\"content\":\"{DeviceInsights}\",\"transformers\":null}",
"size": 4,
"title": "User anomalies - DeviceInsights",
"noDataMessage": "None available",
"queryType": 8
},
"customWidth": "50",
"name": "IP anomalies - DeviceInsights"
}
]
},
"conditionalVisibility": {
"parameterName": "rankingTab",
"comparison": "isEqualTo",
"value": "IPs"
},
"name": "UserGroupTopIncidentsIP "
}
],
"fromTemplateId": "https://sentinelus.hosting.portal.azure.net/sentinelus/Content/1.0.02484.3403-231021-003920/Scenarios/Ecosystem/Content/Workbooks/CustomWorkbook.json",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}