{
"version": "Notebook/1.0",
"items": [
{
"type": 1,
"content": {
"json": "# Azure SQL Databases\r\n"
},
"name": "text - 2"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"value::selected"
],
"parameters": [
{
"id": "3807ff63-b851-47dd-87cc-db8e484e8afb",
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "e282bcfd-676d-4ebe-9a0a-9d047904de22",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"label": "Time range",
"type": 4,
"isRequired": true,
"value": {
"durationMs": 7776000000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
}
},
{
"id": "c517802a-74f7-469d-9158-41c5023905da",
"version": "KqlParameterItem/1.0",
"name": "Subscriptions",
"type": 6,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
"crossComponentResources": [
"value::selected"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "",
"showDefault": false
},
"timeContext": {
"durationMs": 5184000000
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "1f35dc4e-9186-4a36-96a5-2259dec75434",
"version": "KqlParameterItem/1.0",
"name": "Workspaces",
"type": 5,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where strcat('/subscriptions/',subscriptionId) in ({Subscriptions})\r\n| project id",
"crossComponentResources": [
"value::selected"
],
"value": [],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "332be9fd-33ad-407e-843e-5f2c49a50b6a",
"version": "KqlParameterItem/1.0",
"name": "Servers",
"type": 5,
"isRequired": true,
"multiSelect": true,
"quote": "\"",
"delimiter": ",",
"query": "where type == \"microsoft.sql/servers\"\r\n| where strcat('/subscriptions/',subscriptionId) in ({Subscriptions})\r\n| project id=tolower(id)",
"crossComponentResources": [
"value::selected"
],
"value": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "",
"showDefault": false
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "b4cc825f-166b-4929-916a-21b8073748c2",
"version": "KqlParameterItem/1.0",
"name": "Databases",
"type": 5,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "where type == \"microsoft.sql/servers/databases\"\r\n| where strcat('/subscriptions/',subscriptionId) in ({Subscriptions})\r\n| project id=tolower(id)\r\n| extend serverName = split(id,'/databases/')[0]\r\n| where serverName in ({Servers})\r\n| project id",
"crossComponentResources": [
"value::selected"
],
"value": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "",
"showDefault": false
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
}
],
"style": "pills",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
"name": "parameters - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "88959d45-3a98-4f57-a16a-55ed5af242b2",
"cellValue": "mainTab",
"linkTarget": "parameter",
"linkLabel": "Incident Troubleshooting Guide",
"subTarget": "TSG",
"style": "link"
},
{
"id": "254ba4b0-6ee2-41cc-a683-646a13b06ff5",
"cellValue": "mainTab",
"linkTarget": "parameter",
"linkLabel": "Analytics over SQL Server audit events",
"subTarget": "diagnostics",
"style": "link"
},
{
"id": "9fc1cd24-6d9e-4df7-acc4-549daf2f721c",
"cellValue": "mainTab",
"linkTarget": "parameter",
"linkLabel": "Sensitive Data Classification",
"subTarget": "classification",
"style": "link"
},
{
"id": "1a5f9a87-9eed-4133-bf77-c5ddf5a06fce",
"cellValue": "mainTab",
"linkTarget": "parameter",
"linkLabel": "Azure Defender for SQL Coverage",
"subTarget": "alerts",
"style": "link"
}
]
},
"name": "links - 17"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Azure Defender for SQL coverage"
},
"name": "text - 0"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//resources\r\n//| where type == \"microsoft.sql/servers/databases\"\r\n//| summarize Databases = count() by subscriptionId, DefenderForSQL = 0\r\n//| union\r\n//(securityresources\r\n//| where type =~ \"microsoft.security/pricings\"\r\n//| where name == \"SqlServers\"\r\n//| project DefenderForSQL = iif(properties.pricingTier == 'Standard', 1, 0), Databases = 0, subscriptionId)\r\n//| summarize Databases = sum(Databases), DefenderForSQL = sum(DefenderForSQL) by subscriptionId\r\n//| project Subscription = strcat('/subscriptions/', subscriptionId), Databases, ['Defender for SQL'] = iif(DefenderForSQL > 0,'yes',iff(Databases > 0, 'no', 'nodefender_nosql')), ['Onboard Azure Defender'] = iif(DefenderForSQL > 0, '', 'https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26')\r\n//| order by ['Defender for SQL'] asc | order by Databases desc\r\n\r\n\r\ndatatable (Event:string)\r\n [\"SQL Workbook\"]\r\n| extend database = (strcat(\"[\", \"{Databases}\", \"]\"))\r\n| extend database = todynamic(replace(\"'\", '\"', database))\r\n| mvexpand database\r\n| extend subscriptionId = extract(@\"/subscriptions/([^/]+)\", 1, tostring(database))\r\n| summarize SQLs = count() by subscriptionId, DefenderForSQL = 0\r\n| union\r\n(\r\nsecurityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"SqlServers\"\r\n| project DefenderForSQL = iif(properties.pricingTier == 'Standard', 1, 0), SQLs = 0, subscriptionId\r\n)\r\n| summarize SQLs = sum(SQLs), DefenderForSQL = sum(DefenderForSQL) by subscriptionId\r\n| project Subscription = strcat('/subscriptions/', subscriptionId), [\"Databases\"] = SQLs, ['Defender for SQL'] = iif(DefenderForSQL > 0,'yes','no'), ['Onboard Azure Defender'] = iif(DefenderForSQL > 0, '', 'https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26')\r\n| order by ['Defender for SQL'] asc",
"size": 0,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscriptions}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Defender for SQL",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "no",
"representation": "4",
"text": "{0}"
},
{
"operator": "==",
"thresholdValue": "nodefender_nosql",
"representation": "2",
"text": "no"
},
{
"operator": "Default",
"representation": "success",
"text": "{1}"
}
]
}
},
{
"columnMatch": "Onboard Azure Defender",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url"
}
}
],
"sortBy": [
{
"itemKey": "$gen_thresholds_Defender for SQL_2",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "$gen_thresholds_Defender for SQL_2",
"sortOrder": 1
}
]
},
"customWidth": "50",
"name": "query - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//resources\r\n//| where type == \"microsoft.sql/servers/databases\"\r\n//| summarize Databases = count() by subscriptionId, DefenderForSQL = 0\r\n//| union\r\n//(securityresources\r\n//| where type =~ \"microsoft.security/pricings\"\r\n//| where name == \"SqlServers\"\r\n//| project DefenderForSQL = iif(properties.pricingTier == 'Standard', 1, 0), Databases = 0, subscriptionId)\r\n//| summarize Databases = sum(Databases), DefenderForSQL = sum(DefenderForSQL) by subscriptionId\r\n//| project Subscription = 1, ['Defender for SQL'] = iif(DefenderForSQL > 0,'Protected by Azure Defender','Not protected by Azure Defender')\r\n\r\n\r\ndatatable (Event:string)\r\n [\"SQL Workbook\"]\r\n| extend databases = (strcat(\"[\", \"{Databases}\", \"]\"))\r\n| extend databases = todynamic(replace(\"'\", '\"', databases))\r\n| mvexpand databases\r\n| extend subscriptionId = extract(@\"/subscriptions/([^/]+)\", 1, tostring(databases))\r\n| summarize SQLs = count() by subscriptionId, DefenderForSQL = 0\r\n| union\r\n(\r\nsecurityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"SqlServers\"\r\n| project DefenderForSQL = iif(properties.pricingTier == 'Standard', 1, 0), SQLs = 0, subscriptionId\r\n)\r\n| summarize SQLs = sum(SQLs), DefenderForSQL = sum(DefenderForSQL) by subscriptionId\r\n| project Subscription = 1, ['Defender for SQL'] = iif(DefenderForSQL > 0,'Protected by Azure Defender','Not protected by Azure Defender')",
"size": 0,
"title": "Defender coverage, by subscription",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscriptions}"
],
"visualization": "piechart"
},
"customWidth": "50",
"name": "query - 2"
}
]
},
"name": "DefenderforSQLCoverage"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Azure Defender for SQL alerts"
},
"name": "text - 0"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{Workspaces}"
],
"parameters": [
{
"id": "e4d004c4-5870-4d69-954c-423beb2cdb3b",
"version": "KqlParameterItem/1.0",
"name": "AlertSeverity",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "SecurityAlert\r\n| where AlertType startswith \"SQL.\"\r\n| where tolower(ResourceId) in ({Databases})\r\n| summarize Count = count() by AlertSeverity\r\n| order by Count desc, AlertSeverity asc\r\n| project Value = AlertSeverity, Label = strcat(AlertSeverity, ' - ', Count)\r\n",
"crossComponentResources": [
"{Workspaces}"
],
"value": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let data = SecurityAlert\r\n| where \"{AlertSeverity:lable}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where AlertType startswith \"SQL.\"\r\n| where tolower(ResourceId) in ({Databases});\r\ndata\r\n| summarize Count = count() by AlertSeverity\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertSeverity)\r\n on AlertSeverity\r\n | project-away TimeGenerated\r\n| extend AlertSeveritys = AlertSeverity\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend AlertSeverity = 'All', AlertSeveritys = '*' \r\n)\r\n| extend Severity = iif(AlertSeverity == \"All\", 0,iif(AlertSeverity == \"High\", 1, iif(AlertSeverity == \"Medium\", 2, iif(AlertSeverity == \"Low\", 3, 4))))\r\n| order by Severity asc\r\n",
"size": 0,
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "AlertSeverity",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Trend",
"formatter": 9,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": false
}
},
"name": "query - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert\r\n| where AlertType startswith \"SQL.\"\r\n| where tolower(ResourceId) in ({Databases})\r\n| where ResourceId != \"\"\r\n| where AlertSeverity in ({AlertSeverity})\r\n| summarize AlertCount = count() by ResourceId\r\n| project Resource = tolower(ResourceId), AlertCount\r\n| order by AlertCount desc\r\n",
"size": 0,
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "AlertCount",
"formatter": 3,
"formatOptions": {
"palette": "blue"
}
}
]
}
},
"customWidth": "30",
"name": "query - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert\r\n| where TimeGenerated {TimeRange}\r\n| where \"{AlertSeverity}\" has AlertSeverity or isempty(\"{AlertSeverity}\")\r\n| where AlertType startswith \"SQl.\"\r\n| where tolower(ResourceId) in ({Databases})\r\n| where ResourceId != \"\"\r\n//| summarize Count=count() by ResourceId, bin(TimeGenerated,{TimeRange:grain})\r\n| make-series Count = count() on TimeGenerated from ago(30d) to now() step {TimeRange:grain} by ResourceId",
"size": 0,
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "timechart"
},
"customWidth": "70",
"name": "query - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//let Incidents = SecurityIncident\r\n//| project AlertIds, IncidentUrl\r\n//|mv-expand AlertId = AlertIds\r\n//| extend AlertId = tostring(AlertId);\r\nSecurityAlert\r\n| where AlertType startswith \"SQL.\"\r\n| where tolower(ResourceId) in ({Databases})// or tolower(ResourceId) in ({Servers})\r\n| where ResourceId != \"\"\r\n| where AlertSeverity in ({AlertSeverity})\r\n| project TimeGenerated, ResourceId, AlertSeverity, DisplayName, AlertLink, AlertId=tostring(SystemAlertId)\r\n| order by TimeGenerated desc\r\n//| join kind=leftouter Incidents on AlertId\r\n//| project-away AlertIds, AlertId1\r\n| project TimeGenerated, ResourceId, AlertSeverity, DisplayName, ['Azure Defender Alert'] = AlertLink, AlertId //Incident = IncidentUrl, AlertId\r\n",
"size": 0,
"title": "SQL Server alerts",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"exportFieldName": "AlertId",
"exportParameterName": "SelectedAlertId",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Azure Defender Alert",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkLabel": "Go to alert"
}
},
{
"columnMatch": "Incident",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url"
}
},
{
"columnMatch": "AlertId",
"formatter": 5
}
],
"filter": true
}
},
"name": "query - 16"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let data = SecurityAlert\r\n| where AlertType startswith \"SQL.\"\r\n| where SystemAlertId == '{SelectedAlertId}';\r\nlet nodes = data\r\n| project Id = SystemAlertId, Name = DisplayName, Size = 1, Kind = 'alert'\r\n| union (\r\ndata \r\n| project parse_json(Entities), SystemAlertId\r\n| mv-expand Entities\r\n| evaluate bag_unpack(Entities)\r\n| project Id = strcat(SystemAlertId, '-',$id), Name = strcat(ResourceId,Address), Size = 1, Kind = Type\r\n);\r\nlet links = data\r\n| project parse_json(Entities), SystemAlertId\r\n| mv-expand Entities\r\n| evaluate bag_unpack(Entities)\r\n| project SourceId = SystemAlertId, TargetId = strcat(SystemAlertId, '-', $id), Size = 1, Kind = Type\r\n;\r\nnodes\r\n| union (links)\r\n| where Kind != \"\"",
"size": 0,
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "graph",
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "Name",
"formatter": 13,
"formatOptions": {
"showIcon": true
}
},
"centerContent": {
"columnMatch": "Kind",
"formatter": 16,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"nodeIdField": "Id",
"sourceIdField": "SourceId",
"targetIdField": "TargetId",
"graphOrientation": 3,
"showOrientationToggles": false,
"edgeSize": "Size",
"edgeLabel": "Kind",
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "Kind",
"type": 1,
"colorPalette": "default"
},
"hivesMargin": 5
}
},
"name": "query - 6"
}
]
},
"name": "DefenderforSQLAlerts"
}
]
},
"conditionalVisibility": {
"parameterName": "mainTab",
"comparison": "isEqualTo",
"value": "alerts"
},
"name": "DefenderforSQL"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Sensitive Data Analytics"
},
"name": "text - 0"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend label = tostring(parsed[\"@label\"]) \r\n| where label != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by label ",
"size": 0,
"title": "Number of queries, by sensitivity label",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"exportMultipleValues": true,
"exportedParameters": [
{
"fieldName": "label",
"parameterName": "SelectedLabel",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "label",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": false
}
},
"customWidth": "33",
"name": "query - 3 - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend info_type = tostring(parsed[\"@information_type\"]) \r\n| where info_type != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by info_type",
"size": 0,
"title": "Number of queries, by information type",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"exportMultipleValues": true,
"exportedParameters": [
{
"fieldName": "info_type",
"parameterName": "SelectedInformationType",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "tiles",
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "info_type",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"createOtherGroup": 10
}
},
"customWidth": "33",
"name": "query - 3 - Copy - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend Principal = server_principal_name_s\r\n| summarize dcount = dcount(sequence_group_id_g) by Principal",
"size": 0,
"title": "Number of queries, by principal",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"exportMultipleValues": true,
"exportedParameters": [
{
"fieldName": "Principal",
"parameterName": "SelectedPrincipal",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Principal",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"showBorder": false
},
"chartSettings": {
"createOtherGroup": 10
}
},
"customWidth": "33",
"name": "query - 3 - Copy - Copy - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics\r\n| where tolower(ResourceId) in ({Databases})\r\n| where isempty(data_sensitivity_information_s) == false\r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n//| evaluate bag_unpack(parsed, columnsConflict='keep_source')\r\n| mvexpand parsed \r\n| project TimeGenerated, ResourceId, Label = tostring(parsed.['@label']), InformationType = tostring(parsed.['@information_type'])\r\n , Succeeded = succeeded_s, Principal = server_principal_name_s, ClientIP = client_ip_s, Application = application_name_s, Statement = statement_s, Rows = response_rows_d, Action = action_name_s\r\n| where Label != \"\" or InformationType != \"\"\r\n| where isempty('{SelectedLabel}') or (strcat('\"',Label,'\"') in (split('{SelectedLabel}',',')))\r\n| where isempty('{SelectedInformationType}') or (strcat('\"',InformationType,'\"') in (split('{SelectedInformationType}',',')))\r\n| where isempty('{SelectedPrincipal}') or (strcat('\"',Principal,'\"') in (split('{SelectedPrincipal}',',')))",
"size": 0,
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
]
},
"name": "query - 15"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend label = tostring(parsed[\"@label\"]) \r\n| where label != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by label_and_app = strcat(label, \" | \", application_name_s)\r\n| order by label_and_app asc, dcount desc",
"size": 0,
"title": "Application access to classified data (by sensitivity label)",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "piechart"
},
"customWidth": "40",
"name": "query - 3 - Copy - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend label = tostring(parsed[\"@label\"]) \r\n| where label != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by label_and_ip = strcat(label, \" | \", client_ip_s) \r\n| order by label_and_ip asc, dcount desc",
"size": 0,
"title": "IP access to classified data (by sensitivity label)",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "piechart",
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "action_name_s",
"formatter": 1
},
"leftContent": {
"columnMatch": "count_",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "action_name_s",
"formatter": 1
},
"centerContent": {
"columnMatch": "count_",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "40",
"name": "query - 3",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend info_type = tostring(parsed[\"@information_type\"]) \r\n| where info_type != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by info_type_and_app = strcat(info_type, \" | \", application_name_s) \r\n| order by info_type_and_app asc, dcount desc",
"size": 0,
"title": "Application access to classified data (by information type)",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "piechart",
"chartSettings": {
"createOtherGroup": 10
}
},
"customWidth": "40",
"name": "query - 3 - Copy - Copy - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where tolower(ResourceId) in ({Databases})\r\n| where data_sensitivity_information_s != \"\" \r\n| extend parsed=parse_xml(data_sensitivity_information_s).sensitivity_attributes.sensitivity_attribute \r\n| mvexpand parsed \r\n| extend info_type = tostring(parsed[\"@information_type\"]) \r\n| where info_type != \"\" \r\n| summarize dcount = dcount(sequence_group_id_g) by info_type_and_ip = strcat(info_type, \" | \", client_ip_s) \r\n| order by info_type_and_ip asc, dcount desc",
"size": 0,
"title": "IP access to classified data (by information type)",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "piechart",
"chartSettings": {
"createOtherGroup": 10
}
},
"customWidth": "40",
"name": "query - 3 - Copy - Copy - Copy - Copy",
"styleSettings": {
"margin": "0",
"padding": "0"
}
}
]
},
"conditionalVisibility": {
"parameterName": "mainTab",
"comparison": "isEqualTo",
"value": "classification"
},
"name": "DataClassification"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 24"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "3c23fea3-c94f-4d80-9ab0-dc7506b65c25",
"version": "KqlParameterItem/1.0",
"name": "BaselineTimeRange",
"type": 4,
"isRequired": true,
"value": {
"durationMs": 1209600000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 0"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics\r\n| where TimeGenerated > {BaselineTimeRange:start}\r\n| where ResourceType == \"SERVERS/DATABASES\"\r\n| where Category == \"SQLSecurityAuditEvents\"\r\n| where tolower(ResourceId) in ({Databases})\r\n| extend Database = strcat(LogicalServerName_s, '/', database_name_s)\r\n| summarize DailyCount = count() by ResourceId, Database, bin_at(TimeGenerated, 1d, now())\r\n| make-series metric = sum(DailyCount) on TimeGenerated in range({BaselineTimeRange:start}, now()-1d, 1d) by ResourceId, Database\r\n| extend series_decompose_anomalies(metric) // Anomaly detection\r\n| project ResourceId, Database, day = (TimeGenerated), DailyCounts = metric, AnomalyScore = series_decompose_anomalies_metric_ad_score\r\n| extend MaxAnomalyScore = AnomalyScore, MinAnomalyScore = AnomalyScore, AnomlyScoreTrend = AnomalyScore\r\n| mv-apply MaxAnomalyScore to typeof(real) on (top 1 by MaxAnomalyScore desc)\r\n| mv-apply MinAnomalyScore to typeof(real) on (top 1 by MinAnomalyScore asc)\r\n| mv-expand with_itemindex=Index AnomalyScore\r\n| where Index == array_length(DailyCounts)-1\r\n| project-away day, Index\r\n| extend AnomalyScoreAbs = abs(toreal(AnomalyScore))\r\n| extend WasAnomalous = iif(MaxAnomalyScore > 3 or MinAnomalyScore < -3, true, false)\r\n| extend Anomalous = iif(AnomalyScoreAbs > 3, true, false)\r\n| order by AnomalyScoreAbs desc\r\n\r\n",
"size": 0,
"title": "Daily anomaly scores, by database",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"exportFieldName": "ResourceId",
"exportParameterName": "SelectedResource",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "DailyCounts",
"formatter": 9,
"formatOptions": {
"palette": "blue"
}
},
{
"columnMatch": "AnomalyScore",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "startsWith",
"thresholdValue": "-",
"representation": "trenddown",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "0",
"representation": "right",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "trendup",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "MaxAnomalyScore",
"formatter": 5
},
{
"columnMatch": "MinAnomalyScore",
"formatter": 5
},
{
"columnMatch": "AnomlyScoreTrend",
"formatter": 9,
"formatOptions": {
"palette": "orange"
}
},
{
"columnMatch": "AnomalyScoreAbs",
"formatter": 5
},
{
"columnMatch": "WasAnomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "true",
"representation": "2",
"text": ""
},
{
"operator": "==",
"thresholdValue": "false",
"representation": "Blank",
"text": ""
},
{
"operator": "Default",
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Anomalous",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "true",
"representation": "Important",
"text": ""
},
{
"operator": "==",
"thresholdValue": "false",
"representation": "Blank",
"text": ""
},
{
"operator": "Default",
"representation": "success",
"text": "{0}{1}"
}
]
}
}
]
}
},
"name": "query - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics\r\n| where TimeGenerated > {BaselineTimeRange:start}\r\n| where ResourceType == \"SERVERS/DATABASES\"\r\n| where Category == \"SQLSecurityAuditEvents\"\r\n| where tolower(ResourceId) == tolower('{SelectedResource}')\r\n| summarize DailyCount = count() by ResourceId, bin_at(TimeGenerated, 1d, now())\r\n| make-series metric = sum(DailyCount) on TimeGenerated in range({BaselineTimeRange:start}, now()-1d, 1d) by ResourceId\r\n| extend series_decompose_anomalies(metric) // Anomaly detection\r\n| project ResourceId, day = (TimeGenerated), DailyCounts = metric, AnomalyScore = series_decompose_anomalies_metric_ad_score\r\n",
"size": 0,
"title": "Anomaly score over time for the selected database (from the list above)",
"color": "orange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "timechart",
"chartSettings": {
"yAxis": [
"AnomalyScore"
],
"ySettings": {
"numberFormatSettings": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "50",
"name": "query - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics\r\n| where TimeGenerated > {BaselineTimeRange:start}\r\n| where ResourceType == \"SERVERS/DATABASES\"\r\n| where Category == \"SQLSecurityAuditEvents\"\r\n| where tolower(ResourceId) == tolower('{SelectedResource}')\r\n| summarize DailyCount = count() by ResourceId, bin_at(TimeGenerated, 1d, now())\r\n| make-series metric = sum(DailyCount) on TimeGenerated in range({BaselineTimeRange:start}, now()-1d, 1d) by ResourceId\r\n| extend series_decompose_anomalies(metric) // Anomaly detection\r\n| project ResourceId, day = (TimeGenerated), DailyCounts = metric, AnomalyScore = series_decompose_anomalies_metric_ad_score\r\n",
"size": 0,
"title": "Daily activity over time for the selected database (from the list above)",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "timechart",
"chartSettings": {
"yAxis": [
"DailyCounts"
],
"ySettings": {
"numberFormatSettings": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "50",
"name": "query - 2"
}
]
},
"name": "baselines",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibility": {
"parameterName": "mainTab",
"comparison": "isEqualTo",
"value": "diagnostics"
},
"name": "DiagnosticsGroup"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "32eb9f07-9b66-402c-b87a-e9306ae67aec",
"version": "KqlParameterItem/1.0",
"name": "Aggregate",
"type": 2,
"isRequired": true,
"typeSettings": {
"showDefault": false
},
"jsonData": "[ {\"value\": \"Database\", \"label\": \"Database\" }\r\n , { \"value\": \"PrincipalName\", \"label\": \"PrincipalName\", \"selected\":true }\r\n , { \"value\": \"ClientIp\", \"label\": \"ClientIp\" }\r\n , { \"value\": \"HostName\", \"label\": \"HostName\" }\r\n , { \"value\": \"ApplicationName\", \"label\": \"ApplicationName\" }\r\n , { \"value\": \"ActionName\", \"label\": \"ActionName\"}\r\n]",
"timeContext": {
"durationMs": 86400000
}
},
{
"version": "KqlParameterItem/1.0",
"name": "Quantify",
"type": 2,
"isRequired": true,
"typeSettings": {
"showDefault": false
},
"jsonData": "[ { \"value\": \"'Events'\", \"label\": \"Events\", \"selected\":true }\r\n , { \"value\": \"'Successes'\", \"label\": \"Successes\" }\r\n , { \"value\": \"'Failures'\", \"label\": \"Failures\" }\r\n , { \"value\": \"'Egress'\", \"label\": \"Egress\" }\r\n , { \"value\": \"'Ingress'\", \"label\": \"Ingress\"}\r\n]",
"timeContext": {
"durationMs": 86400000
},
"id": "01d632f2-c540-489f-89a4-f388b3369554"
},
{
"id": "348c2b77-db4c-4893-83fe-86cc0e9b8a2b",
"version": "KqlParameterItem/1.0",
"name": "Filter",
"type": 2,
"isRequired": true,
"typeSettings": {
"showDefault": false
},
"jsonData": "[ { \"value\": \"'All'\", \"label\": \"All\", \"selected\":true }\r\n , { \"value\": \"'Execution'\", \"label\": \"Execution\" }\r\n , { \"value\": \"'Statement'\", \"label\": \"Statement\" }\r\n , { \"value\": \"'Drop'\", \"label\": \"Drop\" }\r\n , { \"value\": \"'Outward'\", \"label\": \"Outward\" }\r\n , { \"value\": \"'OS'\", \"label\": \"OS\" }\r\n]",
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "Parameters for general query"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where Category == 'SQLSecurityAuditEvents'\r\n| where tolower(ResourceId) in ({Databases})\r\n| extend PrincipalName = server_principal_name_s, ClientIp = client_ip_s, HostName = host_name_s, ApplicationName = application_name_s, ActionName = action_name_s\r\n , Database = strcat(LogicalServerName_s, '/', database_name_s), isSuccess = succeeded_s, affectedRows = affected_rows_d, responseRows = response_rows_d\r\n , Statement = statement_s\r\n , q = {Quantify:value}, f = {Filter:value}\r\n| extend indicator = case (\r\n f == 'All', 1,\r\n f == 'Statement', iff(isempty(Statement) == 'false', 1, 0),\r\n f == 'Execution', iff(Statement contains 'xp_' or Statement contains 'ps.exe' or Statement contains 'powershell' or Statement contains 'msdb exec', 1, 0),\r\n f == 'Drop', iff(Statement contains \"drop table\" or Statement contains \"drop database\", 1, 0),\r\n f == 'Outward', iff(Statement contains 'http:' or Statement contains 'https:' or Statement contains 'ftp:' or Statement contains 'curl ', 1, 0),\r\n f == 'OS', iff(Statement contains 'sys.dm_os', 1, 0),\r\n 0)\r\n| where indicator == 1\r\n| extend quantity = case(\r\n q == 'Events', tolong(1),\r\n q == 'Successes', tolong(iff(isSuccess == 'true', 1, 0)),\r\n q == 'Failures', tolong(iff(isSuccess == 'false', 1, 0)),\r\n q == 'Egress', tolong(responseRows),\r\n q == 'Ingress', tolong(affectedRows),\r\n tolong(1))\r\n| make-series sum(quantity) on TimeGenerated from ago(30d) to now() step 1d by {Aggregate:escapejson}\r\n//| summarize Count = sum(quantity) by {Aggregate:escapejson}, bin_at(TimeGenerated, 1h, now())\r\n| render timechart",
"size": 0,
"showAnnotations": true,
"title": "Distribution by parameter",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"timeBrushParameterName": "TimeWindow",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
]
},
"customWidth": "70",
"name": "query: Piechart by parameter"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where Category == 'SQLSecurityAuditEvents'\r\n| where tolower(ResourceId) in ({Databases})\r\n| where TimeGenerated {TimeWindow}\r\n| extend PrincipalName = server_principal_name_s, ClientIp = client_ip_s, HostName = host_name_s, ApplicationName = application_name_s, ActionName = action_name_s\r\n , Database = strcat(LogicalServerName_s, '/', database_name_s), isSuccess = succeeded_s, affectedRows = affected_rows_d, responseRows = response_rows_d\r\n , Statement = statement_s, q = {Quantify:value}, f = {Filter:value}\r\n| extend indicator = case (\r\n f == 'All', 1,\r\n f == 'Statement', iff(isempty(Statement) == 'false', 1, 0),\r\n f == 'Execution', iff(Statement contains 'xp_' or Statement contains 'ps.exe' or Statement contains 'powershell' or Statement contains 'msdb exec', 1, 0),\r\n f == 'Drop', iff(Statement contains \"drop table\" or Statement contains \"drop database\", 1, 0),\r\n f == 'Outward', iff(Statement contains 'http:' or Statement contains 'https:' or Statement contains 'ftp:' or Statement contains 'curl ', 1, 0),\r\n f == 'OS', iff(Statement contains 'sys.dm_os', 1, 0),\r\n 0)\r\n| where indicator == 1\r\n| extend quantity = case(\r\n q == 'Events', tolong(1),\r\n q == 'Successes', tolong(iff(isSuccess == 'true', 1, 0)),\r\n q == 'Failures', tolong(iff(isSuccess == 'false', 1, 0)),\r\n q == 'Egress', tolong(responseRows),\r\n q == 'Ingress', tolong(affectedRows),\r\n tolong(1))\r\n| summarize Count = sum(quantity) by {Aggregate:escapejson}\r\n| sort by Count desc\r\n",
"size": 0,
"title": "Distribution by parameter",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
],
"visualization": "piechart"
},
"customWidth": "30",
"name": "query: Piechart by parameter"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "AzureDiagnostics \r\n| where Category == 'SQLSecurityAuditEvents'\r\n| where tolower(ResourceId) in ({Databases})\r\n| where TimeGenerated {TimeWindow}\r\n| project TimeGenerated, ResourceId, ClientIP = client_ip_s, Principal = server_principal_name_s\r\n, HostName = host_name_s, ApplicationName = application_name_s, ActionName = action_name_s\r\n, Database = strcat(LogicalServerName_s, '/', database_name_s), AdditionalInfo = parse_xml(additional_information_s), Statement = statement_s, isSuccessful = succeeded_s, f = {Filter:value}\r\n| extend indicator = case (\r\n f == 'All', 1,\r\n f == 'Statement', iff(isempty(Statement) == 'false', 1, 0),\r\n f == 'Execution', iff(Statement contains 'xp_' or Statement contains 'ps.exe' or Statement contains 'powershell' or Statement contains 'msdb exec', 1, 0),\r\n f == 'Drop', iff(Statement contains \"drop table\" or Statement contains \"drop database\", 1, 0),\r\n f == 'Outward', iff(Statement contains 'http:' or Statement contains 'https:' or Statement contains 'ftp:' or Statement contains 'curl ', 1, 0),\r\n f == 'OS', iff(Statement contains 'sys.dm_os', 1, 0),\r\n 0)\r\n| where indicator == 1\r\n| evaluate bag_unpack(AdditionalInfo)\r\n//| evaluate bag_unpack(batch_information)\r\n//| extend split(failure_reason, ',')\r\n//| extend Error = tostring(failure_reason[(0)]), Level = trim(@\"[^\\w]+\", tostring(failure_reason[(1)])), Reason = trim(@\"[^\\w]+\", tostring(failure_reason[(2)]))\r\n//| project-away failure_reason\r\n| project TimeGenerated, ResourceId, Database, ClientIP, Principal, ApplicationName, HostName, ActionName, Statement, isSuccessful//, Error, Level, Reason\r\n| sort by isSuccessful desc, TimeGenerated desc",
"size": 0,
"title": "Events Log",
"timeContext": {
"durationMs": 604800000
},
"timeContextFromParameter": "TimeRange",
"exportFieldName": "Statement",
"exportParameterName": "SelectedSpecialStatement",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspaces}"
]
},
"customWidth": "100",
"name": "query: Piechart by parameter - Copy - Copy"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "b71c1023-54dd-457a-a05d-77a06c3b25fa",
"version": "KqlParameterItem/1.0",
"name": "Statement",
"type": 1,
"query": "let statement = '{SelectedSpecialStatement:base64}';\r\nprint Statement = base64_decode_tostring(statement)",
"typeSettings": {
"multiLineText": true,
"editorLanguage": "text",
"multiLineHeight": 10
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "formHorizontal",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 10 - Copy - Copy - Copy"
}
]
},
"conditionalVisibility": {
"parameterName": "mainTab",
"comparison": "isEqualTo",
"value": "diagnostics"
},
"name": "AuditLogInvestigate"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "dce50414-fa42-49b9-9c83-54acce4d7211",
"version": "KqlParameterItem/1.0",
"name": "SentinelWSs",
"label": "Sentinel Workspaces",
"type": 5,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "where type =~ 'microsoft.operationsmanagement/solutions'\r\n| where strcat('/subscriptions/',subscriptionId) in ({Subscriptions})\r\n| where name startswith 'SecurityInsights'\r\n| project tostring(properties.workspaceResourceId)",
"crossComponentResources": [
"{Subscriptions}"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"defaultValue": "value::all",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "bf75c90c-0362-4276-b5dc-7b5140ead81d",
"version": "KqlParameterItem/1.0",
"name": "ASCAndSentWSs",
"type": 5,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "datatable (Workspace:string) [{Workspaces}]\r\n| union (datatable (Workspace:string) [{SentinelWSs}])\r\n| distinct Workspace\r\n",
"isHiddenWhenLocked": true,
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": null
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 11"
},
{
"type": 1,
"content": {
"json": "Troubleshooting guide
\r\nSelect one of the following SQL Alerts to investigate:
\r\n"
},
"name": "text - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert\r\n| where Entities has \"MICROSOFT.SQL\"\r\n| extend ['Azure Defender Alert'] = iff(isnotempty(AlertLink),\"Open in Azure Defender\",\"\")\r\n| extend Entities=tostring(Entities), ['Principal Name']=tostring(todynamic(ExtendedProperties)[\"Principal name\"])\r\n| distinct StartTime, ResourceId, DisplayName, AlertSeverity, ['Azure Defender Alert'], AlertLink, SystemAlertId, Entities, ['Principal Name'], RemediationSteps\r\n| extend Entities=todynamic(Entities), RemediationSteps=todynamic(RemediationSteps)\r\n| mv-apply element=Entities to typeof(dynamic) on \r\n(\r\n where element.Type == \"azure-resource\"\r\n | project ResourceId=tostring(element.ResourceId)\r\n)\r\n| where tolower(ResourceId) in ({Databases})\r\n| mv-apply element=Entities to typeof(dynamic) on \r\n(\r\n where element.Type == \"ip\"\r\n | project ['Related IP']=element.Address\r\n)\r\n| join kind=leftouter (\r\nSecurityIncident\r\n| mv-expand AlertIds to typeof(string)\r\n| project AlertIds, IncidentUrl\r\n) on $left.SystemAlertId == $right.AlertIds\r\n| project-away AlertIds\r\n| extend ['Sentinel Incident']=iff(isempty(IncidentUrl), \"This alert is not onboarded to Sentinel\", \"Open incident in Sentinel\")\r\n| extend SubscriptionId=tostring(split(ResourceId, '/')[2]), ResourceGroup=tostring(split(ResourceId, '/')[4]), SqlName=tostring(split(ResourceId, '/')[-1])\r\n| order by StartTime desc\r\n| project-rename ['Start Time']=StartTime, ['Alert Name']=DisplayName, ['Alert Severity']=AlertSeverity\r\n\r\n",
"size": 0,
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "Related IP",
"parameterName": "ip",
"parameterType": 1
},
{
"fieldName": "SqlName",
"parameterName": "SqlName",
"parameterType": 1
},
{
"fieldName": "Start Time",
"parameterName": "StartTime",
"parameterType": 1
},
{
"fieldName": "SubscriptionId",
"parameterName": "SubscriptionId",
"parameterType": 1
},
{
"fieldName": "ResourceGroup",
"parameterName": "ResourceGroup",
"parameterType": 1
},
{
"fieldName": "ResourceId",
"parameterName": "ResourceId",
"parameterType": 1
},
{
"fieldName": "SystemAlertId",
"parameterName": "VendorOriginalId",
"parameterType": 1
},
{
"fieldName": "Entities",
"parameterName": "Entities",
"parameterType": 1
},
{
"fieldName": "AlertLink",
"parameterName": "ASCLink",
"parameterType": 1
},
{
"fieldName": "Principal Name",
"parameterName": "PrincipalName",
"parameterType": 1
},
{
"fieldName": "RemediationSteps",
"parameterName": "RemediationSteps",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Alert Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "blue",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Azure Defender Alert",
"formatter": 1,
"formatOptions": {
"linkColumn": "AlertLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "AlertLink",
"formatter": 5
},
{
"columnMatch": "SystemAlertId",
"formatter": 5
},
{
"columnMatch": "Entities",
"formatter": 5
},
{
"columnMatch": "RemediationSteps",
"formatter": 5
},
{
"columnMatch": "IncidentUrl",
"formatter": 5,
"formatOptions": {
"linkTarget": "Url",
"linkLabel": "Open the Sentinel Incident"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": false
},
"emptyValCustomText": "Alert not onboarded to Sentinel"
}
},
{
"columnMatch": "Sentinel Incident",
"formatter": 1,
"formatOptions": {
"linkColumn": "IncidentUrl",
"linkTarget": "Url"
}
},
{
"columnMatch": "SubscriptionId",
"formatter": 5
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "SqlName",
"formatter": 5
},
{
"columnMatch": "Message",
"formatter": 1,
"formatOptions": {
"linkColumn": "IncidentUrl",
"linkTarget": "Url"
}
}
]
}
},
"name": "query - 0"
},
{
"type": 1,
"content": {
"json": "Step 1: Validate the activity in the logs:
\r\nThis section presents the activity related to the entities in the alert: the IP, the database and the principal user within the selected time window around the alert. \r\n\r\n- Can you identify suspicious or unexpected activity?
\r\n
\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "ip",
"comparison": "isNotEqualTo",
"value": ""
},
"name": "text - 3"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "0c4d4daa-5109-4e4c-90c8-e6acaf6b76ae",
"version": "KqlParameterItem/1.0",
"name": "TimeWin",
"label": "Time window",
"type": 2,
"description": "Time window in days to search around the alert",
"query": "print TimeWin=range(1d, 7d, 1d)\r\n| mv-expand TimeWin \r\n| extend TimeWin=totimespan(TimeWin)\r\n| extend TimeWinText=strcat(toint(TimeWin/1d), iff(TimeWin == 1d, ' day ',' days '))//, toint(TimeWin/1d-toint(TimeWin/1d))*24, ' hours')",
"value": "1.00:00:00",
"typeSettings": {
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "e78776f9-43d6-407d-8be9-0d22514c2935",
"version": "KqlParameterItem/1.0",
"name": "EmailContent",
"type": 1,
"query": "print Subject=\"SOC inquiry\",\r\nBody=\"Dear User,\\n\\nA suspicious activity was observed on your {SqlName} SQL server.\\nPlease confirm you are aware of this activity, or contact us for assistance.\\n\\nThanks,\\nThe SOC\"\r\n| project EmailContent=strcat('?subject=', Subject, '&body=', replace('\\n','%0d%0a',Body))\r\n\r\n",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "ip",
"comparison": "isNotEqualTo",
"value": ""
},
"name": "parameters - 2"
},
{
"type": 1,
"content": {
"json": "Search for all the activity of IP {ip}:
\r\n\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "ip",
"comparison": "isNotEqualTo",
"value": ""
},
"name": "text - 3 - Copy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{ip}\"\r\n| summarize min(TimeGenerated), count() by SourceTable, CategoryValue, Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), Caller, ActivityStatus\r\n| summarize ['Earliest Call']=min(min_TimeGenerated), ActivityStatus=make_list(pack('Status',ActivityStatus,'Count',count_)) by SourceTable, Category=CategoryValue, Operation, ApplicationName, Caller\r\n| extend Chat = iff(isnotempty(Caller),\"💬\",\"\")\r\n| extend ChatLink=strcat(\"https://teams.microsoft.com/l/chat/0/0?users=\", Caller)\r\n| extend Email= iff(isnotempty(Caller),\"📧\",\"\")\r\n| extend EmailLink=strcat(\"mailto:\",Caller,\"{EmailContent}\")\r\n| project ['Source Table']=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable), Category, Operation, ApplicationName, ['Earliest Call'], Caller, Chat, ChatLink, Email, EmailLink, ActivityStatus\r\n| mv-expand ActivityStatus \r\n| evaluate bag_unpack(ActivityStatus)\r\n| union (print Status='dummy', Count=1 | take 0) // force the columns existance\r\n| evaluate pivot(Status, sum(Count))\r\n| project-rename ['Application Name']=ApplicationName\r\n| extend ['Activity Status'] = column_ifexists('Accepted', 0)+column_ifexists('Failed', 0)+column_ifexists('Succeeded', 0)+column_ifexists('Active', 0)+column_ifexists('Started', 0)+column_ifexists('_Empty', 0)\r\n",
"size": 1,
"showAnalytics": true,
"title": "Choose a record to present full details:",
"exportedParameters": [
{
"fieldName": "Source Table",
"parameterName": "SourceTable",
"parameterType": 1
},
{
"fieldName": "Operation",
"parameterName": "Operation",
"parameterType": 1
},
{
"fieldName": "Caller",
"parameterName": "Caller",
"parameterType": 1,
"defaultValue": ""
},
{
"fieldName": "Application Name",
"parameterName": "ApplicationName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "ip",
"comparison": "isNotEqualTo"
},
"name": "query - 15 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{ip}\"\r\n| extend Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), SourceTable=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable)\r\n| where SourceTable == \"{SourceTable}\"\r\n| where Operation == \"{Operation}\"\r\n| where (\"{Caller}\" == \"\" and isempty(Caller)) or \"{Caller}\" == Caller \r\n| where (\"{ApplicationName}\" == \"\" and isempty(ApplicationName)) or \"{ApplicationName}\" == ApplicationName \r\n| project-away ['$table']\r\n",
"size": 0,
"showAnalytics": true,
"title": "Full details",
"noDataMessage": "Click a record on the left to see full details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibilities": [
{
"parameterName": "ip",
"comparison": "isNotEqualTo"
},
{
"parameterName": "SourceTable",
"comparison": "isNotEqualTo"
}
],
"name": "query - 15 - Copy - Copy",
"styleSettings": {
"margin": "10"
}
}
]
},
"name": "group - 18",
"styleSettings": {
"showBorder": true
}
},
{
"type": 1,
"content": {
"json": "Search for all the activity on the {SqlName} database:
\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "SqlName",
"comparison": "isNotEqualTo"
},
"name": "text - 5"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{SqlName}\"\r\n| summarize min(TimeGenerated), count() by SourceTable, CategoryValue, Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), Caller, ActivityStatus\r\n| summarize ['Earliest Call']=min(min_TimeGenerated), ActivityStatus=make_list(pack('Status',ActivityStatus,'Count',count_)) by SourceTable, Category=CategoryValue, Operation, ApplicationName, Caller\r\n| extend Chat = iff(isnotempty(Caller),\"💬\",\"\")\r\n| extend ChatLink=strcat(\"https://teams.microsoft.com/l/chat/0/0?users=\", Caller)\r\n| extend Email= iff(isnotempty(Caller),\"📧\",\"\")\r\n| extend EmailLink=strcat(\"mailto:\",Caller,\"{EmailContent}\")\r\n| project ['Source Table']=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable), Category, Operation, ApplicationName, ['Earliest Call'], Caller, Chat, ChatLink, Email, EmailLink, ActivityStatus\r\n| mv-expand ActivityStatus \r\n| evaluate bag_unpack(ActivityStatus)\r\n| union (print Status='dummy', Count=1 | take 0) // force the columns existance\r\n| evaluate pivot(Status, sum(Count))\r\n| project-rename ['Application Name']=ApplicationName\r\n| extend ['Activity Status'] = column_ifexists('Accepted', 0)+column_ifexists('Failed', 0)+column_ifexists('Succeeded', 0)+column_ifexists('Active', 0)+column_ifexists('Started', 0)+column_ifexists('_Empty', 0)\r\n",
"size": 1,
"showAnalytics": true,
"title": "Choose a record to present full details:",
"exportedParameters": [
{
"fieldName": "Source Table",
"parameterName": "SQL_SourceTable",
"parameterType": 1
},
{
"fieldName": "Operation",
"parameterName": "SQL_Operation",
"parameterType": 1
},
{
"fieldName": "Caller",
"parameterName": "SQL_Caller",
"parameterType": 1,
"defaultValue": ""
},
{
"fieldName": "Application Name",
"parameterName": "SQL_ApplicationName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "ip",
"comparison": "isNotEqualTo"
},
"name": "query - 15 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{SqlName}\"\r\n| extend Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), SourceTable=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable)\r\n| where SourceTable == \"{SQL_SourceTable}\"\r\n| where Operation == \"{SQL_Operation}\"\r\n| where (\"{SQL_Caller}\" == \"\" and isempty(Caller)) or \"{SQL_Caller}\" == Caller \r\n| where (\"{SQL_ApplicationName}\" == \"\" and isempty(ApplicationName)) or \"{SQL_ApplicationName}\" == ApplicationName \r\n| project-away ['$table']\r\n",
"size": 0,
"showAnalytics": true,
"title": "Full details",
"noDataMessage": "Click a record on the left to see full details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibilities": [
{
"parameterName": "SqlName",
"comparison": "isNotEqualTo"
},
{
"parameterName": "SQL_SourceTable",
"comparison": "isNotEqualTo"
}
],
"name": "query - 15 - Copy - Copy",
"styleSettings": {
"margin": "10"
}
}
]
},
"name": "group - 18 - Copy",
"styleSettings": {
"showBorder": true
}
},
{
"type": 1,
"content": {
"json": "Search for all the activity of principal {PrincipalName}:
\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "PrincipalName",
"comparison": "isNotEqualTo"
},
"name": "text - 5 - Copy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{PrincipalName}\"\r\n| summarize min(TimeGenerated), count() by SourceTable, CategoryValue, Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), Caller, ActivityStatus\r\n| summarize ['Earliest Call']=min(min_TimeGenerated), ActivityStatus=make_list(pack('Status',ActivityStatus,'Count',count_)) by SourceTable, Category=CategoryValue, Operation, ApplicationName, Caller\r\n| extend Chat = iff(isnotempty(Caller),\"💬\",\"\")\r\n| extend ChatLink=strcat(\"https://teams.microsoft.com/l/chat/0/0?users=\", Caller)\r\n| extend Email= iff(isnotempty(Caller),\"📧\",\"\")\r\n| extend EmailLink=strcat(\"mailto:\",Caller,\"{EmailContent}\")\r\n| project ['Source Table']=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable), Category, Operation, ApplicationName, ['Earliest Call'], Caller, Chat, ChatLink, Email, EmailLink, ActivityStatus\r\n| mv-expand ActivityStatus \r\n| evaluate bag_unpack(ActivityStatus)\r\n| union (print Status='dummy', Count=1 | take 0) // force the columns existance\r\n| evaluate pivot(Status, sum(Count))\r\n| project-rename ['Application Name']=ApplicationName\r\n| extend ['Activity Status'] = column_ifexists('Accepted', 0)+column_ifexists('Failed', 0)+column_ifexists('Succeeded', 0)+column_ifexists('Active', 0)+column_ifexists('Started', 0)+column_ifexists('_Empty', 0)\r\n",
"size": 1,
"showAnalytics": true,
"title": "Choose a record to present full details:",
"exportedParameters": [
{
"fieldName": "Source Table",
"parameterName": "PN_SourceTable",
"parameterType": 1
},
{
"fieldName": "Operation",
"parameterName": "PN_Operation",
"parameterType": 1
},
{
"fieldName": "Caller",
"parameterName": "PN_Caller",
"parameterType": 1,
"defaultValue": ""
},
{
"fieldName": "Application Name",
"parameterName": "PN_ApplicationName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "PrincipalName",
"comparison": "isNotEqualTo"
},
"name": "query - 15 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nlet AzureDiagnosticsTable = view () { (AzureDiagnostics | extend CategoryValue=Category, OperationName=strcat(OperationName,'/',action_name_s), ActivityStatus=iff(succeeded_s==\"true\", \"Succeeded\", \"Failed\")) };\r\nunion withsource=SourceTable isfuzzy=true \r\nAzureActivity, \r\nAzureDiagnosticsTable\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| search \"{PrincipalName}\"\r\n| extend Operation=iff(isempty(OperationName),tolower(OperationNameValue),OperationName), ApplicationName=column_ifexists('application_name_s', \"\"), SourceTable=iff(SourceTable == \"AzureDiagnosticsTable\", \"AzureDiagnostics\", SourceTable)\r\n| where SourceTable == \"{PN_SourceTable}\"\r\n| where Operation == \"{PN_Operation}\"\r\n| where (\"{PN_Caller}\" == \"\" and isempty(Caller)) or \"{PN_Caller}\" == Caller \r\n| where (\"{PN_ApplicationName}\" == \"\" and isempty(ApplicationName)) or \"{PN_ApplicationName}\" == ApplicationName \r\n| project-away ['$table']\r\n",
"size": 0,
"showAnalytics": true,
"title": "Full details",
"noDataMessage": "Click a record on the left to see full details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
},
{
"columnMatch": "Accepted",
"formatter": 5
},
{
"columnMatch": "Active",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
},
{
"columnMatch": "Started",
"formatter": 5
},
{
"columnMatch": "Succeeded",
"formatter": 5
},
{
"columnMatch": "_Empty",
"formatter": 5
},
{
"columnMatch": "Activity Status",
"formatter": 22,
"formatOptions": {
"compositeBarSettings": {
"labelText": " Total: [\"Activity Status\"]",
"columnSettings": [
{
"columnName": "_Empty",
"color": "gray"
},
{
"columnName": "Accepted",
"color": "blue"
},
{
"columnName": "Active",
"color": "orange"
},
{
"columnName": "Failed",
"color": "redBright"
},
{
"columnName": "Started",
"color": "green"
},
{
"columnName": "Succeeded",
"color": "turquoise"
}
]
}
}
}
]
}
},
"conditionalVisibilities": [
{
"parameterName": "PrincipalName",
"comparison": "isNotEqualTo"
},
{
"parameterName": "PN_SourceTable",
"comparison": "isNotEqualTo"
}
],
"name": "query - 15 - Copy - Copy",
"styleSettings": {
"margin": "10"
}
}
]
},
"name": "group - 18 - Copy - Copy",
"styleSettings": {
"showBorder": true
}
},
{
"type": 1,
"content": {
"json": "Step 2: Validate the activity with the relevant users
\r\n
\r\nThis section presents users with control plane activity (ARM) around the alert time.\r\n\r\n- Contact one of the users - can they explain the activity?
\r\n
\r\n
\r\nSelect a user to contact regarding the activity:
\r\n"
},
"conditionalVisibility": {
"parameterName": "SubscriptionId",
"comparison": "isNotEqualTo"
},
"name": "text - 7"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let t = datetime({StartTime});\r\nlet timeWin = timespan({TimeWin});\r\nAzureActivity\r\n| where TimeGenerated between ((t-timeWin) .. (t+timeWin))\r\n| where ActivityStatusValue == \"Succeeded\"\r\n| where SubscriptionId == \"{SubscriptionId}\"\r\n| where Caller has '@'\r\n| summarize latestActivity=max(TimeGenerated) by Caller, hasAccessedResourceGroup=(ResourceGroup == \"{ResourceGroup}\"), hasAccessedResource=(ResourceId == \"{ResourceId}\")\r\n| extend Chat = iff(isnotempty(Caller),\"💬\",\"\")\r\n| extend ChatLink=strcat(\"https://teams.microsoft.com/l/chat/0/0?users=\", Caller)\r\n| extend Email= iff(isnotempty(Caller),\"📧\",\"\")\r\n| extend EmailLink=strcat(\"mailto:\",Caller,\"{EmailContent}\")\r\n| order by hasAccessedResource desc, hasAccessedResourceGroup desc, latestActivity desc\r\n| project-rename ['Accessed Resource']=hasAccessedResource, ['Accessed Resource Group']=hasAccessedResourceGroup\r\n| take 10\r\n",
"size": 1,
"noDataMessage": "No control-plane activity found ",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{ASCAndSentWSs}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Chat",
"formatter": 1,
"formatOptions": {
"linkColumn": "ChatLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "ChatLink",
"formatter": 5
},
{
"columnMatch": "Email",
"formatter": 1,
"formatOptions": {
"linkColumn": "EmailLink",
"linkTarget": "Url"
}
},
{
"columnMatch": "EmailLink",
"formatter": 5
}
]
}
},
"conditionalVisibility": {
"parameterName": "SubscriptionId",
"comparison": "isNotEqualTo"
},
"name": "query - 8"
},
{
"type": 1,
"content": {
"json": "Step 3: Remediation steps
\r\n
\r\nThis section links to common remeditaion steps that can be applied.\r\n"
},
"conditionalVisibility": {
"parameterName": "Entities",
"comparison": "isNotEqualTo"
},
"name": "text - 9"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let server = print ent=dynamic({Entities})\r\n| mvexpand ent\r\n| where ent.Type == 'azure-resource'\r\n| project AzureID=tostring(ent.ResourceId)\r\n;\r\nserver\r\n| project AzureID, ['Turn on auditing for the server']=strcat('https://ms.portal.azure.com/#@microsoft.onmicrosoft.com/resource',tostring(trim_end(\"/databases/.*$\",AzureID)),\"/serverAuditing\"), \r\n['Configure server firewall']=strcat('https://ms.portal.azure.com/#@microsoft.onmicrosoft.com/resource',trim_end(\"/databases/.*$\",AzureID),\"/firewall\"),\r\nASCLink = \"{ASCLink}\"\r\n| project AzureID, Actions=pack_array(\"View the alert in Azure Defender:\", 'Turn on auditing for the server:', \"Configure server firewall:\"), Links=pack_array(ASCLink, ['Turn on auditing for the server'], ['Configure server firewall'])\r\n| mvexpand Actions, Links\r\n| where isnotempty( Links)\r\n\r\n",
"size": 1,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Links",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkLabel": "Click to apply"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "Entities",
"comparison": "isNotEqualTo"
},
"name": "query - 10"
},
{
"type": 1,
"content": {
"json": "Azure Defender recommended steps:
\r\n"
},
"conditionalVisibility": {
"parameterName": "RemediationSteps",
"comparison": "isNotEqualTo"
},
"name": "text - 7 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print RemediationSteps=dynamic({RemediationSteps})\r\n| mv-expand RemediationSteps to typeof(string)\r\n| extend RemediationSteps=todynamic(RemediationSteps)\r\n| extend RemediationSteps.kind\r\n| project Recommendation=iff(isempty(RemediationSteps.kind), RemediationSteps,tostring(RemediationSteps.displayValue)),\r\n Action=iff(tostring(RemediationSteps.kind) == \"Link\", tostring(RemediationSteps.value),\"\"),\r\n Resource=iff(tostring(RemediationSteps.kind) == \"openBlade\", replace(\"resourceId=\",\"\",tostring(RemediationSteps.detailBladeInputs)),\"\")\r\n",
"size": 1,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Action",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url",
"linkLabel": "Link"
}
},
{
"columnMatch": "Resource",
"formatter": 13,
"formatOptions": {
"showIcon": true
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "RemediationSteps",
"comparison": "isNotEqualTo"
},
"name": "query - 15"
}
]
},
"conditionalVisibility": {
"parameterName": "mainTab",
"comparison": "isEqualTo",
"value": "TSG"
},
"name": "group - 6"
}
],
"fallbackResourceIds": [],
"fromTemplateId": "sentinel-AzureSQLSecurityWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}