{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Windows Audit Checker\n\nThis Microsoft Sentinel workbook validates Windows Security auditing coverage and ingestion quality in the selected workspace.\n\n**What it helps you verify**\n- Required Advanced Audit Policy subcategories are generating the expected `SecurityEvent` data (success and/or failure) across hosts.\n- Hosts with missing events (or unexpected/over-collected events) for the selected policy profile.\n- Overlapping AMA Data Collection Rules (DCRs) collecting the same Security Event IDs from the same machines (duplicate ingestion/cost risk).\n\n**How to use**\n1. Select `Subscription` and `Workspace`, then set `Time Range` and `Policy Profile`.\n2. Review the tabs:\n - **Overview**: high-level coverage status.\n - **Coverage**: drill down by audit subcategory and host.\n - **DCR Deduplication**: highlights EventID overlap between DCRs for `Microsoft-SecurityEvent`.\n\n**Notes**\n- This workbook is read-only and does not change endpoint audit policy.\n- The **DCR Deduplication** tab is supported only in the Azure portal (classic) workbook experience and is not available in the Microsoft Defender portal.\n- Missing data can indicate either disabled auditing on endpoints or a collection/ingestion configuration issue.\n- Very short time ranges can produce false negatives if the selected events did not occur." }, "name": "Intro" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "63e6eb1c-eeeb-4f54-a1f9-4248ab40f0fc", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "f61204fe-63f1-467b-b88c-00b67b9415b5", "version": "KqlParameterItem/1.0", "name": "Subscription", "label": "☁️ Subscription", "type": 6, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "crossComponentResources": [ "value::selected" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "90a93ee9-6a35-4cdd-a2b8-d7398348a24e", "version": "KqlParameterItem/1.0", "name": "Workspace", "label": "🗂️ Workspace", "type": 5, "isRequired": true, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| project id", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [] }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" }, { "id": "718db432-d9a2-449f-9409-08426a8064ad", "version": "KqlParameterItem/1.0", "name": "resourceGroup", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "53d5239a-85f8-4162-afda-5924e5aa03a4", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "⏱️ Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 7776000000 } }, { "id": "dbb96165-c009-4cdf-9e21-2eeec4d0366f", "version": "KqlParameterItem/1.0", "name": "PolicyProfile", "type": 10, "isRequired": true, "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"General\\\", \\\"label\\\": \\\"General\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Stronger\\\", \\\"label\\\": \\\"Stronger\\\" }\\r\\n]\",\"transformers\":null}", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 8 } ], "style": "above", "queryType": 8 }, "name": "parameters - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "dea7f08f-1f9b-4383-827f-e561c23b3123", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link", "linkIsContextBlade": true }, { "id": "bd44bf32-a619-467a-a74e-09a3a2729536", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Coverage", "subTarget": "Coverage", "style": "link" }, { "id": "7271d37b-aaee-452f-9330-935cd6669747", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "DCR Deduplication", "subTarget": "DCR", "style": "link" } ] }, "name": "links - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ===============================================\r\n// Sentinel Windows Audit Coverage - DCs (Overview)\r\n// ===============================================\r\n//\r\n// Purpose:\r\n// - For Domain Controllers only, detect audit coverage gaps by subcategory:\r\n// * Missing important events (audit not enabled for required subcategories)\r\n// * Over-collection (non-required events being collected)\r\n// - Presence-only model: we only care whether any \"Success\"/\"Failure\" event\r\n// occurred in the time window (count >= 1), not the volume.\r\n//\r\n// Inputs:\r\n// - TimeRange parameter (start, end)\r\n// - PolicyProfile parameter: \"General\" or \"Stronger\"\r\n// - SecurityEvent table\r\n//\r\n// Output (per subcategory):\r\n// - Verdict (Missing Success/Failure/Both, Over-collected, OK, N/A)\r\n// - PercentAffected, AffectedHosts, TotalHosts\r\n//\r\n// Notes:\r\n// - DC scope is inferred from Kerberos events (4768/4769/4771) seen in the window.\r\n// - Outcome is derived from Keywords (\"Success\" or \"Failure\").\r\n// - \"Optional\" requirement (SuccessOptional=true) can relax Success requirement\r\n// when Failure is not required (see Effective RequireSuccess).\r\n//\r\n// -----------------------------------------------\r\n\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 5;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\n\r\n// ===============================================\r\n// 1) Subcategory configuration (Category / Scope / EventIDs in scope)\r\n// - Scope: \"DC\" or \"All\"\r\n// - Event lists define which EventIDs represent Success/Failure presence for a subcategory\r\n\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n //\"Non Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\n// ===============================================\r\n// 2) Policy matrix (requirements per Role/Profile)\r\n// - RequireSuccess / RequireFailure: whether Success/Failure presence is required\r\n// - SuccessOptional: if true and Failure not required, Success requirement can be relaxed\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n\r\n\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n\r\n];\r\n\r\n// ===============================================\r\n// 3) DC-only fast path for the Overview\r\n// 3.1) Identify DCs by Kerberos events within the window\r\n\r\nlet DCsOnly =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768,4769,4771)\r\n | summarize by Computer;\r\n\r\n// 3.2) EventID -> Subcategory mapping (used for filtering and joins)\r\nlet EventMap = materialize(\r\n (\r\n SubcatConfig\r\n | mv-expand EventID = SuccessEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | union\r\n (\r\n SubcatConfig\r\n | mv-expand EventID = FailureEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | summarize by Subcategory, Category, Scope, EventID\r\n);\r\n\r\n// 3.3) Presence-only summary for DC-originated events that are in scope\r\nlet EventSummaryDC =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where Computer in (DCsOnly)\r\n | join kind=inner hint.strategy=broadcast (EventMap) on EventID\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\",\"Success\",\r\n Keywords == \"0x8010000000000000\",\"Failure\",\r\n \"Unknown\")\r\n | summarize\r\n SuccessCnt = max(toint(Outcome==\"Success\")),\r\n FailureCnt = max(toint(Outcome==\"Failure\"))\r\n by Computer, Category, Subcategory, Scope\r\n | extend Total = SuccessCnt + FailureCnt;\r\n\r\n// 3.4) Universe: all (DC, subcategory) pairs where Scope in (\"DC\",\"All\")\r\nlet SubcatsForDC = SubcatConfig | where Scope in (\"DC\",\"All\") | project Category, Subcategory, Scope;\r\nlet Universe =\r\n DCsOnly | extend k=1\r\n | join kind=inner (SubcatsForDC | extend k=1) on k\r\n | project Computer, Category, Subcategory, Scope;\r\n\r\n// 3.5) Per-host status (Role is DC)\r\nlet PerHostDC =\r\n Universe\r\n | join kind=leftouter EventSummaryDC on Computer, Category, Subcategory\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0)),\r\n Role = \"Domain Controller\"\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Role == \"Domain Controller\") on Subcategory\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides= (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess= iff(OptionalOverrides, false, RequireSuccess)\r\n // Presence-only threshold = 1 (exists/doesn't exist in the window) \r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= 1, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= 1, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail),\r\n OverReason = case(OverSucc and OverFail, \"Success+Failure\",\r\n OverSucc, \"Success\",\r\n OverFail, \"Failure\", \"\")\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, Category, Subcategory, Status, OverCollected, OverReason;\r\n\r\n// ===============================================\r\n// 4) Aggregation & verdicts\r\n// - Order statuses by impact to compute worst status per subcategory\r\n\r\nlet StatusOrder = datatable(Status:string, Ord:int)\r\n[\r\n \"Missing (both)\", 0,\r\n \"Missing Failure\", 1,\r\n \"Missing Success\", 2,\r\n \"Over-collected\", 3,\r\n \"OK\", 4,\r\n \"OK (not required)\", 4,\r\n \"N/A\", 5\r\n];\r\nlet Ord2Status = datatable(Ord:int, WorstStatus:string)\r\n[\r\n 0, \"Missing (both)\",\r\n 1, \"Missing Failure\",\r\n 2, \"Missing Success\",\r\n 3, \"Over-collected\",\r\n 4, \"OK\",\r\n 5, \"N/A\"\r\n];\r\n\r\nlet Base =\r\n PerHostDC\r\n | extend StatusNorm = case(\r\n Status == \"OK (not required)\", \"OK\",\r\n isempty(Status), \"N/A\",\r\n Status\r\n )\r\n | join kind=leftouter (StatusOrder) on $left.StatusNorm == $right.Status\r\n | project Category, Subcategory, Computer, Ord,\r\n OverCollected = tobool(column_ifexists(\"OverCollected\", false)),\r\n OverReason;\r\n\r\nlet Totals =\r\n Base\r\n | summarize TotalHosts = dcount(Computer) by Category, Subcategory;\r\n\r\nlet WorstPerCat =\r\n Base\r\n | summarize WorstOrd = min(Ord) by Category, Subcategory;\r\n\r\nlet WorstCount =\r\n Base\r\n | join kind=inner (WorstPerCat) on Category, Subcategory\r\n | where Ord == WorstOrd\r\n | summarize AffectedHosts = dcount(Computer),\r\n OverReasons = make_set_if(OverReason, OverCollected and isnotempty(OverReason))\r\n by Category, Subcategory, WorstOrd;\r\n\r\nWorstCount\r\n| join kind=leftouter (Ord2Status) on $left.WorstOrd == $right.Ord\r\n| join kind=leftouter (Totals) on Category, Subcategory\r\n| extend PercentAffected = todouble(AffectedHosts) / todouble(TotalHosts) * 100.0\r\n| extend Verdict = iff(WorstStatus == \"Over-collected\" and array_length(OverReasons) > 0,\r\n strcat(\"Over-collected (\", tostring(OverReasons[0]), \")\"),\r\n WorstStatus)\r\n| project Category, Subcategory, Verdict,\r\n PercentAffected = round(PercentAffected, 1),\r\n AffectedHosts, TotalHosts\r\n| order by Category asc, Subcategory asc\r\n", "size": 0, "title": "Domain Controller Audit Summary", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Verdict", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray" }, { "operator": "startsWith", "thresholdValue": "Over-collected", "representation": "yellow" }, { "operator": "==", "thresholdValue": "Missing (both)", "representation": "redBright" }, { "operator": "==", "thresholdValue": "Missing Failure", "representation": "red" }, { "operator": "==", "thresholdValue": "Missing Success", "representation": "orange" }, { "operator": "==", "thresholdValue": "OK", "representation": "green" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "PercentAffected", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "grayBlue", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "PercentAffected", "color": "lightBlue", "backgroundPattern": "stripes" }, { "columnName": "Category", "color": "blueDarkDark" } ] } } }, { "columnMatch": "BarColor", "formatter": 5 }, { "columnMatch": "IsNA", "formatter": 5 }, { "columnMatch": "SeverityScore", "formatter": 5 } ], "rowLimit": 100 } }, "customWidth": "100", "name": "DCDetails", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ===============================================\r\n// Sentinel Windows Audit Coverage - Servers (Overview)\r\n// ===============================================\r\n//\r\n// Purpose:\r\n// - Show audit-coverage posture for non-DC servers (Member/Workstation) by subcategory:\r\n// * Missing important events (required Success/Failure not present)\r\n// * Over-collection (collecting when not required)\r\n// - Presence-only model: we only check if at least one Success/Failure event occurred\r\n// within the time window; event volume is not evaluated.\r\n//\r\n// Inputs:\r\n// - TimeRange parameter (start, end)\r\n// - PolicyProfile parameter: \"General\" or \"Stronger\"\r\n// - SecurityEvent table\r\n//\r\n// Output (per subcategory):\r\n// - Verdict (Missing Success/Failure/Both, Over-collected, OK, N/A)\r\n// - PercentAffected, AffectedHosts, TotalHosts\r\n//\r\n// Notes:\r\n// - DCs are excluded via a Kerberos-DC heuristic (4768/4769/4771).\r\n// - Outcome is inferred uniformly from Keywords (\"Success\"/\"Failure\").\r\n// - SuccessOptional can relax Success requirement when Failure is not required.\r\n//\r\n// -----------------------------------------------\r\n// 0) Parameters / context\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 5;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\n\r\n// 1) Subcategory configuration (Category / Scope / EventIDs in scope)\r\n// - Scope: \"DC\" or \"All\"\r\n// - EventID lists define which events signal Success/Failure presence for a subcategory.\r\n\r\n\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n //\"Non Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\n// 2) Policy matrix (requirements per Role/Profile)\r\n// - RequireSuccess / RequireFailure indicate presence requirements\r\n// - SuccessOptional: if true and Failure is not required, Success may be relaxed\r\n\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n\r\n\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n\r\n];\r\n\r\n// 3) Build the base host set from ALL configured EventIDs (Success + Failure)\r\n\r\nlet AllEventIds_Early =\r\n (\r\n SubcatConfig\r\n | mv-expand e = SuccessEvents\r\n | project EventID = toint(e)\r\n )\r\n | union\r\n (\r\n SubcatConfig\r\n | mv-expand e = FailureEvents\r\n | project EventID = toint(e)\r\n )\r\n | summarize by EventID;\r\nlet BaseHosts =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (AllEventIds_Early)\r\n | summarize by Computer;\r\n\r\n// 4) Role inference helpers\r\n// 4.1) DC heuristic: presence of Kerberos auth events → Domain Controller\r\nlet DCHeuristic =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer\r\n | extend IsDC = true;\r\n\r\n// 4.2) Final Roles: all base hosts; mark non-DCs as Member/Workstation\r\nlet Roles =\r\n BaseHosts\r\n | join kind=leftouter DCHeuristic on Computer\r\n | extend Role = iff(IsDC == true, \"Domain Controller\", \"Member/Workstation\")\r\n | project Computer, Role;\r\n\r\n\r\n// 5) Member/Workstation fast path for the Overview\r\n// 5.1) DC list (to exclude from MW population)\r\nlet DCsOnly =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768,4769,4771)\r\n | summarize by Computer;\r\n\r\n// 5.2) EventID -> Subcategory map for Scope=\"All\" (compact and reusable)\r\nlet EventMap_All = materialize(\r\n (\r\n SubcatConfig\r\n | where Scope == \"All\"\r\n | mv-expand EventID = SuccessEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | union\r\n (\r\n SubcatConfig\r\n | where Scope == \"All\"\r\n | mv-expand EventID = FailureEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | summarize by Subcategory, Category, Scope, EventID\r\n);\r\n\r\n// 5.3) Member/Workstation population: non-DC hosts with any in-scope events (Scope=\"All\")\r\nlet AllEventIds_AllScope = EventMap_All | summarize by EventID;\r\nlet MemberHosts = materialize(\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (AllEventIds_AllScope)\r\n | summarize by Computer\r\n | join kind=leftanti DCsOnly on Computer\r\n);\r\n\r\n// 5.4) Presence-only aggregation per host x subcategory (Success/Failure seen at least once)\r\nlet EventSummary_MW =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where Computer in (MemberHosts)\r\n | join kind=inner hint.strategy=broadcast (EventMap_All) on EventID\r\n // можно чуть подсушить поток, оставив только Success/Failure:\r\n | where Keywords in (\"0x8020000000000000\",\"0x8010000000000000\")\r\n | extend IsSucc = toint(Keywords == \"0x8020000000000000\"),\r\n IsFail = toint(Keywords == \"0x8010000000000000\")\r\n | summarize\r\n SuccessCnt = max(IsSucc),\r\n FailureCnt = max(IsFail)\r\n by Computer, Category, Subcategory, Scope\r\n | extend Total = SuccessCnt + FailureCnt;\r\n\r\n// 5.5) Universe: (Member/Workstation hosts) × (Scope=\"All\" subcategories)\r\nlet SubcatsForAll = SubcatConfig | where Scope == \"All\" | project Category, Subcategory, Scope;\r\nlet Universe_MW =\r\n MemberHosts | extend k=1\r\n | join kind=inner (SubcatsForAll | extend k=1) on k\r\n | project Computer, Category, Subcategory, Scope;\r\n\r\n// 5.6) Per-host status for Member/Workstation (presence threshold = 1)\r\nlet PerHost_MW =\r\n Universe_MW\r\n | join kind=leftouter EventSummary_MW on Computer, Category, Subcategory\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0)),\r\n Role = \"Member/Workstation\"\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Role == \"Member/Workstation\") on Subcategory\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides= (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess= iff(OptionalOverrides, false, RequireSuccess)\r\n // presence-only\r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= 1, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= 1, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail),\r\n OverReason = case(OverSucc and OverFail, \"Success+Failure\",\r\n OverSucc, \"Success\",\r\n OverFail, \"Failure\", \"\")\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, Category, Subcategory, Status, OverCollected, OverReason;\r\n\r\n// 6) Aggregation & verdicts\r\n// 6.1) Status ordering (impact rank) + helpers\r\nlet StatusOrder = datatable(Status:string, Ord:int)\r\n[\r\n \"Missing (both)\", 0,\r\n \"Missing Failure\", 1,\r\n \"Missing Success\", 2,\r\n \"Over-collected\", 3,\r\n \"OK\", 4,\r\n \"OK (not required)\", 4,\r\n \"N/A\", 5\r\n];\r\nlet Ord2Status = datatable(Ord:int, WorstStatus:string)\r\n[\r\n 0, \"Missing (both)\",\r\n 1, \"Missing Failure\",\r\n 2, \"Missing Success\",\r\n 3, \"Over-collected\",\r\n 4, \"OK\",\r\n 5, \"N/A\"\r\n];\r\n// 6.2) Normalize status and attach ordering\r\nlet Base =\r\n PerHost_MW\r\n | extend StatusNorm = case(\r\n Status == \"OK (not required)\", \"OK\",\r\n isempty(Status), \"N/A\",\r\n Status\r\n )\r\n | join kind=leftouter (StatusOrder) on $left.StatusNorm == $right.Status\r\n | project Category, Subcategory, Computer, Ord,\r\n OverCollected = tobool(column_ifexists(\"OverCollected\", false)),\r\n OverReason;\r\n// 6.3) Totals per (Category, Subcategory)\r\nlet Totals =\r\n Base\r\n | summarize TotalHosts = dcount(Computer) by Category, Subcategory;\r\n// 6.4) Worst rank per (Category, Subcategory)\r\nlet WorstPerCat =\r\n Base\r\n | summarize WorstOrd = min(Ord) by Category, Subcategory;\r\n// 6.5) Count affected hosts at the worst rank and collect over-collection reasons\r\nlet WorstCount =\r\n Base\r\n | join kind=inner (WorstPerCat) on Category, Subcategory\r\n | where Ord == WorstOrd\r\n | summarize AffectedHosts = dcount(Computer),\r\n OverReasons = make_set_if(OverReason, OverCollected and isnotempty(OverReason))\r\n by Category, Subcategory, WorstOrd;\r\n// 6.6) Final projection\r\nWorstCount\r\n| join kind=leftouter (Ord2Status) on $left.WorstOrd == $right.Ord\r\n| join kind=leftouter (Totals) on Category, Subcategory\r\n| extend PercentAffected = todouble(AffectedHosts) / todouble(TotalHosts) * 100.0\r\n| extend Verdict = iff(WorstStatus == \"Over-collected\" and array_length(OverReasons) > 0,\r\n strcat(\"Over-collected (\", tostring(OverReasons[0]), \")\"),\r\n WorstStatus)\r\n| project Category,\r\n Subcategory,\r\n Verdict,\r\n PercentAffected = round(PercentAffected, 1),\r\n AffectedHosts,\r\n TotalHosts\r\n| order by Category asc, Subcategory asc\r\n", "size": 0, "title": "Member Server and Workstation Audit Summary", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Verdict", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray" }, { "operator": "==", "thresholdValue": "Missing Failure", "representation": "red" }, { "operator": "==", "thresholdValue": "Missing (both)", "representation": "redBright" }, { "operator": "==", "thresholdValue": "Missing Success", "representation": "orange" }, { "operator": "==", "thresholdValue": "OK", "representation": "green" }, { "operator": "startsWith", "thresholdValue": "Over-collected", "representation": "yellow" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "PercentAffected", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "grayBlue" } } ] } }, "customWidth": "100", "name": "ServersDetails", "styleSettings": { "maxWidth": "100" } } ] }, "customWidth": "50", "name": "Group-MachinesSummary", "styleSettings": { "maxWidth": "50" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "38e8face-baae-40d2-9ada-10490e6207b7", "version": "KqlParameterItem/1.0", "name": "HiveScope", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n { \"value\": \"All\", \"label\": \"All\", \"selected\":true },\r\n { \"value\": \"Domain Controller\", \"label\": \"Domain Controllers\" },\r\n { \"value\": \"Member/Workstation\", \"label\": \"Member Servers and Workstations\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "label": "Scope", "value": "Member/Workstation" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ===============================================\r\n// Sentinel Windows Audit Coverage - Config-driven Overview (Hive by Category)\r\n// ===============================================\r\n//\r\n// Purpose:\r\n// - Config-driven overview across both roles (DCs + Member/Workstation) with role filter.\r\n// - Highlights missing required auditing and over-collection at the subcategory level.\r\n// - Presence/volume is controlled by MinCount (defaults to 1 here).\r\n//\r\n// Inputs:\r\n// - TimeRange (start, end)\r\n// - PolicyProfile: \"General\" | \"Stronger\" (defaults to General if invalid)\r\n// - HiveScope: \"All\" | \"Domain Controller\" | \"Member/Workstation\" (defaults to All)\r\n// - SecurityEvent table\r\n//\r\n// Output (per subcategory = one Hive node):\r\n// - %OK, %NotOK, host counts, placeholder flag (for empty subcategories)\r\n//\r\n// -----------------------------------------------\r\n// 0) Parameters / context\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 1;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\nlet P_RoleRaw = tostring(\"{HiveScope}\");\r\nlet P_Role = iif(P_RoleRaw in (\"All\",\"Domain Controller\",\"Member/Workstation\"), P_RoleRaw, \"All\");\r\n\r\n// Which subcategories to include by their Scope:\r\n// - For Member/Workstation we include only Scope == \"All\"\r\n// - For DC and All we include both \"All\" and \"DC\"\r\nlet P_Scopes = case(P_Role == \"Member/Workstation\", dynamic([\"All\"]), dynamic([\"All\",\"DC\"]));\r\n\r\n// 1) Subcategory configuration (Category / Scope / in-scope EventIDs)\r\n// EventID sets bound the scope; outcome (Success/Failure) is derived from Keywords.\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n //\"Non Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\n// 2) Policy matrix (requirements per Role/Profile)\r\n// - RequireSuccess / RequireFailure: presence requirements\r\n// - SuccessOptional: if true and Failure is not required, Success requirement can be relaxed\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n \r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false, \r\n\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n\r\n\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"General\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n// \"Non Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n\r\n\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n\r\n\r\n\r\n\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n\r\n];\r\n// 3) Host population & role inference\r\n// 3.1) Build the base host set from ALL configured EventIDs (Success + Failure)\r\n\r\nlet AllEventIds_Early =\r\n (\r\n SubcatConfig\r\n | mv-expand e = SuccessEvents\r\n | project EventID = toint(e)\r\n )\r\n | union\r\n (\r\n SubcatConfig\r\n | mv-expand e = FailureEvents\r\n | project EventID = toint(e)\r\n )\r\n | summarize by EventID;\r\nlet BaseHosts =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (AllEventIds_Early)\r\n | summarize by Computer;\r\n\r\n// 3.2) DC heuristic (Kerberos AS/TGS events imply Domain Controller)\r\nlet DCHeuristic =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer\r\n | extend IsDC = true;\r\n\r\n// 3.3) Final roles for all base hosts\r\nlet Roles =\r\n BaseHosts\r\n | join kind=leftouter DCHeuristic on Computer\r\n | extend Role = iff(IsDC == true, \"Domain Controller\", \"Member/Workstation\")\r\n | project Computer, Role;\r\n\r\n// 4) Event mapping & labeling\r\n// 4.1) Build EventID → (Category, Subcategory, Scope) map (union, dedup)\r\nlet EventMap = materialize(\r\n (\r\n SubcatConfig\r\n | mv-expand EventID = SuccessEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | union\r\n (\r\n SubcatConfig\r\n | mv-expand EventID = FailureEvents\r\n | project Subcategory, Category, Scope, EventID = toint(EventID)\r\n )\r\n | summarize by Subcategory, Category, Scope, EventID);\r\n\r\n// 4.2) Label events by joining SecurityEvent with EventMap (ID pushdown)\r\nlet LabeledEvents =\r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (EventMap | project EventID) // pushdown по ID\r\n | join kind=inner hint.strategy=broadcast (EventMap) on EventID\r\n | project Computer, Category, Subcategory, Scope, Keywords;\r\n\r\n\r\n// 5) Outcome classification, counts, and universe by scope\r\n// 5.1) Classify outcomes from Keywords; count per host×subcategory\r\nlet EventSummary =\r\n LabeledEvents\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\",\"Success\",\r\n Keywords == \"0x8010000000000000\",\"Failure\",\"Unknown\")\r\n | summarize\r\n SuccessCnt = countif(Outcome==\"Success\"),\r\n FailureCnt = countif(Outcome==\"Failure\"),\r\n Total = count()\r\n by Computer, Category, Subcategory, Scope;\r\n\r\n// 5.2) Build role-aware universe by selected scopes (P_Scopes)\r\nlet AllComputers = LabeledEvents | summarize by Computer;\r\nlet AllScopeHosts = AllComputers | extend Scope = \"All\";\r\nlet DCsOnly = Roles | where Role == \"Domain Controller\" | project Computer | extend Scope = \"DC\";\r\nlet SubcatsByScope = SubcatConfig | where Scope in (P_Scopes) | project Subcategory, Category, Scope;\r\nlet Universe =\r\n (AllScopeHosts | union DCsOnly)\r\n | join kind=inner SubcatsByScope on Scope\r\n | project Computer, Category, Subcategory, Scope;\r\n\r\n\r\n// 6) Per-host status evaluation\r\n// 6.1) Join roles, counts, and policy; apply role filter (P_Role)\r\nlet PerHost =\r\n Universe\r\n | lookup (Roles) on Computer // маленькая справка → авто-broadcast справа\r\n| extend Role = coalesce(Role, \"Member/Workstation\")\r\n| where P_Role == \"All\" or Role == P_Role\r\n | join kind=leftouter EventSummary on Computer, Category, Subcategory\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0))\r\n| lookup (PolicyMatrix | where Profile == PolicyProfile) on Subcategory, Role\r\n| extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n // 6.2) Effective requirements (optional override can relax Success) \r\n| extend NoRequirement = (not(RequireSuccess) and not(RequireFailure)) \r\n| extend OptionalOverrides= (SuccessOptional and RequireSuccess and not(RequireFailure)) \r\n| extend EffRequireSuccess= iff(OptionalOverrides, false, RequireSuccess)\r\n// 6.3) Required presence checks (MinCount threshold)\r\n| extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= MinCount, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= MinCount, true)\r\n // 6.4) Over-collection detection (collecting when not required)\r\n| extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n| extend OverCollected = (OverSucc or OverFail),\r\n OverReason = case(OverSucc and OverFail, \"Success+Failure\",\r\n OverSucc, \"Success\",\r\n OverFail, \"Failure\",\r\n \"\")\r\n// 6.5) Final status assignment \r\n| extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n| project Computer, Category, Subcategory, Status, OverCollected, OverReason;\r\n\r\n\r\n// 7) Overview (Hive heatmap grouped by Category) — one tile per Subcategory\r\n// 7.1) Bucketize per-host status into OK / Not OK / N/A\r\nlet Summary =\r\n PerHost\r\n | extend Bucket = case(\r\n Status in (\"OK\",\"OK (not required)\"), \"OK\",\r\n Status == \"N/A\", \"N/A\",\r\n \"Not OK\") // сюда попадёт и \"Over-collected\"\r\n | summarize Hosts = dcount(Computer) by Category, Subcategory, Bucket;\r\n\r\n// 7.2) Aggregate counts and compute %OK / %NotOK among decided hosts\r\nlet SubcatAgg =\r\n Summary\r\n | summarize \r\n OK = sumif(Hosts, Bucket==\"OK\"),\r\n NotOK = sumif(Hosts, Bucket==\"Not OK\"),\r\n NA = sumif(Hosts, Bucket==\"N/A\")\r\n by Category, Subcategory\r\n | extend TotalHosts = OK + NotOK + NA,\r\n Den = toreal(OK + NotOK)\r\n | extend OkPct = iff(Den==0.0, real(0), round(100.0 * toreal(OK) / Den, 1)),\r\n NotOkPct = iff(Den==0.0, real(0), round(100.0 * toreal(NotOK) / Den, 1));\r\n\r\n// 7.3) Mark placeholders (subcategories with no EventIDs configured)\r\nlet SubcatFlags =\r\n SubcatConfig\r\n | extend IsPlaceholder = iif(array_length(SuccessEvents)==0 and array_length(FailureEvents)==0, true, false)\r\n | project Category, Subcategory, IsPlaceholder;\r\n\r\n// 7.4) Final dataset for Hive: exactly one node per subcategory\r\nSubcatAgg\r\n| join kind=leftouter SubcatFlags on Category, Subcategory\r\n| extend NodeId = strcat(Category, \"|\", Subcategory) // unique node id across categories\r\n| extend OkPct=iff(IsPlaceholder,100.0,OkPct)\r\n| extend Value = OkPct \r\n| project NodeId, Category, Subcategory, Hosts=TotalHosts, Value, OkPct, NotOkPct,IsPlaceholder\r\n", "size": 0, "title": "Audit Heat Map - {HiveScope}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "graph", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Subcategory", "formatter": 1 }, "leftContent": { "columnMatch": "OkPct", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Subcategory", "formatter": 1 }, "centerContent": { "columnMatch": "OkPct", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "hivesContent": { "columnMatch": "Category", "formatter": 1 }, "nodeIdField": "NodeId", "graphOrientation": 2, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "OkPct", "type": 4, "heatmapPalette": "redGreen", "heatmapMin": null, "heatmapMax": null }, "groupByField": "Category", "hivesMargin": 1, "edgeColorSettings": null } }, "name": "query - 0" } ] }, "customWidth": "50", "name": "group - 4" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Overview" }, "name": "GroupOverview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Coverage Analytics\r\n\r\nDetailed audit coverage analysis by subcategory. Select a subcategory to view detailed coverage metrics.\r\n" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "coverage-subcategory-selector", "version": "KqlParameterItem/1.0", "name": "SelectedSubcategory", "label": "📋 Select Subcategory", "type": 10, "isRequired": true, "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Credential Validation\\\", \\\"label\\\": \\\"Account Logon | Credential Validation\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Kerberos Authentication Service\\\", \\\"label\\\": \\\"Account Logon | Kerberos Authentication Service\\\" },\\r\\n { \\\"value\\\": \\\"Kerberos Service Ticket Operations\\\", \\\"label\\\": \\\"Account Logon | Kerberos Service Ticket Operations\\\" },\\r\\n { \\\"value\\\": \\\"Other Account Logon Events\\\", \\\"label\\\": \\\"Account Logon | Other Account Logon Events\\\" },\\r\\n { \\\"value\\\": \\\"Computer Account Management\\\", \\\"label\\\": \\\"Account Management | Computer Account Management\\\" },\\r\\n { \\\"value\\\": \\\"Other Account Management Events\\\", \\\"label\\\": \\\"Account Management | Other Account Management Events\\\" },\\r\\n { \\\"value\\\": \\\"Security Group Management\\\", \\\"label\\\": \\\"Account Management | Security Group Management\\\" },\\r\\n { \\\"value\\\": \\\"User Account Management\\\", \\\"label\\\": \\\"Account Management | User Account Management\\\" },\\r\\n { \\\"value\\\": \\\"PNP Activity\\\", \\\"label\\\": \\\"Detailed Tracking | PNP Activity\\\" },\\r\\n { \\\"value\\\": \\\"Process Creation\\\", \\\"label\\\": \\\"Detailed Tracking | Process Creation\\\" },\\r\\n { \\\"value\\\": \\\"Process Termination\\\", \\\"label\\\": \\\"Detailed Tracking | Process Termination\\\" },\\r\\n { \\\"value\\\": \\\"RPC Events\\\", \\\"label\\\": \\\"Detailed Tracking | RPC Events\\\" },\\r\\n { \\\"value\\\": \\\"Detailed Directory Service Replication\\\", \\\"label\\\": \\\"DS Access | Detailed Directory Service Replication\\\" },\\r\\n { \\\"value\\\": \\\"Directory Service Access\\\", \\\"label\\\": \\\"DS Access | Directory Service Access\\\" },\\r\\n { \\\"value\\\": \\\"Directory Service Changes\\\", \\\"label\\\": \\\"DS Access | Directory Service Changes\\\" },\\r\\n { \\\"value\\\": \\\"Directory Service Replication\\\", \\\"label\\\": \\\"DS Access | Directory Service Replication\\\" },\\r\\n { \\\"value\\\": \\\"Account Lockout\\\", \\\"label\\\": \\\"Logon and Logoff | Account Lockout\\\" },\\r\\n { \\\"value\\\": \\\"User/Device Claims\\\", \\\"label\\\": \\\"Logon and Logoff | User/Device Claims\\\" },\\r\\n { \\\"value\\\": \\\"Group Membership\\\", \\\"label\\\": \\\"Logon and Logoff | Group Membership\\\" },\\r\\n { \\\"value\\\": \\\"Logoff\\\", \\\"label\\\": \\\"Logon and Logoff | Logoff\\\" },\\r\\n { \\\"value\\\": \\\"Logon\\\", \\\"label\\\": \\\"Logon and Logoff | Logon\\\" },\\r\\n { \\\"value\\\": \\\"Special Logon\\\", \\\"label\\\": \\\"Logon and Logoff | Special Logon\\\" },\\r\\n { \\\"value\\\": \\\"Other Logon/Logoff Events\\\", \\\"label\\\": \\\"Logon and Logoff | Other Logon/Logoff Events\\\" },\\r\\n { \\\"value\\\": \\\"Detailed File Share\\\", \\\"label\\\": \\\"Object Access | Detailed File Share\\\" },\\r\\n { \\\"value\\\": \\\"File Share\\\", \\\"label\\\": \\\"Object Access | File Share\\\" },\\r\\n { \\\"value\\\": \\\"Filtering Platform Connection\\\", \\\"label\\\": \\\"Object Access | Filtering Platform Connection\\\" },\\r\\n { \\\"value\\\": \\\"Filtering Platform Packet Drop\\\", \\\"label\\\": \\\"Object Access | Filtering Platform Packet Drop\\\" },\\r\\n { \\\"value\\\": \\\"Handle Manipulation\\\", \\\"label\\\": \\\"Object Access | Handle Manipulation\\\" },\\r\\n { \\\"value\\\": \\\"Kernel Object\\\", \\\"label\\\": \\\"Object Access | Kernel Object\\\" },\\r\\n { \\\"value\\\": \\\"Other Object Access Events\\\", \\\"label\\\": \\\"Object Access | Other Object Access Events\\\" },\\r\\n { \\\"value\\\": \\\"Removable Storage\\\", \\\"label\\\": \\\"Object Access | Removable Storage\\\" },\\r\\n { \\\"value\\\": \\\"Central Policy Staging\\\", \\\"label\\\": \\\"Object Access | Central Policy Staging\\\" },\\r\\n { \\\"value\\\": \\\"Policy Change\\\", \\\"label\\\": \\\"Policy Change | Policy Change\\\" },\\r\\n { \\\"value\\\": \\\"Authentication Policy Change\\\", \\\"label\\\": \\\"Policy Change | Authentication Policy Change\\\" },\\r\\n { \\\"value\\\": \\\"Authorization Policy Change\\\", \\\"label\\\": \\\"Policy Change | Authorization Policy Change\\\" },\\r\\n { \\\"value\\\": \\\"MPSSVC Rule-Level Policy Change\\\", \\\"label\\\": \\\"Policy Change | MPSSVC Rule-Level Policy Change\\\" },\\r\\n { \\\"value\\\": \\\"Other Policy Change Events\\\", \\\"label\\\": \\\"Policy Change | Other Policy Change Events\\\" },\\r\\n { \\\"value\\\": \\\"Other Privilege Use Events\\\", \\\"label\\\": \\\"Privilege Use | Other Privilege Use Events\\\" },\\r\\n { \\\"value\\\": \\\"Sensitive Privilege Use\\\", \\\"label\\\": \\\"Privilege Use | Sensitive Privilege Use\\\" },\\r\\n { \\\"value\\\": \\\"Other System Events\\\", \\\"label\\\": \\\"System | Other System Events\\\" },\\r\\n { \\\"value\\\": \\\"Security State Change\\\", \\\"label\\\": \\\"System | Security State Change\\\" },\\r\\n { \\\"value\\\": \\\"Security System Extension\\\", \\\"label\\\": \\\"System | Security System Extension\\\" },\\r\\n { \\\"value\\\": \\\"System Integrity\\\", \\\"label\\\": \\\"System | System Integrity\\\" }\\r\\n]\",\"transformers\":null}", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 8 }, { "id": "subcategory-info-param", "version": "KqlParameterItem/1.0", "name": "SubcategoryInfo", "type": 1, "isRequired": false, "query": "let SelectedSubcat = \"{SelectedSubcategory}\";\r\nlet SubcatConfig = datatable(Subcategory:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n \"Other Privilege Use Events\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\nlet EventIDDesc = datatable(EventID:int, Description:string)\r\n[\r\n 4608,\"Windows is starting up\",4609,\"Windows is shutting down\",4610,\"Authentication package loaded\",4611,\"Trusted logon process registered\",4612,\"Audit message queue exhausted\",4614,\"Notification package loaded\",4615,\"Invalid LPC port use\",4616,\"System time changed\",4618,\"Security event pattern occurred\",4621,\"Admin recovered from CrashOnAuditFail\",4622,\"Security package loaded\",4624,\"Account successfully logged on\",4625,\"Account failed to log on\",4626,\"User/Device claims info\",4627,\"Group membership info\",4634,\"Account logged off\",4647,\"User initiated logoff\",4648,\"Logon with explicit credentials\",4649,\"Replay attack detected\",4656,\"Handle to object requested\",4658,\"Handle to object closed\",4660,\"Object deleted\",4661,\"Handle to object requested\",4662,\"Operation on object\",4663,\"Attempt to access object\",4672,\"Special privileges assigned\",4673,\"Privileged service called\",4674,\"Operation on privileged object\",4675,\"SIDs filtered\",4688,\"New process created\",4689,\"Process exited\",4690,\"Handle duplication attempt\",4691,\"Indirect object access\",4696,\"Primary token assigned\",4697,\"Service installed\",4698,\"Scheduled task created\",4699,\"Scheduled task deleted\",4700,\"Scheduled task enabled\",4701,\"Scheduled task disabled\",4702,\"Scheduled task updated\",4703,\"Token right adjusted\",4704,\"User right assigned\",4705,\"User right removed\",4706,\"Trust to domain created\",4707,\"Trust to domain removed\",4713,\"Kerberos policy changed\",4714,\"Encrypted recovery policy changed\",4715,\"Audit policy (SACL) changed\",4716,\"Trusted domain info modified\",4717,\"Security access granted\",4718,\"Security access removed\",4719,\"System audit policy changed\",4720,\"User account created\",4722,\"User account enabled\",4723,\"Password change attempt\",4724,\"Password reset attempt\",4725,\"User account disabled\",4726,\"User account deleted\",4727,\"Global group created\",4728,\"Member added to global group\",4729,\"Member removed from global group\",4730,\"Global group deleted\",4731,\"Local group created\",4732,\"Member added to local group\",4733,\"Member removed from local group\",4734,\"Local group deleted\",4735,\"Local group changed\",4737,\"Global group changed\",4738,\"User account changed\",4739,\"Domain policy changed\",4740,\"User account locked out\",4741,\"Computer account created\",4742,\"Computer account changed\",4743,\"Computer account deleted\",4754,\"Universal group created\",4755,\"Universal group changed\",4756,\"Member added to universal group\",4757,\"Member removed from universal group\",4758,\"Universal group deleted\",4764,\"Group type changed\",4765,\"User account unlocked\",4766,\"Password change attempt\",4767,\"User account unlocked\",4768,\"Kerberos TGT requested\",4769,\"Kerberos service ticket requested\",4770,\"Kerberos ticket renewed\",4771,\"Kerberos pre-auth failed\",4772,\"Kerberos TGT request failed\",4773,\"Kerberos service ticket failed\",4774,\"Account mapped for logon\",4775,\"Account mapping failed\",4776,\"Credential validation attempt\",4777,\"Credential validation failed\",4778,\"Session reconnected\",4779,\"Session disconnected\",4780,\"ACL set on admin accounts\",4781,\"Account name changed\",4782,\"Password hash accessed\",4793,\"Password policy API called\",4794,\"DSRM password set attempt\",4798,\"Local group membership enumerated\",4799,\"Security group membership enumerated\",4800,\"Workstation locked\",4801,\"Workstation unlocked\",4802,\"Screen saver invoked\",4803,\"Screen saver dismissed\",4816,\"RPC integrity violation\",4817,\"Auditing settings changed\",4818,\"Central policy mismatch\",4819,\"Central policies changed\",4826,\"Boot config data loaded\",4864,\"Namespace collision\",4865,\"Forest info entry added\",4866,\"Forest info entry removed\",4867,\"Forest info entry modified\",4902,\"Per-user audit policy created\",4904,\"Security event source registered\",4905,\"Security event source unregistered\",4906,\"CrashOnAuditFail changed\",4907,\"Auditing settings changed\",4908,\"Special groups table modified\",4911,\"Object resource attributes changed\",4912,\"Per-user audit policy changed\",4913,\"Central policy on object changed\",4928,\"AD replica source established\",4929,\"AD replica source removed\",4930,\"AD replica source modified\",4931,\"AD replica destination modified\",4932,\"Naming context sync begun\",4933,\"Naming context sync ended\",4934,\"AD object attributes replicated\",4935,\"Replication failure began\",4936,\"Replication failure ended\",4937,\"Lingering object removed\",4944,\"Firewall started\",4945,\"Firewall rule listed\",4946,\"Firewall rule added\",4947,\"Firewall rule modified\",4948,\"Firewall rule deleted\",4949,\"Firewall settings reset\",4950,\"Firewall setting changed\",4951,\"Firewall rule ignored (version)\",4952,\"Firewall rule parts ignored\",4953,\"Firewall rule unparseable\",4954,\"Firewall GPO settings changed\",4956,\"Firewall profile changed\",4957,\"Firewall rule not applied\",4958,\"Firewall rule not configured\",4964,\"Special groups assigned\",4985,\"Transaction state changed\",5024,\"Firewall service started\",5025,\"Firewall service stopped\",5027,\"Firewall policy retrieval failed\",5028,\"Firewall policy parse failed\",5029,\"Firewall driver init failed\",5030,\"Firewall service start failed\",5032,\"Firewall user notification failed\",5033,\"Firewall driver started\",5034,\"Firewall driver stopped\",5035,\"Firewall driver start failed\",5037,\"Firewall driver runtime error\",5038,\"Code integrity hash invalid\",5056,\"Cryptographic self-test\",5057,\"Cryptographic primitive failed\",5058,\"Key file operation\",5059,\"Key migration operation\",5060,\"Verification failed\",5061,\"Cryptographic operation\",5062,\"Kernel crypto self-test\",5063,\"Crypto provider operation\",5064,\"Crypto context operation\",5065,\"Crypto context modification\",5066,\"Crypto function operation\",5067,\"Crypto function modification\",5068,\"Crypto function provider\",5069,\"Crypto function property\",5070,\"Crypto function property\",5136,\"Directory object modified\",5137,\"Directory object created\",5138,\"Directory object undeleted\",5139,\"Directory object moved\",5140,\"Network share accessed\",5141,\"Directory object deleted\",5142,\"Network share added\",5143,\"Network share modified\",5144,\"Network share deleted\",5145,\"Network share access checked\",5148,\"Network share access ability\",5149,\"Network share access ability\",5152,\"WFP blocked packet\",5153,\"WFP filter blocked packet\",5154,\"WFP permitted listen\",5155,\"WFP blocked listen\",5156,\"WFP allowed connection\",5157,\"WFP blocked connection\",5158,\"WFP permitted bind\",5159,\"WFP blocked bind\",5168,\"WFP protocol mismatch\",5376,\"Credential Manager backup\",5377,\"Credential Manager restore\",5378,\"Credentials delegation disallowed\",5447,\"WFP callout present\",5632,\"Wireless auth request\",5633,\"Wired auth request\",5712,\"RPC attempted\",5888,\"COM+ object modified\",5889,\"COM+ object deleted\",5890,\"COM+ object added\",6144,\"GPO security policy applied\",6145,\"GPO security policy errors\",6281,\"Code integrity page hashes invalid\",6410,\"Code integrity file rejected\",6416,\"External device recognized\",6419,\"Device disable requested\",6420,\"Device disabled\",6421,\"Device enable requested\",6422,\"Device enabled\",6423,\"Device installation forbidden\",6424,\"Device installation allowed\"\r\n];\r\nlet SubcatSummary = datatable(Subcategory:string, Summary:string)\r\n[\r\n \"Credential Validation\",\"Events generated by credential validation on the computer responsible for validating credentials.\",\r\n \"Kerberos Authentication Service\",\"Events generated by Kerberos TGT requests to the domain controller.\",\r\n \"Kerberos Service Ticket Operations\",\"Events generated by Kerberos service ticket requests from KDC.\",\r\n \"Other Account Logon Events\",\"Other account-related logon events like RDP or network logon.\",\r\n \"Computer Account Management\",\"Events when computer accounts are created, changed, deleted, renamed, disabled, or enabled.\",\r\n \"Other Account Management Events\",\"Other account management events like password hash access.\",\r\n \"Security Group Management\",\"Events when security groups are created, changed, deleted, or membership modified.\",\r\n \"User Account Management\",\"Events when user accounts are created, changed, deleted, renamed, disabled, enabled, or passwords changed.\",\r\n \"PNP Activity\",\"Events when plug and play detects an external device.\",\r\n \"Process Creation\",\"Events when a process is created or started. Generates many events.\",\r\n \"Process Termination\",\"Events when a process exits.\",\r\n \"RPC Events\",\"Events for inbound RPC connections.\",\r\n \"Detailed Directory Service Replication\",\"Detailed AD DS replication events.\",\r\n \"Directory Service Access\",\"Events when AD DS objects with SACL are accessed.\",\r\n \"Directory Service Changes\",\"Events when changes are made to AD DS objects.\",\r\n \"Directory Service Replication\",\"Events when replication between DCs begins and ends.\",\r\n \"Account Lockout\",\"Events when accounts are locked out due to failed logon attempts.\",\r\n \"User/Device Claims\",\"User and device claim information in logon tokens.\",\r\n \"Group Membership\",\"Group membership information in logon tokens.\",\r\n \"Logoff\",\"Events when users log off.\",\r\n \"Logon\",\"Events when users attempt to log on or off, including network logon validation.\",\r\n \"Special Logon\",\"Events for logons with admin-equivalent privileges.\",\r\n \"Detailed File Share\",\"Events when file shares are accessed. Generates many events.\",\r\n \"File Share\",\"Events when shared folders are accessed.\",\r\n \"Filtering Platform Connection\",\"Events when WFP allows or blocks connections.\",\r\n \"Filtering Platform Packet Drop\",\"Events when WFP drops packets. Generates many events.\",\r\n \"Handle Manipulation\",\"Events when handles to objects are opened or closed.\",\r\n \"Kernel Object\",\"Events when handles to kernel objects are requested.\",\r\n \"Other Object Access Events\",\"Other object access events like Task Scheduler and COM+.\",\r\n \"Removable Storage\",\"Events when removable storage devices are accessed.\",\r\n \"Central Policy Staging\",\"Events for Central Access Policy staging on file servers.\",\r\n \"Policy Change\",\"Events for policy rule changes including audit policy.\",\r\n \"Authentication Policy Change\",\"Events for authentication policy changes including Kerberos.\",\r\n \"Authorization Policy Change\",\"Events for authorization policy changes including user rights.\",\r\n \"MPSSVC Rule-Level Policy Change\",\"Events for Windows Firewall rule changes.\",\r\n \"Other Policy Change Events\",\"Other security policy changes not in other subcategories.\",\r\n \"Other Privilege Use Events\",\"Other privilege use events not in Sensitive Privilege Use.\",\r\n \"Sensitive Privilege Use\",\"Events when sensitive privileges are used to change security or view data.\",\r\n \"Other System Events\",\"Other system-level events not in other subcategories.\",\r\n \"Security State Change\",\"Events when security state changes like startup or shutdown.\",\r\n \"Security System Extension\",\"Events when security extension code like auth packages is loaded.\",\r\n \"System Integrity\",\"Events when security subsystem integrity is violated.\",\r\n \"Other Logon/Logoff Events\",\"Other logon/logoff events like RDP disconnects, RunAs, workstation lock/unlock.\"\r\n];\r\nlet SubcatInfo = SubcatConfig | where Subcategory == SelectedSubcat | take 1;\r\nlet Summary = toscalar(SubcatSummary | where Subcategory == SelectedSubcat | project Summary);\r\nlet SuccessIDs = SubcatInfo | mv-expand e = SuccessEvents | project EventID = toint(e);\r\nlet FailureIDs = SubcatInfo | mv-expand e = FailureEvents | project EventID = toint(e);\r\nlet AllIDs = (SuccessIDs | extend T = \"S\") | union (FailureIDs | extend T = \"F\") | summarize Ts = make_set(T) by EventID | extend Lbl = iif(array_length(Ts)==2,\"(S,F)\",iif(Ts[0]==\"S\",\"(S)\",\"(F)\"));\r\nlet EvList = AllIDs | join kind=leftouter EventIDDesc on EventID | extend Txt = strcat(\"- **\",tostring(EventID),\"**\",Lbl,\": \",coalesce(Description,\"N/A\")) | order by EventID asc | summarize L = make_list(Txt);\r\nlet EvTxt = iif(toscalar(EvList|count)>0,strcat(\"\\n\\n**Events:**\\n\",toscalar(EvList|project strcat_array(L,\"\\n\"))),\"\\n\\n**Events:** None\");\r\nprint v = strcat(\"**Summary:** \",Summary,EvTxt) | project v", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 8 }, "name": "parameters - subcategory" }, { "type": 1, "content": { "json": "### Audit {SelectedSubcategory}\r\n\r\n{SubcategoryInfo}" }, "name": "text - subcategory-header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ===============================================\r\n// Sentinel Windows Audit Coverage - Universal Coverage Query\r\n// ===============================================\r\n// Purpose: Universal coverage analysis for any selected subcategory\r\n// Uses presence-only model (MinCount = 1) and efficient approaches from Overview\r\n// -----------------------------------------------\r\n\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 1; // Presence-only model\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\nlet SelectedSubcat = tostring(\"{SelectedSubcategory}\");\r\n\r\n// 1) Subcategory configuration (same as Overview)\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\n// 2) Policy matrix (same as Overview)\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n];\r\n\r\n// 3) Get selected subcategory config and build EventID list\r\nlet SubcatInfo = SubcatConfig | where Subcategory == SelectedSubcat | take 1;\r\nlet SelectedScope = tostring(toscalar(SubcatInfo | project Scope));\r\n\r\n// 4) Build EventID list for filtering (using mv-expand directly on dynamic arrays)\r\nlet AllEventIDs = \r\n (SubcatInfo | mv-expand EventID = SuccessEvents | project EventID = toint(EventID))\r\n | union\r\n (SubcatInfo | mv-expand EventID = FailureEvents | project EventID = toint(EventID))\r\n | summarize by EventID;\r\n\r\n// 5) Role inference (DC heuristic)\r\nlet DCsOnly = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer;\r\n\r\n// 6) Get hosts based on scope\r\nlet RelevantHosts = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | summarize by Computer\r\n | join kind=leftouter (DCsOnly | extend IsDC = true) on Computer\r\n | extend IsDC = isnotempty(IsDC)\r\n | extend Role = iff(IsDC, \"Domain Controller\", \"Member/Workstation\")\r\n | where (SelectedScope == \"All\" or (SelectedScope == \"DC\" and IsDC))\r\n | project Computer, Role;\r\n\r\n// 7) Event summary (presence-only)\r\nlet EventSummary = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | join kind=inner hint.strategy=broadcast (RelevantHosts | project Computer) on Computer\r\n | join kind=inner hint.strategy=broadcast (AllEventIDs) on EventID\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\", \"Success\",\r\n Keywords == \"0x8010000000000000\", \"Failure\",\r\n \"Unknown\")\r\n | summarize\r\n SuccessCnt = max(toint(Outcome == \"Success\")),\r\n FailureCnt = max(toint(Outcome == \"Failure\"))\r\n by Computer\r\n | extend Total = SuccessCnt + FailureCnt;\r\n\r\n// 8) Per-host evaluation\r\nlet PerHost = \r\n RelevantHosts\r\n | join kind=leftouter EventSummary on Computer\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0))\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Subcategory == SelectedSubcat) on Role\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides = (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess = iff(OptionalOverrides, false, RequireSuccess)\r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= MinCount, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= MinCount, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail)\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, SuccessCnt, FailureCnt, Status;\r\n\r\n// 9) Summary by bucket\r\nPerHost\r\n| extend Bucket = case(\r\n Status in (\"OK\", \"OK (not required)\"), \"OK\",\r\n Status == \"N/A\", \"N/A\",\r\n \"Not OK\")\r\n| summarize Hosts = dcount(Computer) by Bucket\r\n| project Bucket = tostring(Bucket), Hosts\r\n", "size": 0, "title": "Summary", "noDataMessage": "No data available", "exportFieldName": "", "exportParameterName": "SelectedBucket", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "OK", "color": "green" }, { "seriesName": "OK (not required)", "color": "greenDark" }, { "seriesName": "Not OK", "color": "redBright" }, { "seriesName": "Missing (both)", "color": "redBright" }, { "seriesName": "Missing Failure", "color": "red" }, { "seriesName": "Missing Success", "color": "orange" }, { "seriesName": "Over-collected", "color": "yellow" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "30", "name": "query - summary", "styleSettings": { "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Universal coverage query - Domain Controllers\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 1;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\nlet SelectedSubcat = tostring(\"{SelectedSubcategory}\");\r\n\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n];\r\n\r\nlet SubcatInfo = SubcatConfig | where Subcategory == SelectedSubcat | take 1;\r\nlet SelectedScope = tostring(toscalar(SubcatInfo | project Scope));\r\nlet AllEventIDs = \r\n (SubcatInfo | mv-expand EventID = SuccessEvents | project EventID = toint(EventID))\r\n | union\r\n (SubcatInfo | mv-expand EventID = FailureEvents | project EventID = toint(EventID))\r\n | summarize by EventID;\r\nlet DCsOnly = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer;\r\nlet RelevantHosts = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | summarize by Computer\r\n | join kind=leftouter (DCsOnly | extend IsDC = true) on $left.Computer == $right.Computer\r\n | extend IsDC = isnotempty(IsDC)\r\n | extend Role = iff(IsDC, \"Domain Controller\", \"Member/Workstation\")\r\n | where (SelectedScope == \"All\" or (SelectedScope == \"DC\" and IsDC))\r\n | project Computer, Role;\r\nlet EventSummary = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | join kind=inner hint.strategy=broadcast (RelevantHosts | project Computer) on $left.Computer == $right.Computer\r\n | join kind=inner hint.strategy=broadcast (AllEventIDs) on $left.EventID == $right.EventID\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\", \"Success\",\r\n Keywords == \"0x8010000000000000\", \"Failure\",\r\n \"Unknown\")\r\n | summarize\r\n SuccessCnt = max(toint(Outcome == \"Success\")),\r\n FailureCnt = max(toint(Outcome == \"Failure\"))\r\n by Computer\r\n | extend Total = SuccessCnt + FailureCnt;\r\nlet PerHost = \r\n RelevantHosts\r\n | join kind=leftouter EventSummary on Computer\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0))\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Subcategory == SelectedSubcat) on Role\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides = (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess = iff(OptionalOverrides, false, RequireSuccess)\r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= MinCount, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= MinCount, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail)\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, SuccessCnt, FailureCnt, Status;\r\nlet StatusOrder = datatable(Status:string, Ord:int)\r\n[\r\n \"Missing (both)\", 0,\r\n \"Missing Failure\", 1,\r\n \"Missing Success\", 2,\r\n \"Over-collected\", 3,\r\n \"OK\", 4,\r\n \"OK (not required)\", 4,\r\n \"N/A\", 5\r\n];\r\nPerHost\r\n| where Role == \"Domain Controller\"\r\n| summarize Hosts = dcount(Computer) by Status\r\n| join kind=leftouter StatusOrder on Status\r\n| order by Ord asc\r\n| project Status, Hosts\r\n", "size": 0, "title": "Domain Controllers Auditing", "color": "blueDark", "noDataMessage": "No data available!", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "", "parameterName": "SelectedRoleStatus", "parameterType": 1, "defaultValue": "All" }, { "fieldName": "Role", "parameterName": "SelectedRole", "parameterType": 1, "defaultValue": "All" } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "OK", "color": "green" }, { "seriesName": "OK (not required)", "color": "greenDark" }, { "seriesName": "Missing (both)", "color": "redBright" }, { "seriesName": "Missing Failure", "color": "red" }, { "seriesName": "Missing Success", "color": "orange" }, { "seriesName": "Over-collected", "color": "yellow" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "30", "name": "query - dc", "styleSettings": { "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Universal coverage query - Member/Workstation\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 1;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\nlet SelectedSubcat = tostring(\"{SelectedSubcategory}\");\r\n\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n];\r\n\r\nlet SubcatInfo = SubcatConfig | where Subcategory == SelectedSubcat | take 1;\r\nlet SelectedScope = tostring(toscalar(SubcatInfo | project Scope));\r\nlet AllEventIDs = \r\n (SubcatInfo | mv-expand EventID = SuccessEvents | project EventID = toint(EventID))\r\n | union\r\n (SubcatInfo | mv-expand EventID = FailureEvents | project EventID = toint(EventID))\r\n | summarize by EventID;\r\nlet DCsOnly = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer;\r\nlet RelevantHosts = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | summarize by Computer\r\n | join kind=leftouter (DCsOnly | extend IsDC = true) on $left.Computer == $right.Computer\r\n | extend IsDC = isnotempty(IsDC)\r\n | extend Role = iff(IsDC, \"Domain Controller\", \"Member/Workstation\")\r\n | where (SelectedScope == \"All\" or (SelectedScope == \"DC\" and IsDC))\r\n | project Computer, Role;\r\nlet EventSummary = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | join kind=inner hint.strategy=broadcast (RelevantHosts | project Computer) on $left.Computer == $right.Computer\r\n | join kind=inner hint.strategy=broadcast (AllEventIDs) on $left.EventID == $right.EventID\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\", \"Success\",\r\n Keywords == \"0x8010000000000000\", \"Failure\",\r\n \"Unknown\")\r\n | summarize\r\n SuccessCnt = max(toint(Outcome == \"Success\")),\r\n FailureCnt = max(toint(Outcome == \"Failure\"))\r\n by Computer\r\n | extend Total = SuccessCnt + FailureCnt;\r\nlet PerHost = \r\n RelevantHosts\r\n | join kind=leftouter EventSummary on Computer\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0))\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Subcategory == SelectedSubcat) on Role\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides = (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess = iff(OptionalOverrides, false, RequireSuccess)\r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= MinCount, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= MinCount, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail)\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, SuccessCnt, FailureCnt, Status;\r\nlet StatusOrder = datatable(Status:string, Ord:int)\r\n[\r\n \"Missing (both)\", 0,\r\n \"Missing Failure\", 1,\r\n \"Missing Success\", 2,\r\n \"Over-collected\", 3,\r\n \"OK\", 4,\r\n \"OK (not required)\", 4,\r\n \"N/A\", 5\r\n];\r\nPerHost\r\n| where Role == \"Member/Workstation\"\r\n| summarize Hosts = dcount(Computer) by Status\r\n| join kind=leftouter StatusOrder on Status\r\n| order by Ord asc\r\n| project Status, Hosts\r\n", "size": 0, "title": "Member servers / workstations", "noDataMessage": "No data available", "timeContextFromParameter": "TimeRange", "exportFieldName": "", "exportParameterName": "SelectedRoleStatus", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "OK", "color": "green" }, { "seriesName": "OK (not required)", "color": "greenDark" }, { "seriesName": "Missing (both)", "color": "redBright" }, { "seriesName": "Missing Failure", "color": "red" }, { "seriesName": "Missing Success", "color": "orange" }, { "seriesName": "Over-collected", "color": "yellow" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "30", "name": "query - mw", "styleSettings": { "margin": "0", "padding": "10px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "coverage-show-details", "version": "KqlParameterItem/1.0", "name": "ShowDetails", "label": "Show computer details", "type": 10, "isRequired": true, "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Hide\\\", \\\"label\\\": \\\"Hide\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Show\\\", \\\"label\\\": \\\"Show\\\" }\\r\\n ]\",\"transformers\":null}", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 8 } ], "style": "pills", "queryType": 8 }, "name": "parameters - show-details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Universal coverage query - Computer Details\r\nset query_results_cache_max_age = time(10m);\r\nset query_results_cache_per_shard;\r\nlet start = {TimeRange:start};\r\nlet end = {TimeRange:end};\r\nlet MinCount = 1;\r\nlet PolicyProfileRaw = tostring(\"{PolicyProfile}\");\r\nlet PolicyProfile = iif(PolicyProfileRaw in (\"General\",\"Stronger\"), PolicyProfileRaw, \"General\");\r\nlet SelectedSubcat = tostring(\"{SelectedSubcategory}\");\r\n\r\nlet SubcatConfig = datatable(Subcategory:string, Category:string, Scope:string, SuccessEvents:dynamic, FailureEvents:dynamic)\r\n[\r\n \"Credential Validation\", \"Account Logon\", \"All\", dynamic([4774,4776]), dynamic([4775,4777]),\r\n \"Kerberos Authentication Service\", \"Account Logon\", \"DC\", dynamic([4768]), dynamic([4771,4772]),\r\n \"Kerberos Service Ticket Operations\", \"Account Logon\", \"DC\", dynamic([4769,4770]), dynamic([4769,4773]),\r\n \"Other Account Logon Events\", \"Account Logon\", \"All\", dynamic([]), dynamic([]),\r\n \"Computer Account Management\", \"Account Management\", \"DC\", dynamic([4741,4742,4743]), dynamic([]),\r\n \"Other Account Management Events\", \"Account Management\", \"All\", dynamic([4782,4793]), dynamic([]),\r\n \"Security Group Management\", \"Account Management\", \"All\", dynamic([4727,4737,4728,4729,4730,4731,4732,4733,4734,4735,4754,4755,4756,4757,4758,4764,4799]), dynamic([]),\r\n \"User Account Management\", \"Account Management\", \"All\", dynamic([4720,4722,4723,4724,4725,4726,4738,4740,4765,4767,4780,4781,4794,4798,5376,5377]), dynamic([4723,4724,4766,4794]),\r\n \"PNP Activity\", \"Detailed Tracking\", \"All\", dynamic([6416,6419,6420,6421,6422,6423,6424]), dynamic([]),\r\n \"Process Creation\", \"Detailed Tracking\", \"All\", dynamic([4688,4696]), dynamic([]),\r\n \"Process Termination\", \"Detailed Tracking\", \"All\", dynamic([4689]), dynamic([]),\r\n \"RPC Events\", \"Detailed Tracking\", \"All\", dynamic([5712]), dynamic([]),\r\n \"Detailed Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4928,4929,4930,4931,4934,4936,4937]), dynamic([4928,4929,4930,4931,4935]),\r\n \"Directory Service Access\", \"DS Access\", \"DC\", dynamic([4662,4661]), dynamic([4662,4661]),\r\n \"Directory Service Changes\", \"DS Access\", \"DC\", dynamic([5136,5137,5138,5139,5141]), dynamic([]),\r\n \"Directory Service Replication\", \"DS Access\", \"DC\", dynamic([4932,4933]), dynamic([4933]),\r\n \"Account Lockout\", \"Logon and Logoff\",\"All\", dynamic([]), dynamic([4625]),\r\n \"User/Device Claims\", \"Logon and Logoff\",\"All\", dynamic([4626]), dynamic([]),\r\n \"Group Membership\", \"Logon and Logoff\",\"All\", dynamic([4627]), dynamic([]),\r\n \"Logoff\", \"Logon and Logoff\",\"All\", dynamic([4634,4647]), dynamic([]),\r\n \"Logon\", \"Logon and Logoff\",\"All\", dynamic([4624,4648,4675]), dynamic([4625]),\r\n \"Special Logon\", \"Logon and Logoff\",\"All\", dynamic([4964,4672]), dynamic([]),\r\n \"Detailed File Share\", \"Object Access\",\"All\", dynamic([5145]), dynamic([5145]),\r\n \"File Share\", \"Object Access\",\"All\", dynamic([5140,5142,5143,5144]), dynamic([5140,5168]),\r\n \"Filtering Platform Connection\", \"Object Access\",\"All\", dynamic([5154,5156,5158]), dynamic([5031,5155,5157,5159]),\r\n \"Filtering Platform Packet Drop\", \"Object Access\",\"All\", dynamic([5153]), dynamic([5152]),\r\n \"Handle Manipulation\", \"Object Access\",\"All\", dynamic([4658,4690]), dynamic([]),\r\n \"Kernel Object\", \"Object Access\",\"All\", dynamic([4656,4658,4660,4663]), dynamic([4656]),\r\n \"Other Object Access Events\", \"Object Access\",\"All\", dynamic([4691,4698,4699,4700,4701,4702,5888,5889,5890]), dynamic([5148,5149]),\r\n \"Removable Storage\", \"Object Access\",\"All\", dynamic([4656,4658,4663]), dynamic([4656]),\r\n \"Central Policy Staging\", \"Object Access\",\"All\", dynamic([4818]), dynamic([]),\r\n \"Policy Change\", \"Policy Change\",\"All\", dynamic([4715,4719,4817,4902,4906,4907,4908,4912,4904,4905]), dynamic([]),\r\n \"Authentication Policy Change\", \"Policy Change\",\"All\", dynamic([4670,4706,4707,4716,4713,4717,4718,4739,4864,4865,4866,4867]), dynamic([]),\r\n \"Authorization Policy Change\", \"Policy Change\",\"All\", dynamic([4703,4704,4705,4670,4911,4913]), dynamic([]),\r\n \"MPSSVC Rule-Level Policy Change\", \"Policy Change\",\"All\", dynamic([4944,4945,4946,4947,4948,4949,4950,4954,4956]), dynamic([4951,4952,4953,4957,4958]),\r\n \"Other Policy Change Events\", \"Policy Change\",\"All\", dynamic([4714,4819,4826,5063,5064,5065,5066,5067,5068,5069,5070,5447,6144]), dynamic([5063,5064,5065,5066,5067,5068,5069,5070,6145]),\r\n \"Other Privilege Use Events\", \"Privilege Use\",\"All\", dynamic([4985]), dynamic([]),\r\n \"Sensitive Privilege Use\", \"Privilege Use\",\"All\", dynamic([4673,4674,4985]), dynamic([4673,4674]),\r\n \"Other System Events\", \"System\",\"All\", dynamic([5024,5025,5033,5034,5058,5059]), dynamic([5027,5028,5029,5030,5032,5035,5037,5058,5059]),\r\n \"Security State Change\", \"System\",\"All\", dynamic([4608,4609,4616,4621]), dynamic([]),\r\n \"Security System Extension\", \"System\",\"All\", dynamic([4610,4611,4614,4622,4697]), dynamic([]),\r\n \"System Integrity\", \"System\",\"All\", dynamic([4612,4615,4618,4816,5056,5062,5061]), dynamic([5038,5057,5060,5061,6281,6410]),\r\n \"Other Logon/Logoff Events\", \"Logon and Logoff\",\"All\", dynamic([4649,4778,4779,4800,4801,4802,4803,5632,5633]), dynamic([5378])\r\n];\r\n\r\nlet PolicyMatrix = datatable(Subcategory:string, Role:string, Profile:string, RequireSuccess:bool, RequireFailure:bool, SuccessOptional:bool)\r\n[\r\n \"Credential Validation\", \"Domain Controller\", \"General\", false, true, true,\r\n \"Credential Validation\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Credential Validation\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Credential Validation\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Authentication Service\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Authentication Service\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kerberos Service Ticket Operations\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Kerberos Service Ticket Operations\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Logon Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Account Logon Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Computer Account Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Computer Account Management\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Account Management Events\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Other Account Management Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security Group Management\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security Group Management\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"User Account Management\", \"Domain Controller\", \"General\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"User Account Management\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"User Account Management\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"PNP Activity\", \"Domain Controller\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"PNP Activity\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"PNP Activity\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Process Creation\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Process Creation\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Process Termination\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Process Termination\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Process Termination\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"RPC Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"RPC Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"RPC Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Detailed Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Detailed Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Access\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Directory Service Access\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Changes\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Directory Service Changes\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Directory Service Replication\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Directory Service Replication\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Account Lockout\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Account Lockout\", \"Domain Controller\", \"Stronger\", false, true, false,\r\n \"Account Lockout\", \"Member/Workstation\", \"Stronger\", false, true, false,\r\n \"User/Device Claims\", \"Domain Controller\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"User/Device Claims\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"User/Device Claims\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Group Membership\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Group Membership\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Group Membership\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Logoff\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Logoff\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Logon/Logoff Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Special Logon\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Special Logon\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Special Logon\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Detailed File Share\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Detailed File Share\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Detailed File Share\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"File Share\", \"Domain Controller\", \"General\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"File Share\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"File Share\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"General\", false, true, false,\r\n \"Filtering Platform Connection\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Connection\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Filtering Platform Packet Drop\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Handle Manipulation\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Handle Manipulation\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Kernel Object\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Kernel Object\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other Object Access Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other Object Access Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Removable Storage\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Removable Storage\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Central Policy Staging\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Central Policy Staging\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Central Policy Staging\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Authentication Policy Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Authentication Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"General\", true, false, true,\r\n \"Authorization Policy Change\", \"Domain Controller\", \"Stronger\", true, false, true,\r\n \"Authorization Policy Change\", \"Member/Workstation\", \"Stronger\", true, false, true,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"MPSSVC Rule-Level Policy Change\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"General\", true, true, true,\r\n \"Other Policy Change Events\", \"Domain Controller\", \"Stronger\", true, true, true,\r\n \"Other Policy Change Events\", \"Member/Workstation\", \"Stronger\", true, true, true,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"General\", false, false, false,\r\n \"Other Privilege Use Events\", \"Domain Controller\", \"Stronger\", false, false, false,\r\n \"Other Privilege Use Events\", \"Member/Workstation\", \"Stronger\", false, false, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Sensitive Privilege Use\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Other System Events\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Other System Events\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Security State Change\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security State Change\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security State Change\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"General\", true, false, false,\r\n \"Security System Extension\", \"Domain Controller\", \"Stronger\", true, false, false,\r\n \"Security System Extension\", \"Member/Workstation\", \"Stronger\", true, false, false,\r\n \"System Integrity\", \"Domain Controller\", \"General\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"System Integrity\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"System Integrity\", \"Member/Workstation\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"General\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"General\", true, true, false,\r\n \"Logon\", \"Domain Controller\", \"Stronger\", true, true, false,\r\n \"Logon\", \"Member/Workstation\", \"Stronger\", true, true, false\r\n];\r\n\r\nlet SubcatInfo = SubcatConfig | where Subcategory == SelectedSubcat | take 1;\r\nlet SelectedScope = tostring(toscalar(SubcatInfo | project Scope));\r\nlet AllEventIDs = \r\n (SubcatInfo | mv-expand EventID = SuccessEvents | project EventID = toint(EventID))\r\n | union\r\n (SubcatInfo | mv-expand EventID = FailureEvents | project EventID = toint(EventID))\r\n | summarize by EventID;\r\nlet DCsOnly = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | where EventID in (4768, 4769, 4771)\r\n | summarize by Computer;\r\nlet RelevantHosts = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | summarize by Computer\r\n | join kind=leftouter (DCsOnly | extend IsDC = true) on $left.Computer == $right.Computer\r\n | extend IsDC = isnotempty(IsDC)\r\n | extend Role = iff(IsDC, \"Domain Controller\", \"Member/Workstation\")\r\n | where (SelectedScope == \"All\" or (SelectedScope == \"DC\" and IsDC))\r\n | project Computer, Role;\r\nlet EventSummary = \r\n SecurityEvent\r\n | where TimeGenerated between (start .. end)\r\n | join kind=inner hint.strategy=broadcast (RelevantHosts | project Computer) on $left.Computer == $right.Computer\r\n | join kind=inner hint.strategy=broadcast (AllEventIDs) on $left.EventID == $right.EventID\r\n | extend Outcome = case(\r\n Keywords == \"0x8020000000000000\", \"Success\",\r\n Keywords == \"0x8010000000000000\", \"Failure\",\r\n \"Unknown\")\r\n | summarize\r\n SuccessCnt = max(toint(Outcome == \"Success\")),\r\n FailureCnt = max(toint(Outcome == \"Failure\"))\r\n by Computer\r\n | extend Total = SuccessCnt + FailureCnt;\r\nlet PerHost = \r\n RelevantHosts\r\n | join kind=leftouter EventSummary on Computer\r\n | extend SuccessCnt = tolong(coalesce(SuccessCnt, 0)),\r\n FailureCnt = tolong(coalesce(FailureCnt, 0)),\r\n Total = tolong(coalesce(Total, 0))\r\n | join kind=leftouter hint.strategy=broadcast (PolicyMatrix | where Profile == PolicyProfile and Subcategory == SelectedSubcat) on Role\r\n | extend RequireSuccess = tobool(RequireSuccess),\r\n RequireFailure = tobool(RequireFailure),\r\n SuccessOptional = tobool(SuccessOptional)\r\n | extend NoRequirement = (not(RequireSuccess) and not(RequireFailure))\r\n | extend OptionalOverrides = (SuccessOptional and RequireSuccess and not(RequireFailure))\r\n | extend EffRequireSuccess = iff(OptionalOverrides, false, RequireSuccess)\r\n | extend SuccessOK = iff(EffRequireSuccess, SuccessCnt >= MinCount, true),\r\n FailureOK = iff(RequireFailure, FailureCnt >= MinCount, true)\r\n | extend OverSucc = (not(EffRequireSuccess) and SuccessCnt > 0),\r\n OverFail = (not(RequireFailure) and FailureCnt > 0)\r\n | extend OverCollected = (OverSucc or OverFail)\r\n | extend Status = case(\r\n NoRequirement and Total == 0, \"OK (not required)\",\r\n NoRequirement and Total > 0, \"Over-collected\",\r\n OptionalOverrides and Total == 0, \"OK (not required)\",\r\n OptionalOverrides and Total > 0, \"OK\",\r\n not(SuccessOK) and not(FailureOK), \"Missing (both)\",\r\n not(SuccessOK), \"Missing Success\",\r\n not(FailureOK), \"Missing Failure\",\r\n OverCollected, \"Over-collected\",\r\n \"OK\")\r\n | project Computer, Role, SuccessCnt, FailureCnt, Status;\r\nlet StatusOrder = datatable(Status:string, Ord:int)\r\n[\r\n \"Missing (both)\", 0,\r\n \"Missing Failure\", 1,\r\n \"Missing Success\", 2,\r\n \"Over-collected\", 3,\r\n \"OK\", 4,\r\n \"OK (not required)\", 4,\r\n \"N/A\", 5\r\n];\r\nlet P_BucketRaw = '{SelectedBucket}';\r\nlet P_Bucket = iif(P_BucketRaw == \"All\", \"All\",\r\n iif(isnull(parse_json(P_BucketRaw).series),\r\n P_BucketRaw,\r\n tostring(parse_json(P_BucketRaw).series)));\r\nPerHost\r\n| extend Bucket = case(\r\n Status in (\"OK\", \"OK (not required)\"), \"OK\",\r\n Status == \"N/A\", \"N/A\",\r\n \"Not OK\")\r\n| where (P_Bucket == \"All\"\r\n or (P_Bucket == \"OK\" and Status in (\"OK\", \"OK (not required)\"))\r\n or (P_Bucket == \"N/A\" and Status == \"N/A\")\r\n or (P_Bucket == \"Not OK\" and Status !in (\"OK\", \"OK (not required)\", \"N/A\")))\r\n| join kind=leftouter StatusOrder on Status\r\n| order by Ord asc, Computer asc\r\n| project Computer, Role, Status\r\n", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "OK", "representation": "green" }, { "operator": "==", "thresholdValue": "OK (not required)", "representation": "greenDark" }, { "operator": "==", "thresholdValue": "Missing (both)", "representation": "redBright" }, { "operator": "==", "thresholdValue": "Missing Failure", "representation": "red" }, { "operator": "==", "thresholdValue": "Missing Success", "representation": "orange" }, { "operator": "==", "thresholdValue": "Over-collected", "representation": "yellow" }, { "operator": "==", "thresholdValue": "N/A", "representation": "gray" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "rowLimit": 50, "filter": true, "sortBy": [ { "itemKey": "Role", "sortOrder": 1 }, { "itemKey": "Status", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Role", "sortOrder": 1 }, { "itemKey": "Status", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "ShowDetails", "comparison": "isEqualTo", "value": "Show" }, "name": "query - details" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Coverage" }, "name": "groupCoverage" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cb5f9584-e6f3-411e-b39a-f31d226e309e", "version": "KqlParameterItem/1.0", "name": "VMsSubscriptions", "type": 6, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [], "includeAll": false }, "timeContext": { "durationMs": 86400000 }, "value": [ "", "" ], "label": "☁️ Analyze Subscriptions (make sure to include Sentinel's subscription)" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 1, "content": { "json": "## DCR Deduplication Analysis\n\nThis tab identifies **duplicate SecurityEvent collection** across Data Collection Rules (DCRs) associated with your VMs and Arc-enabled servers.\n\n**Why it matters:** When multiple DCRs collect the same EventIDs from a single machine, you pay for duplicate ingestion without additional security value.\n\n**How to fix:** Review the conflicts below and consolidate EventID collection into a single DCR per machine, or remove overlapping EventIDs from one of the DCRs." }, "name": "text - dcr-header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(\n (\n (insightsresources\n | where type =~ 'microsoft.insights/datacollectionruleassociations'\n | extend pa=todynamic(properties))\n | project dcrId=tolower(tostring(pa.dataCollectionRuleId)),\n targetResourceId=tostring(\n substring(tolower(id), 0,\n indexof(tolower(id), '/providers/microsoft.insights/datacollectionruleassociations/')))\n )\n | join kind=inner (\n resources\n | where type =~ 'microsoft.insights/datacollectionrules'\n | extend p=todynamic(properties)\n | where isnotempty(p.dataFlows)\n | mv-expand flow=p.dataFlows\n | mv-expand stream=flow.streams\n | where stream =~ 'Microsoft-SecurityEvent'\n | mv-expand destName=flow.destinations\n | mv-expand la=p.destinations.logAnalytics\n | where tostring(la.name) == tostring(destName)\n | extend laWs=tolower(tostring(la.workspaceResourceId))\n | where laWs == tolower('{Workspace}')\n | project dcrId=tolower(id), dcrName=name, p\n | mv-expand we=p.dataSources.windowsEventLogs\n | where array_index_of(we.streams, 'Microsoft-SecurityEvent') >= 0\n | mv-expand xp=we.xPathQueries\n | extend ev = extract_all(@\"EventID\\s*=\\s*(\\d+)\", tostring(xp))\n | mv-expand eventId = ev\n | extend eventId = toint(eventId)\n | summarize eventIds = make_set(eventId, 5000) by dcrId, dcrName\n ) on dcrId\n | project targetResourceId, dcrId, dcrName, eventIds\n)\n| summarize dcrs = make_list(pack('dcrId', dcrId, 'dcrName', dcrName, 'eventIds', eventIds))\n by targetResourceId\n| mv-expand a = dcrs\n| mv-expand b = dcrs\n| extend a_dcr = tostring(a.dcrId), b_dcr = tostring(b.dcrId)\n| extend cmp = strcmp(a_dcr, b_dcr)\n| where cmp < 0\n| extend overlap = set_intersect(todynamic(a.eventIds), todynamic(b.eventIds))\n| where array_length(overlap) > 0\n| summarize AffectedHosts = dcount(targetResourceId)", "size": 4, "title": "🖥️ Hosts with Duplicates", "noDataMessage": "✅ No duplicates found!", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{VMsSubscriptions}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "AffectedHosts", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, "showBorder": true } }, "customWidth": "15", "name": "query - dcr-hosts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(\n (\n (insightsresources\n | where type =~ 'microsoft.insights/datacollectionruleassociations'\n | extend pa=todynamic(properties))\n | project dcrId=tolower(tostring(pa.dataCollectionRuleId)),\n targetResourceId=tostring(\n substring(tolower(id), 0,\n indexof(tolower(id), '/providers/microsoft.insights/datacollectionruleassociations/')))\n )\n | join kind=inner (\n resources\n | where type =~ 'microsoft.insights/datacollectionrules'\n | extend p=todynamic(properties)\n | where isnotempty(p.dataFlows)\n | mv-expand flow=p.dataFlows\n | mv-expand stream=flow.streams\n | where stream =~ 'Microsoft-SecurityEvent'\n | mv-expand destName=flow.destinations\n | mv-expand la=p.destinations.logAnalytics\n | where tostring(la.name) == tostring(destName)\n | extend laWs=tolower(tostring(la.workspaceResourceId))\n | where laWs == tolower('{Workspace}')\n | project dcrId=tolower(id), dcrName=name, p\n | mv-expand we=p.dataSources.windowsEventLogs\n | where array_index_of(we.streams, 'Microsoft-SecurityEvent') >= 0\n | mv-expand xp=we.xPathQueries\n | extend ev = extract_all(@\"EventID\\s*=\\s*(\\d+)\", tostring(xp))\n | mv-expand eventId = ev\n | extend eventId = toint(eventId)\n | summarize eventIds = make_set(eventId, 5000) by dcrId, dcrName\n ) on dcrId\n | project targetResourceId, dcrId, dcrName, eventIds\n)\n| summarize dcrs = make_list(pack('dcrId', dcrId, 'dcrName', dcrName, 'eventIds', eventIds))\n by targetResourceId\n| mv-expand a = dcrs\n| mv-expand b = dcrs\n| extend a_dcr = tostring(a.dcrId), b_dcr = tostring(b.dcrId)\n| extend cmp = strcmp(a_dcr, b_dcr)\n| where cmp < 0\n| extend overlap = set_intersect(todynamic(a.eventIds), todynamic(b.eventIds))\n| where array_length(overlap) > 0\n| mv-expand dupId = overlap\n| summarize dupEventIDs = make_set(tolong(dupId), 5000) by targetResourceId\n| extend dupEventCount = array_length(dupEventIDs)\n| summarize TotalDuplicateEventIDs = sum(dupEventCount)", "size": 4, "title": "📋 Total Duplicate EventIDs", "noDataMessage": "✅ No duplicates!", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{VMsSubscriptions}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "TotalDuplicateEventIDs", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, "showBorder": true } }, "customWidth": "15", "name": "query - dcr-eventids" }, { "type": 1, "content": { "json": "### DCR Pair Conflicts" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(\r\n (\r\n // Pull Data Collection Rule Associations (DCRAs) from the provider-scoped table.\r\n // Each DCRA represents a binding between a Data Collection Rule (DCR) and a target resource (e.g., VM/Arc machine).\r\n (insightsresources\r\n | where type =~ 'microsoft.insights/datacollectionruleassociations'\r\n | extend pa=todynamic(properties))\r\n // Normalize the DCR id to lowercase for reliable joins later,\r\n // and derive the parent target resource id by stripping the DCRA suffix from the DCRA resource id (case-insensitive).\r\n | project dcrId=tolower(tostring(pa.dataCollectionRuleId)),\r\n targetResourceId=tostring(\r\n substring(tolower(id), 0,\r\n indexof(tolower(id), '/providers/microsoft.insights/datacollectionruleassociations/')))\r\n )\r\n | join kind=inner (\r\n // From all DCRs, keep only those that:\r\n // 1) have dataFlows,\r\n // 2) include the Microsoft-SecurityEvent stream,\r\n // 3) send to the selected Log Analytics workspace (match by destination name).\r\n resources\r\n | where type =~ 'microsoft.insights/datacollectionrules'\r\n | extend p=todynamic(properties)\r\n | where isnotempty(p.dataFlows)\r\n | mv-expand flow=p.dataFlows\r\n | mv-expand stream=flow.streams\r\n | where stream =~ 'Microsoft-SecurityEvent'\r\n | mv-expand destName=flow.destinations\r\n | mv-expand la=p.destinations.logAnalytics\r\n | where tostring(la.name) == tostring(destName)\r\n // Normalize the workspace resource id and filter to the chosen workspace.\r\n | extend laWs=tolower(tostring(la.workspaceResourceId))\r\n | where laWs == tolower('{Workspace}')\r\n // Keep DCR identity and payload; normalize id to lowercase to match the DCRA join key. \r\n | project dcrId=tolower(id), dcrName=name, p\r\n // From the DCR, enumerate windowsEventLogs data sources that send to Microsoft-SecurityEvent. \r\n | mv-expand we=p.dataSources.windowsEventLogs\r\n | where array_index_of(we.streams, 'Microsoft-SecurityEvent') >= 0\r\n // Extract EventIDs from XPath queries (e.g., \"...(EventID=4624) or (EventID=4625)...\").\r\n | mv-expand xp=we.xPathQueries\r\n | extend ev = extract_all(@\"EventID\\s*=\\s*(\\d+)\", tostring(xp))\r\n | mv-expand eventId = ev\r\n | extend eventId = toint(eventId)\r\n // Build a unique set of EventIDs per DCR (this is the collection fingerprint we will intersect across DCRs).\r\n | summarize eventIds = make_set(eventId, 5000) by dcrId, dcrName\r\n ) on dcrId\r\n // At this point we have, per target machine, each attached DCR and its explicit EventID set. \r\n | project targetResourceId, dcrId, dcrName, eventIds\r\n)\r\n // Build all unordered DCR pairs per target (machine) from the single list, without re-querying any remote table.\r\n| summarize dcrs = make_list(pack('dcrId', dcrId, 'dcrName', dcrName, 'eventIds', eventIds))\r\n by targetResourceId\r\n| mv-expand a = dcrs\r\n| mv-expand b = dcrs\r\n// Keep only one direction of each pair and drop self-pairs using a stable string comparison of DCR ids.\r\n| extend a_dcr = tostring(a.dcrId), b_dcr = tostring(b.dcrId)\r\n| extend cmp = strcmp(a_dcr, b_dcr)\r\n| where cmp < 0 \r\n// Compute the intersection of EventID sets for the DCR pair on the same machine.\r\n| extend overlap = set_intersect(todynamic(a.eventIds), todynamic(b.eventIds))\r\n// Only surface pairs that actually have overlapping EventIDs (i.e., potential duplicate collection).\r\n| where array_length(overlap) > 0\r\n// Final shape: machine, the two conflicting DCRs (as resource IDs for clickable links), and the list/count of overlapping EventIDs.\r\n| project targetResourceId,\r\n dcrA = tostring(a.dcrId),\r\n dcrB = tostring(b.dcrId),\r\n overlapCount = array_length(overlap),\r\n overlapEventIDs = overlap\r\n| order by overlapCount desc, targetResourceId asc\r\n", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{VMsSubscriptions}" ], "gridSettings": { "formatters": [ { "columnMatch": "targetResourceId", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "dcrA", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "dcrB", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "overlapCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "80px" } } ] } }, "customWidth": "100", "name": "query - 0", "styleSettings": { "padding": "5" } }, { "type": 1, "content": { "json": "---\r\n### Host Duplicate Rollup" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(\r\n (\r\n // Retrieve Data Collection Rule Associations (DCRAs) - each is a binding of a DCR to a target resource (e.g., VM/Arc server).\r\n // Use the provider-scoped table insightsresources for consistent discovery across subscriptions.\r\n (insightsresources\r\n | where type =~ 'microsoft.insights/datacollectionruleassociations'\r\n | extend pa=todynamic(properties))\r\n // Prepare join keys:\r\n // - Normalize the DCR id to lowercase for exact string equality in joins.\r\n // - Derive the parent (target) resource id by removing the association suffix from the DCRA id (case-insensitive).\r\n | project dcrId=tolower(tostring(pa.dataCollectionRuleId)),\r\n targetResourceId=tostring(\r\n substring(tolower(id), 0,\r\n indexof(tolower(id), '/providers/microsoft.insights/datacollectionruleassociations/')))\r\n )\r\n | join kind=inner (\r\n // From all DCRs, keep only those that send the Microsoft-SecurityEvent stream to the selected workspace.\r\n resources\r\n | where type =~ 'microsoft.insights/datacollectionrules'\r\n | extend p=todynamic(properties)\r\n // Only consider DCRs that actually define dataFlows.\r\n | where isnotempty(p.dataFlows)\r\n // Unroll flows and streams to find Microsoft-SecurityEvent.\r\n | mv-expand flow=p.dataFlows\r\n | mv-expand stream=flow.streams\r\n | where stream =~ 'Microsoft-SecurityEvent'\r\n // Match each flow to its Log Analytics destination by name.\r\n | mv-expand destName=flow.destinations\r\n | mv-expand la=p.destinations.logAnalytics\r\n | where tostring(la.name) == tostring(destName)\r\n // Keep only flows targeting the chosen workspace (use lowercase for robust comparison).\r\n | extend laWs=tolower(tostring(la.workspaceResourceId))\r\n | where laWs == tolower('{Workspace}')\r\n // Preserve the DCR identity and payload for EventID extraction; normalize id to lowercase to match DCRA key.\r\n | project dcrId=tolower(id), dcrName=name, p\r\n // From each DCR, enumerate windowsEventLogs data sources that map to Microsoft-SecurityEvent.\r\n | mv-expand we=p.dataSources.windowsEventLogs\r\n | where array_index_of(we.streams, 'Microsoft-SecurityEvent') >= 0\r\n // Extract explicit EventIDs from XPath queries (e.g., \"(EventID=4624) or (EventID=4625) ...\").\r\n // Note: very broad XPaths (e.g., \"Security!*\") won't yield explicit IDs and thus won't appear here.\r\n | mv-expand xp=we.xPathQueries\r\n | extend ev = extract_all(@\"EventID\\s*=\\s*(\\d+)\", tostring(xp))\r\n | mv-expand eventId = ev\r\n | extend eventId = toint(eventId)\r\n // Build a unique EventID set per DCR - this becomes the fingerprint for overlap checks.\r\n // (This does not subtract exclusions defined via transformKql)\r\n | summarize eventIds = make_set(eventId, 5000) by dcrId, dcrName\r\n ) on dcrId\r\n // At this point: for each target resource, we have each attached DCR and its set of explicitly collected EventIDs.\r\n | project targetResourceId, dcrId, dcrName, eventIds\r\n)\r\n// Consolidate all DCRs for a given target into a single list of objects so we can build pairs locally (no extra remote reads).\r\n| summarize dcrs = make_list(pack('dcrId', dcrId, 'dcrName', dcrName, 'eventIds', eventIds))\r\n by targetResourceId\r\n// Create all unordered DCR pairs per target by expanding the single list twice.\r\n| mv-expand a = dcrs\r\n| mv-expand b = dcrs\r\n// Keep only one direction of the pair and exclude self-pairs via a stable string comparison on normalized DCR ids.\r\n| extend a_dcr = tostring(a.dcrId), b_dcr = tostring(b.dcrId)\r\n| extend cmp = strcmp(a_dcr, b_dcr)\r\n| where cmp < 0\r\n// Compute the intersection of EventID sets for the DCR pair on the same machine.\r\n// If the intersection is non-empty, the pair is at risk of duplicate collection/billing for those EventIDs.\r\n| extend overlap = set_intersect(todynamic(a.eventIds), todynamic(b.eventIds))\r\n| where array_length(overlap) > 0\r\n// Expand overlapping EventIDs to aggregate unique duplicate IDs and participating DCRs per target.\r\n| mv-expand dupId = overlap\r\n| summarize dupEventIDs = make_set(tolong(dupId), 5000),\r\n dcrIdsA = make_set(tostring(a.dcrId), 128),\r\n dcrIdsB = make_set(tostring(b.dcrId), 128)\r\n by targetResourceId\r\n// Union left/right DCR ID sets to get the unique set of DCRs involved in any overlap on the target.\r\n| extend dcrIds = set_union(dcrIdsA, dcrIdsB)\r\n// Compute handy counters: number of overlapping DCRs and number of duplicate EventIDs.\r\n| extend dcrCount = array_length(dcrIds),\r\n dupEventCount = array_length(dupEventIDs)\r\n// Final shape for dashboarding: one row per target with counts, the duplicate EventID list, and the overlapping DCR IDs.\r\n| project targetResourceId, dcrCount, dupEventCount, dupEventIDs, dcrIds\r\n| order by dupEventCount desc, targetResourceId asc\r\n", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{VMsSubscriptions}" ], "gridSettings": { "formatters": [ { "columnMatch": "targetResourceId", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "dcrIds", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "dupEventCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "100px" } } ] } }, "customWidth": "100", "name": "query - 1", "styleSettings": { "padding": "5" } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DCR" }, "name": "DCRTab" } ], "styleSettings": {}, "fromTemplateId": "sentinel-WindowsAuditChecker", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }