{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Vectra RUX Security Dashboard", "style": "upsell" }, "name": "workbook-title" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "67d14413-6eca-4803-b447-c9c7f744ce43", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Entity", "subTarget": "Entity", "style": "link" }, { "id": "cbc93b75-3cc9-4191-b334-0d44c7652ce0", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Detections", "subTarget": "Detections", "style": "link" }, { "id": "919866f6-87e0-479f-969f-eedc7d970251", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Lockdown", "subTarget": "Lockdown", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c2e47223-15df-44b3-8040-0bfc72eeab0a", "version": "KqlParameterItem/1.0", "name": "timerange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "f909ea8d-ce5f-41a1-8b26-d2e34169f149", "version": "KqlParameterItem/1.0", "name": "View", "label": "Prioritized", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "jsonData": "[\r\n { \"value\":\"true\", \"label\":\"Yes\" },\r\n { \"value\":\"false\", \"label\":\"No\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "true" ] }, { "id": "732ba446-ecc2-49fd-be25-53ee45d3f9c2", "version": "KqlParameterItem/1.0", "name": "DataSource", "label": "Data Source Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"AWS\", \"label\":\"AWS\"},\r\n {\"value\":\"EntraID\",\"label\":\"Entra ID\"},\r\n {\"value\":\"Azure\",\"label\":\"Azure\"},\r\n {\"value\":\"Network\",\"label\":\"Network\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "e2fa7c64-c20c-4e7b-9557-81c64f2c5b58", "version": "KqlParameterItem/1.0", "name": "EntityType", "label": "Entity Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let Types = VectraEntities | where ['Last Updated'] {timerange} | distinct Type | project Type\n| where isnotempty(Type)\n| distinct Type;\nTypes\n| extend splitted_entity_type = split(Type, \"_\")\n| mv-expand splitted_entity_type\n| extend cap = toupper(substring(splitted_entity_type,0,1)), rest_string = substring(splitted_entity_type,1)\n| extend joined_str = strcat(cap,rest_string)\n| distinct joined_str, Type\n| summarize joined_array = make_list(tostring(joined_str)) by Type\n| extend capitalized_Category = strcat_array(joined_array, \" \")\n| distinct Type, capitalized_Category\n| sort by capitalized_Category asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange" }, { "id": "P_deep_url", "version": "KqlParameterItem/1.0", "name": "P_deep_url", "type": 1, "isHiddenWhenLocked": true, "value": "None" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _DataSourceLookup =\n VectraDetectionsCombined\n | where [\"Change Type\"] in (\"new\", \"append\")\n | where isnotempty([\"Data Source Type\"])\n | summarize arg_max(['Last Updated'], [\"Data Source Type\"]) by ['Entity ID']\n | project _LookupEntityId = ['Entity ID'], _DetectedDST = [\"Data Source Type\"];\nVectraEntities\n| where ['Last Updated'] {timerange}\n| summarize arg_max(['Last Updated'], *) by ['Entity ID'], Type\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View})) and ('*' in ({EntityType}) or Type in ({EntityType}))\n| lookup kind=leftouter (_DataSourceLookup) on $left.['Entity ID'] == $right._LookupEntityId\n| extend _at = tostring([\"Account Type\"])\n| extend _dstFromAccount = case(\n Type == \"account\" and (_at has \"o365\" or _at has \"entra_principal\" or _at has \"entra_id\"), \"EntraID\",\n Type == \"account\" and _at has \"azure\", \"Azure\",\n Type == \"account\" and _at has \"aws\", \"AWS\",\n \"\"\n)\n| extend _dstFromDetection = iff(isnotempty(_DetectedDST), case(\n _DetectedDST == \"aws\", \"AWS\",\n _DetectedDST == \"o365\", \"EntraID\",\n _DetectedDST == \"azure-cp\", \"Azure\",\n tolower(tostring(_DetectedDST)) in (\"network\", \"nwi\", \"vectra\"), \"Network\",\n \"\"\n), \"\")\n| extend _dstFromName = case(\n Name startswith \"AWS\", \"AWS\",\n Name startswith \"SAML\", \"AWS\",\n Name startswith \"O365\", \"EntraID\",\n Name startswith \"M365\", \"EntraID\",\n Name startswith \"Azure\", \"Azure\",\n \"\"\n)\n| extend ['Data Source Type'] = case(\n isnotempty(_dstFromAccount), _dstFromAccount,\n isnotempty(_dstFromDetection), _dstFromDetection,\n isnotempty(_dstFromName), _dstFromName,\n \"Network\"\n)\n| project-away _DetectedDST, _at, _dstFromAccount, _dstFromDetection, _dstFromName\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\n| extend priority = case(\n ['Is Prioritized'] == true, \"Prioritized\",\n ['Is Prioritized'] == false, \"Not Prioritized\",\n \"Unknown\"\n)\n| summarize count() by priority\n| order by priority desc", "size": 3, "title": "Entity Count by Priority", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "priority", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Prioritized", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Prioritized", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "representation": "lightBlue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": true, "size": "auto" } }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _DataSourceLookup =\n VectraDetectionsCombined\n | where [\"Change Type\"] in (\"new\", \"append\")\n | where isnotempty([\"Data Source Type\"])\n | summarize arg_max(['Last Updated'], [\"Data Source Type\"]) by ['Entity ID']\n | project _LookupEntityId = ['Entity ID'], _DetectedDST = [\"Data Source Type\"];\nVectraEntities\n| where ['Last Updated'] {timerange} \n| summarize arg_max(['Last Updated'], *) by ['Entity ID'], Type\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View})) and ('*' in ({EntityType}) or Type in ({EntityType}))\n| lookup kind=leftouter (_DataSourceLookup) on $left.['Entity ID'] == $right._LookupEntityId\n| extend _at = tostring([\"Account Type\"])\n| extend _dstFromAccount = case(\n Type == \"account\" and (_at has \"o365\" or _at has \"entra_principal\" or _at has \"entra_id\"), \"EntraID\",\n Type == \"account\" and _at has \"azure\", \"Azure\",\n Type == \"account\" and _at has \"aws\", \"AWS\",\n \"\"\n)\n| extend _dstFromDetection = iff(isnotempty(_DetectedDST), case(\n _DetectedDST == \"aws\", \"AWS\",\n _DetectedDST == \"o365\", \"EntraID\",\n _DetectedDST == \"azure-cp\", \"Azure\",\n tolower(tostring(_DetectedDST)) in (\"network\", \"nwi\", \"vectra\"), \"Network\",\n \"\"\n), \"\")\n| extend _dstFromName = case(\n Name startswith \"AWS\", \"AWS\",\n Name startswith \"SAML\", \"AWS\",\n Name startswith \"O365\", \"EntraID\",\n Name startswith \"M365\", \"EntraID\",\n Name startswith \"Azure\", \"Azure\",\n \"\"\n)\n| extend ['Data Source Type'] = case(\n isnotempty(_dstFromAccount), _dstFromAccount,\n isnotempty(_dstFromDetection), _dstFromDetection,\n isnotempty(_dstFromName), _dstFromName,\n \"Network\"\n)\n| project-away _DetectedDST, _at, _dstFromAccount, _dstFromDetection, _dstFromName\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\",2, Name)\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\n| sort by ['Urgency Score'] desc, Importance desc\n| extend Importance = case(\n Importance == 0, \"Low\",\n Importance == 1, \"Medium\",\n Importance == 2, \"High\",\n \"Unknown\"\n), Velocity = case(\n Velocity == 0, \"Low\",\n Velocity == 1, \"Medium\",\n Velocity == 2, \"High\",\n \"Unknown\"\n),\n['Vectra Pivot'] = replace_string(replace_string(tostring(['Vectra Pivot']), \"api/v3.4/\", \"\"), \"api/v3.5/\", \"\")\n| project ['Urgency Score'], ['Attack Rating'], ['Entity Name'], ['Vectra Pivot'], Prioritized = ['Is Prioritized'], ['Data Source Type'], Importance, Velocity, ['Last Updated']", "size": 0, "showAnalytics": true, "title": "Entity View", "showRefreshButton": true, "exportFieldName": "Vectra Pivot", "exportParameterName": "P_deep_url", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra" } }, { "columnMatch": "Prioritized", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "red", "text": "true" }, { "operator": "Default", "text": "{0}{1}" } ] } }, { "columnMatch": "Deep Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Entity View grid to view more details_" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _entity =\n VectraEntities\n | extend ['Vectra Pivot'] = replace_string(replace_string(tostring(['Vectra Pivot']), \"api/v3.4/\", \"\"), \"api/v3.5/\", \"\")\n | where ['Vectra Pivot'] == \"{P_deep_url}\" or ['Vectra Pivot'] startswith strcat(\"{P_deep_url}\", \"?\")\n | summarize arg_max(['Last Updated'], *) by ['Entity ID'];\nlet _DataSourceLookup =\n VectraDetectionsCombined\n | where [\"Change Type\"] in (\"new\", \"append\")\n | where isnotempty([\"Data Source Type\"])\n | join kind=inner (_entity | project ['Entity ID']) on $left.['Entity ID'] == $right.['Entity ID']\n | summarize arg_max(['Last Updated'], [\"Data Source Type\"]) by ['Entity ID']\n | project _LookupEntityId = ['Entity ID'], _DetectedDST = [\"Data Source Type\"];\n_entity\n| lookup kind=leftouter (_DataSourceLookup) on $left.['Entity ID'] == $right._LookupEntityId\n| extend _at = tostring([\"Account Type\"])\n| extend _dstFromAccount = case(\n Type == \"account\" and (_at has \"o365\" or _at has \"entra_principal\" or _at has \"entra_id\"), \"EntraID\",\n Type == \"account\" and _at has \"azure\", \"Azure\",\n Type == \"account\" and _at has \"aws\", \"AWS\",\n \"\"\n)\n| extend _dstFromDetection = iff(isnotempty(_DetectedDST), case(\n _DetectedDST == \"aws\", \"AWS\",\n _DetectedDST == \"o365\", \"EntraID\",\n _DetectedDST == \"azure-cp\", \"Azure\",\n tolower(tostring(_DetectedDST)) in (\"network\", \"nwi\", \"vectra\"), \"Network\",\n \"\"\n), \"\")\n| extend _dstFromName = case(\n Name startswith \"AWS\", \"AWS\",\n Name startswith \"SAML\", \"AWS\",\n Name startswith \"O365\", \"EntraID\",\n Name startswith \"M365\", \"EntraID\",\n Name startswith \"Azure\", \"Azure\",\n \"\"\n)\n| extend ['Data Source'] = case(\n isnotempty(_dstFromAccount), _dstFromAccount,\n isnotempty(_dstFromDetection), _dstFromDetection,\n isnotempty(_dstFromName), _dstFromName,\n \"Network\"\n)\n| project-away _DetectedDST, _at, _dstFromAccount, _dstFromDetection, _dstFromName\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\", 2, Name)\n| where ('*' in ({DataSource}) or ['Data Source'] in ({DataSource}))\n| project\n ['Entity ID'],\n ['Entity Name'],\n ['Urgency Score'],\n ['Data Source'],\n ['Type'] = Type,\n ['State'] = State,\n ['IP'] = [\"IP Address\"],\n ['Is Prioritized'],\n ['Severity'] = Severity,\n ['Importance'] = Importance,\n ['Attack Profile'],\n ['Breadth Contrib'],\n ['Velocity'] = Velocity,\n ['Attack Rating'],\n ['Tags'] = Tags,\n ['Assigned To'] = [\"Assigned To\"],\n ['Vectra Pivot'],\n ['Last Updated']", "size": 4, "showAnalytics": true, "title": "Selected Entity View data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Last Detection URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ] } }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _entity =\n VectraEntities\n | extend ['Vectra Pivot'] = replace_string(replace_string(tostring(['Vectra Pivot']), \"api/v3.4/\", \"\"), \"api/v3.5/\", \"\")\n | where ['Vectra Pivot'] == \"{P_deep_url}\" or ['Vectra Pivot'] startswith strcat(\"{P_deep_url}\", \"?\")\n | summarize arg_max(['Last Updated'], *) by ['Entity ID']\n | project sel_entity_id = ['Entity ID'];\nVectraDetectionsCombined\n| where ['Last Updated'] > ago(90d)\n| join kind=inner _entity on $left.['Entity ID'] == $right.sel_entity_id\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\n| project ['Detection ID'], ['D Type Vname'], ['Detection Category'], status=[\"Investigation Status\"], ['Unresolved Priority'], ['Last Updated'], ['Vectra Pivot']\n| order by ['Last Updated'] desc", "size": 0, "showAnalytics": true, "title": "Detection List", "showRefreshButton": true, "exportFieldName": "Detection ID", "exportParameterName": "P_detection_id", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra", "linkIsContextBlade": false } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Detection ID", "formatter": 5 }, { "columnMatch": "Deep Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Detection List grid to view more details_" }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraDetectionsCombined\r\n| where ['Last Updated'] > ago(90d) and (URL == '{P_deep_url}' or URL startswith strcat('{P_deep_url}', '?'))\r\n| where ['Detection ID'] == '{P_detection_id}'\r\n| where [\"Change Type\"] in (\"new\", \"append\")\r\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\",\"Botnet\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",\"Unknown\")\r\n| extend [\"Detection Details\"] = parse_json([\"Detection Details\"])[0]\r\n| extend [\"Detection Details\"] = case(isnotempty([\"Detection Details\"]), [\"Detection Details\"], \"Details too large to display.\")\r\n| extend [\"Source Host\"] = parse_json([\"Source Host\"])[0]\r\n| extend [\"Grouped Details\"] = parse_json([\"Grouped Details\"])[0]\r\n| extend Summary = parse_json(Summary)[0]\r\n| extend Details = parse_json([\"Details\"])[0]\r\n| project ID, ['Detection Category'], ['Is Triaged'], Behavior=[\"Detection Name\"], [\"Detection ID\"], [\"Vectra Pivot\"], [\"Entity ID\"], URL, [\"Entity UID\"], [\"Last Updated\"], [\"Detection Details\"], [\"Details\"], Severity, ['Source IP'], [\"Normal Domains\"], [\"Is Targeting Key Asset\"], [\"Source Host\"], Summary, [\"Grouped Details\"]", "size": 4, "showAnalytics": true, "title": "Selected Detection List Data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Source Host", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Summary", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Grouped Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ] } }, "conditionalVisibilities": [ { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "P_detection_id", "comparison": "isNotEqualTo", "value": "None" } ], "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 8" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Entity" }, "name": "Entity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8ba900f4-2667-4651-87ee-866de79ed08f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "41b0ee6f-04db-423c-a0fd-babfda10e619", "version": "KqlParameterItem/1.0", "name": "DataSource", "label": "Data Source Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"AWS\", \"label\":\"AWS\"},\r\n {\"value\":\"EntraID\",\"label\":\"Entra ID\"},\r\n {\"value\":\"Azure\",\"label\":\"Azure\"},\r\n {\"value\":\"Network\",\"label\":\"Network\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "bd9a1ea9-0bec-457d-a24b-f84e15e1af42", "version": "KqlParameterItem/1.0", "name": "DetectionCategory", "label": "Detection Category", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"botnet\", \"label\":\"Botnet\"},\r\n {\"value\":\"command_and_control\",\"label\":\"Command and Control\"},\r\n {\"value\":\"reconnaissance\",\"label\":\"Reconnaissance\"},\r\n {\"value\":\"lateral_movement\",\"label\":\"Lateral Movement\"},\r\n {\"value\":\"exfiltration\",\"label\":\"Exfiltration\"},\r\n {\"value\":\"botnet_activity\", \"label\":\"Botnet Activity\"},\r\n {\"value\":\"info\", \"label\":\"Info\"},\r\n {\"value\":\"unclassified\", \"label\":\"Unclassified\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "1144f1b6-24e0-422c-bc8c-9bd87f6d258e", "version": "KqlParameterItem/1.0", "name": "DetectionType", "label": "Behavior", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraDetectionsCombined\n| where ['Last Updated'] {TimeRange}\n| where [\"Change Type\"] in (\"new\", \"append\")\n| summarize arg_max(['Last Updated'],*) by ['Detection ID']\n| extend _uid_pfx = tostring(split(['Entity UID'],\":\")[0])\n| extend _dst = case(_uid_pfx startswith \"AWS\", \"AWS\", _uid_pfx startswith \"SAML\", \"AWS\", _uid_pfx startswith \"O365\", \"EntraID\", _uid_pfx startswith \"M365\", \"EntraID\", _uid_pfx startswith \"Azure\", \"Azure\", \"Network\")\n| where ('*' in ({DataSource}) or _dst in ({DataSource})) and ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory}))\n| distinct ['Detection Name']\n| sort by ['Detection Name'] asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "0a0026bb-e21f-45b0-9678-f3650317ce61", "version": "KqlParameterItem/1.0", "name": "Mitre", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraDetectionsCombined\n| where ['Last Updated'] {TimeRange}\n| where [\"Change Type\"] in (\"new\", \"append\")\n| extend _MitreArr = case(isnull(Mitre), dynamic([]), gettype(Mitre) in (\"array\", \"dynamic\"), Mitre, pack_array(Mitre))\n| mv-expand _MitreArr\n| extend Mitre = tostring(_MitreArr)\n| distinct Mitre\n| sort by Mitre asc\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count:long, ['Detection Category']:string, category_count:long) [0,\"Botnet Activity\",1, 0,\"Command and Control\",2, 0,\"Reconnaissance\",3,\n 0,\"Lateral Movement\",4, 0,\"Exfiltration\",5, 0,\"Info\",6, 0,\"Unclassified\",7] \n |union\n ( \n VectraDetectionsCombined \n | where ['Last Updated'] {TimeRange}\n | extend _MitreArr = case(isnull(Mitre), dynamic([]), gettype(Mitre) in (\"array\", \"dynamic\"), Mitre, pack_array(Mitre))\n | mv-expand _MitreArr\n | extend Mitre = tostring(_MitreArr)\n | where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\n | summarize arg_max(['Last Updated'],*) by ['Detection ID']\n | extend ['Data Source Type'] = case(['Entity UID'] startswith \"AWS\", \"AWS\",\n ['Entity UID'] startswith \"SAML\", \"AWS\",\n ['Entity UID'] startswith \"O365\", \"EntraID\",\n ['Entity UID'] startswith \"M365\", \"EntraID\",\n ['Entity UID'] startswith \"Azure\", \"Azure\",\"Network\")\n | where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\n | where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in\n ({DetectionType}))\n | extend ['Detection Category'] = case(['Detection Category']==\"botnet\" or ['Detection Category']==\"botnet_activity\",\"Botnet Activity\",\n ['Detection Category']==\"command_and_control\",\"Command and Control\",\n ['Detection Category']==\"reconnaissance\",\"Reconnaissance\",\n ['Detection Category']==\"lateral_movement\",\"Lateral Movement\",\n ['Detection Category']==\"exfiltration\",\"Exfiltration\",\n ['Detection Category']==\"info\",\"Info\",\n ['Detection Category']==\"unclassified\",\"Unclassified\",\"Other\")\n | extend category_count=case(['Detection Category']==\"Botnet Activity\",1,\n ['Detection Category']==\"Command and Control\",2,\n ['Detection Category']==\"Reconnaissance\",3,\n ['Detection Category']==\"Lateral Movement\",4,\n ['Detection Category']==\"Exfiltration\",5,\n ['Detection Category']==\"Info\",6,\n ['Detection Category']==\"Unclassified\",7,8)\n | summarize Count=count() by ['Detection Category'], category_count\n )\n | summarize Count=sum(Count) by ['Detection Category'], category_count\n | sort by category_count asc", "size": 3, "title": "Detection Category Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Detection Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Command and Control", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Exfiltration", "representation": "purple", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Lateral Movement", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Reconnaissance", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Unclassified", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "representation": "lightBlue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": true, "size": "auto" } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Mitre_List = \r\n VectraDetectionsCombined\r\n | where ['Last Updated'] {TimeRange}\r\n | summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n | extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"EntraID\", \r\n ['Entity UID'] startswith \"M365\", \"EntraID\", \r\n ['Entity UID'] startswith \"Azure\", \"Azure\", \r\n \"Network\"\r\n )\r\n | where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n | where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType}))\r\n | extend _MitreArr = case(isnull(Mitre), dynamic([]), gettype(Mitre) in (\"array\", \"dynamic\"), Mitre, pack_array(Mitre))\r\n | mv-expand _MitreArr\r\n | extend Mitre = tostring(_MitreArr)\r\n | where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\r\n | summarize Mitre_Numbers = make_list(Mitre) by ['Detection ID'];\r\nVectraDetectionsCombined\r\n| where ['Last Updated'] {TimeRange}\r\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"EntraID\", \r\n ['Entity UID'] startswith \"M365\", \"EntraID\", \r\n ['Entity UID'] startswith \"Azure\", \"Azure\", \r\n \"Network\"\r\n)\r\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\", 2, ['Entity UID'])\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType}))\r\n| extend ['Detection Category'] = case(\r\n ['Detection Category'] == \"botnet\", \"Botnet\",\r\n ['Detection Category'] == \"command_and_control\", \"Command and Control\",\r\n ['Detection Category'] == \"reconnaissance\", \"Reconnaissance\",\r\n ['Detection Category'] == \"lateral_movement\", \"Lateral Movement\",\r\n ['Detection Category'] == \"exfiltration\", \"Exfiltration\",\r\n ['Detection Category'] == \"botnet_activity\", \"Botnet Activity\",\r\n ['Detection Category'] == \"unclassified\", \"Unclassified\",\r\n \"Other\"\r\n)\r\n| extend [\"Source IP\"] = case(isnotempty([\"Source IP\"]), [\"Source IP\"], \"Not Applicable\")\r\n| join kind=inner (Mitre_List) on ['Detection ID']\r\n| project\r\n ['Entity Name'],\r\n ['Detection Category'],\r\n Behavior=[\"Detection Name\"],\r\n ['Vectra Pivot'],\r\n ['Data Source Type'],\r\n ['Source IP'],\r\n ['Last Updated'],\r\n [\"Detection ID\"],\r\n ['External Reference ID'],\r\n Mitre\r\n| sort by ['Last Updated'] desc\r\n", "size": 0, "showAnalytics": true, "title": "Detection View", "showRefreshButton": true, "exportFieldName": "Detection ID", "exportParameterName": "P_detection_id", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra" } }, { "columnMatch": "Detection ID", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Detection View grid to view more details_" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Mitre_List = \r\n VectraDetectionsCombined\r\n | where ['Last Updated'] {TimeRange}\r\n | summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n | extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"EntraID\", \r\n ['Entity UID'] startswith \"M365\", \"EntraID\", \r\n ['Entity UID'] startswith \"Azure\", \"Azure\", \r\n \"Network\"\r\n )\r\n | where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n | where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType})) and [\"Detection ID\"] == '{P_detection_id}'\r\n | extend _MitreArr = case(isnull(Mitre), dynamic([]), gettype(Mitre) in (\"array\", \"dynamic\"), Mitre, pack_array(Mitre))\r\n | mv-expand _MitreArr\r\n | extend Mitre = tostring(_MitreArr)\r\n | where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\r\n | summarize Mitre_Numbers = make_list(Mitre) by ['Detection ID'];\r\nVectraDetectionsCombined\r\n| where ['Last Updated'] {TimeRange}\r\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\",\r\n ['Entity UID'] startswith \"O365\", \"EntraID\",\r\n ['Entity UID'] startswith \"M365\", \"EntraID\",\r\n ['Entity UID'] startswith \"Azure\", \"Azure\",\"Network\")\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType})) and [\"Detection ID\"] == '{P_detection_id}'\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\",\"Botnet\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",['Detection Category'] == \"botnet_activity\", \"Botnet Activity\",['Detection Category'] == \"unclassified\", \"Unclassified\",\"Other\")\r\n| extend [\"Source Host\"] = parse_json([\"Source Host\"])[0]\r\n| extend [\"Grouped Details\"] = parse_json([\"Grouped Details\"])[0]\r\n| extend Summary = parse_json(Summary)[0]\r\n| join kind=inner (Mitre_List) on ['Detection ID']\r\n| project ID, ['Detection Category'], ['Is Triaged'], Behavior=[\"Detection Name\"], [\"Detection ID\"], [\"Vectra Pivot\"], [\"Entity ID\"], ['Entity Pivot']=URL, [\"Entity UID\"], [\"Last Updated\"], [\"Details\"], Severity, ['Source IP'], ['External Reference ID'], Mitre", "size": 4, "showAnalytics": true, "title": "Selected Detection View Data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Source Host", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Summary", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Grouped Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ] } }, "conditionalVisibility": { "parameterName": "P_detection_id", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 5" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Detections" }, "name": "Detections" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ea3f10f3-aa7e-481c-9d4f-7939d1a463a1", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "7df89745-bea2-4a36-9c0a-4e64a01a0423", "version": "KqlParameterItem/1.0", "name": "EntityType", "label": "Entity Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraLockdown\n| where [\"Locked Date\"] {TimeRange} or [\"Unlock Date\"] {TimeRange}\n| distinct Type\n| extend cap = toupper(substring(Type,0,1)), rest_string = substring(Type,1)\n| extend Captilized_type = strcat(cap,rest_string)\n| distinct ['Type'], Captilized_type", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "90c8487a-b24b-420e-8a70-73baad8d3301", "version": "KqlParameterItem/1.0", "name": "EntityLocked", "label": "Entity Locked", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"True\", \"label\":\"True\", \"selected\":true },\r\n { \"value\":\"False\", \"label\":\"False\", \"selected\":true}\r\n]", "value": [ "False", "True" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraLockdown\n| where case('{TimeRange}' contains 'ago', [\"Locked Date\"] {TimeRange} or ([\"Unlock Date\"] {TimeRange} and [\"Unlock Date\"] <= now()), [\"Locked Date\"] {TimeRange} or [\"Unlock Date\"] {TimeRange})\n| summarize arg_max(TimeGenerated, *) by [\"Entity Name\"], Type, [\"Locked Date\"], [\"Unlock Date\"]\n| where ('*' in ({EntityType}) or Type in ({EntityType}))\n| extend current_status = case([\"Locked Date\"] <= now() and now() < [\"Unlock Date\"], \"True\", \"False\")\n| where ('*' in ({EntityLocked}) or current_status in ({EntityLocked}))\n| sort by [\"Locked Date\"] desc\n| project [\"Entity Name\"], [\"Entity Type\"] = Type, [\"Entity Locked\"] = current_status, [\"Locked By\"], [\"Locked Date\"], [\"Unlock Date\"]", "size": 0, "showAnalytics": true, "title": "Lockdown View", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Entity Locked", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 2" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Lockdown" }, "name": "lockdown" } ] }, "name": "main" } ], "fromTemplateId": "sentinel-VectraRUXSecurityDashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }