{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Check Point Exposure Management - Alert Overview & Sync Health\n\nThis workbook provides visibility into Check Point Exposure Management alerts ingested via the CCP data connector and Importer playbook. Use it to monitor alert volume, status distribution, and ingestion health." }, "name": "header" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a2b3c4d5-e6f7-4a8b-9c0d-1e2f3a4b5c6d", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "tab-overview", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "tab-sync-health", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Sync Health", "subTarget": "SyncHealth", "style": "link" }, { "id": "tab-alert-details", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Alert Details", "subTarget": "AlertDetails", "style": "link" } ] }, "name": "tabs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize\n TotalAlerts = dcount(ref_id),\n OpenAlerts = dcountif(ref_id, status == \"open\"),\n ClosedAlerts = dcountif(ref_id, status == \"closed\"),\n LatestAlert = max(TimeGenerated)\n| project\n ['Total Alerts'] = TotalAlerts,\n ['Open'] = OpenAlerts,\n ['Closed'] = ClosedAlerts,\n ['Latest Ingestion'] = LatestAlert", "size": 4, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "Total Alerts", "formatter": 12, "formatOptions": { "palette": "auto" } } } }, "name": "summary-tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, status) by ref_id\n| summarize Count = count() by status\n| order by Count desc", "size": 2, "title": "Alert Status Distribution", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "status-distribution" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, severity) by ref_id\n| summarize Count = count() by severity\n| order by Count desc", "size": 2, "title": "Alert Severity Distribution", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "severity-distribution" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize AlertCount = dcount(ref_id) by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc", "size": 0, "title": "Alert Ingestion Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "AlertCount", "label": "Distinct Alerts" } ] } }, "name": "ingestion-timeline" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, category) by ref_id\n| summarize Count = count() by category\n| order by Count desc\n| take 10", "size": 2, "title": "Top Alert Categories", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "top-categories" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "overview-group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize RecordCount = count() by bin(TimeGenerated, 10m)\n| order by TimeGenerated asc", "size": 0, "title": "Ingestion Volume (records per 10-min window)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "RecordCount", "label": "Records Ingested" } ] } }, "name": "ingestion-volume" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated > ago(24h)\n| summarize RecordCount = count() by bin(TimeGenerated, 10m)\n| order by TimeGenerated asc\n| extend PreviousTime = prev(TimeGenerated)\n| where isnotnull(PreviousTime)\n| extend GapMinutes = datetime_diff('minute', TimeGenerated, PreviousTime)\n| where GapMinutes > 15\n| project GapStart = PreviousTime, GapEnd = TimeGenerated, GapMinutes\n| order by GapMinutes desc", "size": 0, "title": "Ingestion Gaps (>15 minutes, last 24h)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "GapMinutes", "formatter": 8, "formatOptions": { "palette": "redGreen" } } ] } }, "name": "ingestion-gaps" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(modification_date)\n| extend IngestionDelay = datetime_diff('minute', TimeGenerated, modification_date)\n| where IngestionDelay >= 0\n| summarize\n AvgDelayMinutes = avg(IngestionDelay),\n P50DelayMinutes = percentile(IngestionDelay, 50),\n P95DelayMinutes = percentile(IngestionDelay, 95),\n MaxDelayMinutes = max(IngestionDelay)\n| project\n ['Avg Delay (min)'] = round(AvgDelayMinutes, 1),\n ['P50 Delay (min)'] = round(P50DelayMinutes, 1),\n ['P95 Delay (min)'] = round(P95DelayMinutes, 1),\n ['Max Delay (min)'] = round(MaxDelayMinutes, 1)", "size": 4, "title": "Ingestion Latency (modification_date → TimeGenerated)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": true } }, "name": "ingestion-latency" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize\n NewAlerts = countif(created_date >= ago(1d)),\n ModifiedAlerts = countif(modification_date >= ago(1d) and modification_date != created_date),\n TotalRecords = count()\n by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc", "size": 0, "title": "New vs Modified Alert Records Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "new-vs-modified" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "SyncHealth" }, "name": "sync-health-group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ref_id\n| project\n TimeGenerated,\n ref_id,\n event_title,\n status,\n severity,\n category,\n source,\n confidence,\n created_date,\n modification_date,\n threat_actor\n| order by TimeGenerated desc\n| take 100", "size": 0, "title": "Latest Alerts (deduplicated by ref_id)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "very_high", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "high", "representation": "red", "text": "{0}" }, { "operator": "==", "thresholdValue": "medium", "representation": "orange", "text": "{0}" }, { "operator": "==", "thresholdValue": "low", "representation": "green", "text": "{0}" }, { "operator": "Default", "representation": "gray", "text": "{0}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "open", "representation": "blue", "text": "{0}" }, { "operator": "==", "thresholdValue": "closed", "representation": "gray", "text": "{0}" }, { "operator": "Default", "representation": "yellow", "text": "{0}" } ] } } ] } }, "name": "alerts-table" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ref_id\n| where status == \"closed\" and isnotempty(closure_reason)\n| summarize Count = count() by tostring(closure_reason)\n| order by Count desc", "size": 2, "title": "Closure Reason Breakdown", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "closure-reasons" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "argsentdc_CL\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ref_id\n| where isnotempty(threat_actor)\n| summarize AlertCount = dcount(ref_id) by threat_actor\n| order by AlertCount desc\n| take 10", "size": 2, "title": "Top Threat Actors", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "threat-actors" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "AlertDetails" }, "name": "alert-details-group" } ], "fallbackResourceIds": [], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }