{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Digital Shadows\n---\n\nWelcome to your Digital Shadows workbook. Here you can visualize certain aspects of data.\n\nYou can get a list of incidents from past n number of days, bar chart depicting the number of incidents over certain period of time and breakdown of incidents by type as seen in Digital Shadows portal.\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bb5c1509-5af4-4ff0-a4d4-55b7dd7a3f84", "version": "KqlParameterItem/1.0", "name": "TimeParameter", "label": "Time Parameter", "type": 4, "description": "Get all the incidents data from past", "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 172800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 1, "content": { "json": "\n---\n## Past incidents according to selected time \n---" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DigitalShadows_V2_CL\n| summarize arg_max(TimeGenerated, *) by IncidentId, AlertId", "size": 0, "title": "Incidents", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeParameter", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Historical data", "styleSettings": { "margin": "2 px", "padding": "5 px", "showBorder": true } }, { "type": 1, "content": { "json": "\n---\n## Incidents over time \n---" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DigitalShadows_V2_CL\n| summarize arg_max(TimeGenerated, *) by IncidentId, AlertId\n| summarize incidents=count() by bin(TimeGenerated, 1h)", "size": 0, "title": "Bar charts ", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeParameter", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "graphSettings": { "type": 0, "topContent": { "columnMatch": "InALogs_CL", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "TimeGenerated", "showLegend": true, "seriesLabelSettings": [ { "seriesName": "InALogs_CL", "label": "Incidents and alerts" }, { "seriesName": "incidents", "color": "blue" } ], "ySettings": { "min": 0 } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "name": "barcharts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\n---\n## Breakdown over time\n---\nBy risk score" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string) [0, \"Very High\", 0, \"High\", 0, \"Medium\", 0, \"Low\", 0, \"Very Low\", 0, \"None\"]\n| union\n (\n DigitalShadows_V2_CL\n | summarize arg_max(TimeGenerated, *) by IncidentId, AlertId\n | extend status = case( \n RiskLevel == \"very-high\" or RiskAssessmentRiskLevel\n == \"very-high\", \"Very High\",\n RiskLevel == \"high\" or RiskAssessmentRiskLevel\n == \"high\", \"High\",\n RiskLevel == \"medium\" or RiskAssessmentRiskLevel\n == \"medium\", \"Medium\",\n RiskLevel == \"low\" or RiskAssessmentRiskLevel\n == \"low\", \"Low\",\n RiskLevel == \"very-low\" or RiskAssessmentRiskLevel\n == \"very-low\", \"Very Low\",\n RiskLevel == \"none\" or RiskAssessmentRiskLevel\n == \"none\", \"None\", \n \"True\"\n )\n | where status != \"True\"\n | summarize Count = count() by status\n )\n| summarize Count=sum(Count) by status", "size": 3, "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeParameter", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 5, "formatOptions": { "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "greenRed" } }, "showBorder": true } }, "name": "query - 0" }, { "type": 1, "content": { "json": "\n---\nBy state" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string) [0, \"Unread\", 0, \"Open\", 0, \"Rejected\", 0, \"Resolved\", 0, \"Closed\"]\n| union\n (\n DigitalShadows_V2_CL\n | summarize arg_max(TimeGenerated, *) by IncidentId, AlertId\n | extend status = case(Status == \"unread\", \"Unread\",\n Status == \"open\", \"Open\", \n Status == \"rejected\", \"Rejected\",\n Status == \"resolved\", \"Resolved\",\n Status == \"closed\", \"Closed\",\n \"True\"\n )\n | where status != \"True\"\n | summarize Count = count() by status\n )\n| summarize Count=sum(Count) by status", "size": 3, "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeParameter", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "status", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 5" }, { "type": 1, "content": { "json": "\n---\nBy most frequent risk" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string) [0, \"Cyber Threat\", 0, \"Credential Compromise\", 0, \"Impersonating Employee Profile\", 0, \"Impersonating Company Profile\", 0, \"Customer Details\", 0, \"Technical Leakage\", 0, \"Intellectual Property\", 0, \"Negative Publicity\", 0, \"Exposed Port\", 0, \"Exposed Credentials Alert\", 0, \"Protectively Marked Document\", 0, \"Phishing Attempt\", 0, \"Spoof Profile\", 0, \"Customer Details\", 0, \"Brand Misuse\", 0, \"Mobile Application\", 0, \"Domain Certificate Issue\", 0, \"CVE\", 0, \"Unmarked Document\", 0, \"Social media-technical information\", 0, \"Social media-personal information\", 0, \"Physical security-personal threat\", 0, \"Physical security-employee threat\", 0, \"Physical security-company threat\", 0, \"Defamation\", 0, \"Legacy marked document\", 0, \"Internally marked document\", 0, \"Exposed access key\", 0, \"Exposed marked document\", 0, \"Exposed technical document\", 0, \"Impersonating domain\", 0, \"Impersonating subdomain\", 0, \"Unauthorized code commit\"]\n| union\n (\n DigitalShadows_V2_CL\n | summarize arg_max(TimeGenerated, *) by IncidentId, AlertId\n | extend status = case( \n Classification== \"cyber-threat-incident\", \"Cyber Threat\",\n Classification==\"credential-compromise-incident\", \"Credential Compromise\",\n Classification==\"employee-threat-incident\", \"Impersonating Employee Profile\",\n Classification==\"impersonating-domain-alert\", \"Impersonating Company Profile\",\n Classification==\"personal-compliance-incident\", \"Customer Details\",\n Classification==\"technical-compliance-incident\", \"Technical Leakage\",\n Classification==\"intellectual-property-incident\", \"Intellectual Property\",\n Classification==\"negative-publicity-incident\", \"Negative Publicity\",\n Classification==\"exposed-port-incident\", \"Exposed Port\",\n Classification==\"exposed-credential-alert\", \"Exposed Credentials Alert\", \n Classification==\"protectively-marked-document-incident\", \"Protectively Marked Document\",\n Classification==\"phishing-attempt-incident\", \"Phishing Attempt\",\n Classification==\"spoof-profile-incident\", \"Spoof Profile\",\n Classification==\"customer-details-incident\", \"Customer Details\",\n Classification==\"brand-misuse-incident\", \"Brand Misuse\",\n Classification==\"mobile-application-incident\", \"Mobile Application\",\n Classification==\"domain-certificate-issue-incident\", \"Domain Certificate Issue\",\n Classification==\"cve-incident\", \"CVE\", \n Classification==\"unmarked-document-incident\", \"Unmarked Document\",\n Classification==\"technical-compliance-incident\", \"Social media-technical information\",\n Classification==\"personal-compliance-incident\", \"Social media-personal information\",\n Classification==\"personal-threat-incident\", \"Physical security-personal threat\",\n Classification==\"employee-threat-incident\", \"Physical security-employee threat\",\n Classification==\"company-threat-incident\", \"Physical security-company threat\",\n Classification==\"defamation-incident\", \"Defamation\",\n Classification==\"legacy-marked-document-incident\", \"Legacy marked document\",\n Classification==\"internally-marked-document-incident\", \"Internally marked document\",\n Classification==\"exposed-access-key-alert\", \"Exposed access key\",\n Classification==\"marked-document-alert\", \"Exposed marked document\",\n Classification==\"technical-leakage-incident\", \"Exposed technical document\",\n Classification==\"impersonating-domain-alert\", \"Impersonating domain\",\n Classification==\"impersonating-subdomain-alert\", \"Impersonating subdomain\",\n Classification==\"unauthorized-code-commit-alert\", \"Unauthorized code commit\",\n \"True\"\n )\n | where status != \"True\"\n | summarize Count = count() by status\n )\n| summarize Count=sum(Count) by status\n| sort by Count\n", "size": 3, "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeParameter", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "name": "query - 2" } ] }, "name": "group - 4" } ], "fromTemplateId": "DigitalShadows-Workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }