{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "3ac5e194-a6a4-4405-8370-6da952e8bc5b", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "1ba43bf0-5c1a-4081-b357-34f5389cf5f2", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "DataSource Statistics", "subTarget": "DataSourceStatistics", "style": "link" }, { "id": "c5d475b0-86f9-4e78-8b32-d19631bc68de", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Microsoft Sentinel Github", "subTarget": "MicrosoftSentinelGithub", "style": "link" }, { "id": "90261d23-b3d6-4b6c-a22c-c74cfe8d2e23", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Detection Platform Services", "subTarget": "DetectionPlatformServices", "style": "link" }, { "id": "6618168f-77ef-4b5b-9ebd-70e2852ba475", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "MITRE ATT&CK Heatmaps (Coverage)", "subTarget": "MITREATT&CKcoverage", "style": "link" } ] }, "name": "links - 0" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/r/UjQS9t0TSr)" }, "name": "Survey" }, { "type": 1, "content": { "json": "# Getting Started\r\n---\r\n\r\nThis workbook enables SecOps Analysts, Threat Intelligence Professionals, and Threat Hunters to map out-of-the box Microsoft Sentinel detections coverage across MITRE ATT&CK framework. \r\n
With this workbook, analysts will be able to get insights into what out-of-the box detections are already available and can make informed decision to either onboard new datasources or enable new analytics and hunting queries to increase MITRE ATT&CK coverage or fill existing gaps. \r\n\r\nThe workbook is designed into separate tabs as described below.\r\n\r\n## DataSource Statistics\r\n---\r\nThis section provides dataSources currently being populated based on Usage Table and security alerts triggered across those datasources from SecurityAlerts Table across Microsoft Sentinel workspace.\r\n\r\n## Microsoft Sentinel Github\r\n---\r\nThis section provides breakdown of existing out-of-the box content by Detection type such as Analytics, Hunting Queries and Fusion detections as well as by MITRE ATT&CK Tactics. \r\n\r\n## Detection Platform Services\r\n---\r\nThis section provides breakdown of built-in alerts from Microsoft suite of security products such as Azure Defender for various cloud resource types/services, Microsoft Defender for Identity (MDI), Microsoft Cloud Application Security (MCAS) and others. \r\n
These alerts can be visually represented by products as well as cloud resource types. \r\n\r\n\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## MITRE ATT&CK Heatmaps\r\n---\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## MITRE coverage\r\n\r\nMicrosoft Sentinel now provides a built-in feature to view your current MITRE ATT&CK coverage using an interactive heatmap. To access it, navigate to the Azure portal, open Microsoft Sentinel, and under the 'Threat management' section, select 'MITRE ATT&CK (Preview)\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Links and Resources\r\n\r\n- Microsoft Sentinel Github : https://github.com/Azure/Azure-Sentinel/\r\n- Microsoft Sentinel Fusion : https://docs.microsoft.com/azure/sentinel/fusion-scenario-reference\r\n- Microsoft Defender for Cloud: https://docs.microsoft.com/azure/security-center/alerts-reference\r\n- Azure Identity Protection (AIP): https://docs.microsoft.com/azure/active-directory/identity-protection/concept-identity-protection-risks\r\n- Microsoft Defender for Identity: https://docs.microsoft.com/advanced-threat-analytics/suspicious-activity-guide\r\n- Microsoft Defender for Cloud Apps : https://docs.microsoft.com/cloud-app-security/investigate-anomaly-alerts" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 2" }, { "type": 1, "content": { "json": "\r\n# ** Data Sources Available in Current Microsoft Sentinel **\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage \r\n| summarize SizeinMB = round(sum(Quantity),2) by DataType \r\n| sort by SizeinMB desc", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "query - 4" }, { "type": 1, "content": { "json": "# Detections Coverage in Existing Microsoft Sentinel" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize Count=dcount(AlertName) by ProviderName, VendorName", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ProviderName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "ProviderName", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize Count=count() by ProviderName, VendorName, AlertName\r\n| sort by ProviderName", "size": 0, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "customWidth": "50", "name": "query - 7", "styleSettings": { "maxWidth": "50" } }, { "type": 1, "content": { "json": "## MITRE ATT&CK Coverage against Microsoft Sentinel Github\r\n\r\n# Links and Resources :\r\n- Tactics : https://attack.mitre.org/tactics/enterprise/\r\n- Enterprise Matrix : https://attack.mitre.org/matrices/enterprise/\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where isnotempty(Tactic)\r\n| summarize Count=dcount(DetectionName) by DetectionType", "size": 0, "title": "Query Type Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "50", "name": "query - 10", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Tactic)\r\n| extend Tactic = iff(Tactic in (\"Privilege Escalation\",\"Privilege escalation\") ,\"PrivilegeEscalation\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Persistance\",\"Persistence\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"Command and control\",\"CommandandControl\"), \"CommandAndControl\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"Resource Development\",\"ResourceDevelopment\"), \"ResourceDevelopment\",Tactic)\r\n | extend Tactic = iff(Tactic in (\"Defense Evasion\",\"Defense evasion\"), \"DefenseEvasion\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Lateral movement\",\"LateralMovement\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Credential Access\",\"CredentialAccess\",Tactic)\r\n | extend Tactic = iff(Tactic==\"Defense Impairment\",\"DefenseImpairment\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"IntialAccess\",\"InitalAccess\", \"Initial access\"),\"InitialAccess\",Tactic)\r\n| where Tactic in (\"InitialAccess\", \"Collection\", \"Discovery\", \"Execution\", \"Exfiltration\", \"LateralMovement\", \"Persistence\", \"PrivilegeEscalation\", \"DefenseEvasion\", \"CredentialAccess\",\"ResourceDevelopment\", \"Stealth\",\"DefenseImpairment\", \"LateralMovement\", \"Reconnaissance\", \"Impact\")\r\n| summarize Count=dcount(DetectionId), make_set(DetectionName) by Tactic\r\n| sort by Count desc", "size": 0, "title": "Tactic Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Tactic", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "50", "name": "query - 9", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Platform)\r\n| summarize Count=dcount(DetectionId) by Platform\r\n| sort by Count desc", "size": 0, "title": "Platform Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "100", "name": "query - 12", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Tactic) and isnotempty(Platform)\r\n| distinct Platform, DataTypes, DetectionType, DetectionName,DetectionUrl \r\n| sort by Platform asc, DetectionType asc", "size": 0, "title": "DataSource Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 9000, "filter": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "100", "name": "query - 11", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n| summarize Count=count() by DetectionService\r\n| sort by Count desc", "size": 0, "title": "Detections by Microsoft Services", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "customWidth": "50", "name": "query - 13", "styleSettings": { "maxWidth": "30" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n| where Provider != \"N.A.\"\r\n| summarize Count=count() by Provider\r\n| sort by Count desc", "size": 0, "title": "ASC - Resource Type Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Provider", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "customWidth": "50", "name": "query - 14", "styleSettings": { "maxWidth": "70" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n", "size": 0, "title": "List of Alerts by Microsoft Services", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "name": "query - 15" }, { "type": 1, "content": { "json": "" }, "name": "text - 16" }, { "type": 1, "content": { "json": "## MITRE coverage\r\n\r\nMicrosoft Sentinel now provides a built-in feature to view your current MITRE ATT&CK coverage using an interactive heatmap. To access it, navigate to the Azure portal, open Microsoft Sentinel, and under the 'Threat management' section, select 'MITRE ATT&CK (Preview)\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MITREATT&CKcoverage" }, "name": "text - 1" } ], "fromTemplateId": "sentinel-mitreattack", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }