{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **TMApexOneEvent** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-TMApexOneEvent-parser)"
      },
      "name": "text - 8"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "cd8447d9-b096-4673-92d8-2a1e8291a125",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "description": "Sets the time name for analysis",
            "value": {
              "durationMs": 7776000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TMApexOneEvent\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
        "size": 0,
        "title": "Events Over Time",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart",
        "graphSettings": {
          "type": 0
        }
      },
      "customWidth": "60",
      "name": "query - 12",
      "styleSettings": {
        "maxWidth": "55"
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TMApexOneEvent\r\n| where isnotempty(DstDvcHostname)\r\n| summarize dcount(DstDvcHostname)",
              "size": 3,
              "title": "Devices",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "customWidth": "50",
            "name": "query - 3",
            "styleSettings": {
              "margin": "10",
              "padding": "10"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TMApexOneEvent\n| where isnotempty(SrcUserName)\n| summarize dcount(SrcUserName)",
              "size": 3,
              "title": "Users",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "customWidth": "50",
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TMApexOneEvent\n| where isnotempty(SrcProcessName)\n| summarize dcount(SrcProcessName)",
              "size": 3,
              "title": "Processes",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "customWidth": "50",
            "name": "query - 3"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "  TMApexOneEvent\r\n  | where EventMessage has \"Endpoint Application Control\"\r\n  | where DvcAction has \"blocked\"\r\n  | count",
              "size": 3,
              "title": "Blocked applications",
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "customWidth": "50",
            "name": "query - 2"
          }
        ]
      },
      "customWidth": "30",
      "name": "group - 15",
      "styleSettings": {
        "maxWidth": "30"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "  TMApexOneEvent\r\n | extend EventType = case(\r\n  EventMessage == \"7\", \"Web Security\", \r\n  EventMessage == \"virusa\", \"Predictive Machine Learning\",\r\n  EventMessage == \"Attack Discovery Detections\", \"Attack Discovery Detection\", \r\n  EventMessage == \"Behavior Monitoring\", \"Behavior Monitoring\",\r\n  EventMessage == \"CnC Callback\", \"C&C Callback\", \r\n  EventMessage == \"This is a policy name\", \"Policy name\",\r\n  EventMessage == \"Data Loss Prevention\", \"Data Loss Prevention\", \r\n  EventMessage == \"Device Access Control\", \"Device Access Control\",\r\n  EventMessage == \"Endpoint Application Control Violation Information\", \"Endpoint Application Control\", \r\n  EventMessage == \"Engine Update Status\", \"Engine Update Status\",\r\n  EventMessage == \"Managed Product Logon/Logoff Events\", \"Managed Product Logon/Logoff Events\", \r\n  EventMessage == \"Suspicious Connection\", \"Suspicious Connection\",\r\n  EventMessage == \"Pattern Update Status\", \"Pattern Update Status\", \r\n  EventMessage == \"VAN_RANSOMWARE.umxxhelloransom_abc\", \"Sandbox Detection\",\r\n  EventMessage == \"Spyware Detected\", \"Spyware Detected\", \r\n  EventMessage == \"JS_EXPLOIT.SMDN\", \"Virus/Malware Detected\",\r\n  EventMessage == \"Suspicious Files\", \"Suspicious Files\",\r\n  \"unknown\")\r\n  | summarize count() by EventType",
        "size": 3,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "EventType",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "query - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "  TMApexOneEvent\r\n  | where isnotempty(ApplicationProtocol)\r\n  | extend AppProtocol = case(\r\n  ApplicationProtocol == \"0\", \"Unknown\", \r\n  ApplicationProtocol == \"1\", \"SMTP\",\r\n  ApplicationProtocol == \"2\", \"POP3\",\r\n  ApplicationProtocol == \"3\", \"IRC\", \r\n  ApplicationProtocol == \"4\", \"DNS Response\",\r\n  ApplicationProtocol == \"5\", \"HTTP\",\r\n  ApplicationProtocol == \"6\", \"FTP\", \r\n  ApplicationProtocol == \"7\", \"TFTP\",\r\n  ApplicationProtocol == \"8\", \"SMB\",\r\n  ApplicationProtocol == \"9\", \"Windows Live Messenger (MSN)\", \r\n  ApplicationProtocol == \"10\", \"AIM\",\r\n  ApplicationProtocol == \"11\", \"Yahoo! Messenger\",\r\n  ApplicationProtocol == \"12\", \"Gmail\",\r\n  ApplicationProtocol == \"13\", \"Yahoo! Mail\", \r\n  ApplicationProtocol == \"14\", \"Windows Live Hotmail\",\r\n  ApplicationProtocol == \"15\", \"RDP\",\r\n  ApplicationProtocol == \"16\", \"DHCP\",\r\n  ApplicationProtocol == \"17\", \"Telnet\", \r\n  ApplicationProtocol == \"18\", \"LDAP\",\r\n  ApplicationProtocol == \"19\", \"File transfer\",\r\n  ApplicationProtocol == \"20\", \"SSH\",\r\n  ApplicationProtocol == \"21\", \"Dameware\", \r\n  ApplicationProtocol == \"22\", \"VNC\",\r\n  ApplicationProtocol == \"23\", \"Cisco Telnet\",\r\n  ApplicationProtocol == \"24\", \"Kerberos\", \r\n  ApplicationProtocol == \"25\", \"DCE RPC\",\r\n  ApplicationProtocol == \"26\", \"SQL\",\r\n  ApplicationProtocol == \"27\", \"pcAnywhere\", \r\n  ApplicationProtocol == \"28\", \"ICMP\",\r\n  ApplicationProtocol == \"29\", \"SNMP\",\r\n  ApplicationProtocol == \"30\", \"Virus pattern TCP\", \r\n  ApplicationProtocol == \"31\", \"Virus pattern UDP\",\r\n  ApplicationProtocol == \"32\", \"HTTPS\",\r\n  ApplicationProtocol == \"33\", \"SMB2\",\r\n  ApplicationProtocol == \"34\", \"MMS\", \r\n  ApplicationProtocol == \"35\", \"IMAP4\",\r\n  ApplicationProtocol == \"36\", \"RADIUS\",\r\n  ApplicationProtocol == \"37\", \"Radmin\",\r\n  ApplicationProtocol == \"38\", \"FTP_Response\", \r\n  ApplicationProtocol == \"48\", \"RTSP/RTP-UDP\",\r\n  ApplicationProtocol == \"49\", \"RTSP/RTP-TCP\",\r\n  ApplicationProtocol == \"50\", \"RTSP/RDT-UDP\",\r\n  ApplicationProtocol == \"51\", \"RTSP/RDT-TCP\",\r\n  ApplicationProtocol == \"52\", \"WMSP\",\r\n  ApplicationProtocol == \"53\", \"SHOUTCast\", \r\n  ApplicationProtocol == \"54\", \"RTMP\",\r\n  ApplicationProtocol == \"68\", \"DNS Request\",\r\n  ApplicationProtocol == \"256\", \"BitTorrent\", \r\n  ApplicationProtocol == \"257\", \"Kazaa\",\r\n  ApplicationProtocol == \"258\", \"Limewire\",\r\n  ApplicationProtocol == \"259\", \"Bearshare\", \r\n  ApplicationProtocol == \"260\", \"Bluester\",\r\n  ApplicationProtocol == \"261\", \"Edonkey emule\",\r\n  ApplicationProtocol == \"262\", \"Edonkey2000\",\r\n  ApplicationProtocol == \"263\", \"Filezilla\", \r\n  ApplicationProtocol == \"264\", \"Guncleus\",\r\n  ApplicationProtocol == \"265\", \"Gnutella\",\r\n  ApplicationProtocol == \"266\", \"Winny\",\r\n  ApplicationProtocol == \"267\", \"Napster\", \r\n  ApplicationProtocol == \"268\", \"Morpheus\",\r\n  ApplicationProtocol == \"269\", \"Napster\",\r\n  ApplicationProtocol == \"270\", \"Shareaza\",\r\n  ApplicationProtocol == \"271\", \"WinMX\", \r\n  ApplicationProtocol == \"272\", \"Mldonkey\",\r\n  ApplicationProtocol == \"273\", \"Direct Connect\",\r\n  ApplicationProtocol == \"274\", \"Soulseek\", \r\n  ApplicationProtocol == \"275\", \"OpenAP\",\r\n  ApplicationProtocol == \"276\", \"Kuro\",\r\n  ApplicationProtocol == \"277\", \"Imesh\", \r\n  ApplicationProtocol == \"278\", \"Skype\",\r\n  ApplicationProtocol == \"279\", \"Google Talk\",\r\n  ApplicationProtocol == \"317\", \"Cabos\", \r\n  ApplicationProtocol == \"318\", \"Zultrax\",\r\n  ApplicationProtocol == \"319\", \"Foxy\",\r\n  ApplicationProtocol == \"320\", \"eDonkey\",\r\n  ApplicationProtocol == \"321\", \"Ares\", \r\n  ApplicationProtocol == \"322\", \"Miranda\",\r\n  ApplicationProtocol == \"323\", \"Kceasy\",\r\n  ApplicationProtocol == \"324\", \"MoodAmp\",\r\n  ApplicationProtocol == \"325\", \"Deepnet Explorer\", \r\n  ApplicationProtocol == \"326\", \"FreeWire\",\r\n  ApplicationProtocol == \"327\", \"Gimme\",\r\n  ApplicationProtocol == \"328\", \"GnucDNA GWebCache\",\r\n  ApplicationProtocol == \"329\", \"Jubster\",\r\n  ApplicationProtocol == \"330\", \"MyNapster\", \r\n  ApplicationProtocol == \"331\", \"Nova GWebCache\",\r\n  ApplicationProtocol == \"332\", \"Swapper GWebCache\",\r\n  ApplicationProtocol == \"333\", \"Xnap\",\r\n  ApplicationProtocol == \"334\", \"Xolox\", \r\n  ApplicationProtocol == \"335\", \"Ppstream\",\r\n  ApplicationProtocol == \"640\", \"AIM Express\",\r\n  ApplicationProtocol == \"641\", \"Chikka SMS Messenger\",\r\n  ApplicationProtocol == \"642\", \"eBuddy\", \r\n  ApplicationProtocol == \"643\", \"ICQ2Go\",\r\n  ApplicationProtocol == \"644\", \"ILoveIM Web Messenger\",\r\n  ApplicationProtocol == \"645\", \"IMUnitive\",\r\n  ApplicationProtocol == \"646\", \"Mabber\",\r\n  ApplicationProtocol == \"647\", \"Meebo\",\r\n  ApplicationProtocol == \"648\", \"Yahoo! Web Messenger\", \r\n  ApplicationProtocol == \"848\", \"SIP2\",\r\n  ApplicationProtocol == \"1024\", \"GPass\",\r\n  ApplicationProtocol == \"10001\", \"IP\",\r\n  ApplicationProtocol == \"10002\", \"ARP\",\r\n  ApplicationProtocol == \"10003\", \"TCP\", \r\n  ApplicationProtocol == \"10004\", \"UDP\",\r\n  ApplicationProtocol == \"10005\", \"IGMP\",\r\n  ApplicationProtocol == \"60\", \"ORACLE\", \r\n  ApplicationProtocol == \"44\", \"MySQL\",\r\n  ApplicationProtocol == \"520\", \"MSSQL\",\r\n  ApplicationProtocol == \"337\", \"Postgres\", \r\n  ApplicationProtocol == \"41\", \"ICMPv6\",\r\n  ApplicationProtocol == \"10006\", \"GGP\",\r\n  ApplicationProtocol == \"10007\", \"PUP\",\r\n  ApplicationProtocol == \"10008\", \"IDP\", \r\n  ApplicationProtocol == \"10009\", \"ND\",\r\n  ApplicationProtocol == \"10010\", \"RAW\",\r\n  \"unknown\")\r\n  | summarize ProtocolCount = count() by AppProtocol",
        "size": 3,
        "title": "Network protocols",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "30",
      "name": "query - 10",
      "styleSettings": {
        "maxWidth": "45"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TMApexOneEvent\r\n| where EventMessage has \"CnC Callback\" \r\n| project EventEndTime, SrcIpAddr,  DstIpAddr\r\n",
        "size": 0,
        "title": "CnC connections",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "filter": true
        }
      },
      "customWidth": "35",
      "name": "query - 15",
      "styleSettings": {
        "maxWidth": "35"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TMApexOneEvent\r\n| where EventMessage has \"Endpoint Application Control\"\r\n| where DvcAction has \"Blocked\"\r\n| project EventEndTime, Application = FileName, SrcUserName\r\n",
        "size": 0,
        "title": "Blocked applications",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "filter": true
        }
      },
      "customWidth": "35",
      "name": "query - 13",
      "styleSettings": {
        "maxWidth": "35"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "  TMApexOneEvent\r\n  | where isnotempty(FileName)\r\n  | extend File = strcat(FilePath, FileName)\r\n  | summarize count() by File\r\n  | sort by count_ desc ",
        "size": 0,
        "title": "Suspicious files",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "filter": true
        }
      },
      "customWidth": "35",
      "name": "query - 10",
      "styleSettings": {
        "maxWidth": "30"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TMApexOneEvent\r\n| sort by TimeGenerated desc \r\n| where EventMessage !in~ (\"Engine Update Statusd\", \"Pattern Update Status\")\r\n| project EventEndTime, Module=EventMessage, FileName ",
        "size": 0,
        "title": "Latest detections",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true
        }
      },
      "customWidth": "55",
      "name": "query - 11",
      "styleSettings": {
        "maxWidth": "80"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "  TMApexOneEvent\r\n  | where EventMessage has \"Data Loss Prevention\"\r\n  | extend DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\r\n  | where isnotempty(DeviceCustomNumber3)\r\n  | extend Channel_Type = case(\r\n  DeviceCustomNumber3 == \"65535\", \"Not available\",\r\n  DeviceCustomNumber3 == \"0\", \"Removable storage\", \r\n  DeviceCustomNumber3 == \"1\", \"SMB\",\r\n  DeviceCustomNumber3 == \"2\", \"Email\",\r\n  DeviceCustomNumber3 == \"3\", \"IM\", \r\n  DeviceCustomNumber3 == \"4\", \"FTP\",\r\n  DeviceCustomNumber3 == \"5\", \"HTTP\",\r\n  DeviceCustomNumber3 == \"6\", \"HTTPS\", \r\n  DeviceCustomNumber3 == \"7\", \"PGP\",\r\n  DeviceCustomNumber3 == \"8\", \"Data recorders\",\r\n  DeviceCustomNumber3 == \"9\", \"Printer\", \r\n  DeviceCustomNumber3 == \"10\", \"Clipboard\",\r\n  DeviceCustomNumber3 == \"11\", \"Sync\",\r\n  DeviceCustomNumber3 == \"12\", \"P2P\",\r\n  DeviceCustomNumber3 == \"13\", \"Webmail\", \r\n  DeviceCustomNumber3 == \"14\", \"Document management\",\r\n  DeviceCustomNumber3 == \"15\", \"Cloud storage\",\r\n  DeviceCustomNumber3 == \"121\", \"SMTP email\",\r\n  DeviceCustomNumber3 == \"122\", \"Exchange Client Mail\", \r\n  DeviceCustomNumber3 == \"123\", \"Lotus Note Email\",\r\n  DeviceCustomNumber3 == \"130\", \"Webmail (Yahoo! Mail)\",\r\n  DeviceCustomNumber3 == \"131\", \"Webmail (Hotmail)\",\r\n  DeviceCustomNumber3 == \"132\", \"Webmail (Gmail)\",\r\n  DeviceCustomNumber3 == \"133\", \"Webmail (AOL Mail)\",\r\n  DeviceCustomNumber3 == \"140\", \"IM (MSN)\",\r\n  DeviceCustomNumber3 == \"141\", \"IM (AIM)\",\r\n  DeviceCustomNumber3 == \"142\", \"IM (Yahoo Messenger)\",\r\n  DeviceCustomNumber3 == \"143\", \"IM (Skype)\",\r\n  DeviceCustomNumber3 == \"191\", \"P2P (BitTorrent)\",\r\n  DeviceCustomNumber3 == \"192\", \"P2P (EMule)\",\r\n  DeviceCustomNumber3 == \"193\", \"P2P (Winny)\",\r\n  DeviceCustomNumber3 == \"194\", \"P2P (HTCSYN)\",\r\n  DeviceCustomNumber3 == \"195\", \"P2P (iTunes)\",\r\n  DeviceCustomNumber3 == \"196\", \"Cloud storage (DropBox)\",\r\n  DeviceCustomNumber3 == \"197\", \"Cloud storage (Box)\",\r\n  DeviceCustomNumber3 == \"198\", \"Cloud storage (Google Drive)\",\r\n  DeviceCustomNumber3 == \"199\", \"Cloud storage (OneDrive)\",\r\n  DeviceCustomNumber3 == \"200\", \"Cloud storage (SugarSync)\",\r\n  DeviceCustomNumber3 == \"201\", \"Cloud storage (Hightail)\",\r\n  DeviceCustomNumber3 == \"202\", \"IM (QQ)\",\r\n  DeviceCustomNumber3 == \"203\", \"Webmail (other)\",\r\n  DeviceCustomNumber3 == \"204\", \"Cloud storage (Evernote)\",\r\n  DeviceCustomNumber3 == \"211\", \"Document management (SharePoint)\",\r\n  \"unknown\")\r\n  | summarize ChannelType = count() by Channel_Type",
        "size": 3,
        "title": "Channel types",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "query - 9"
    }
  ],
  "fromTemplateId": "sentinel-TrendMicroApexOneWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}