{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bb18f0f1-0893-479d-83fe-9cca36e33b43", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "value": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d559890f-2663-49a6-af45-3dfc1fa7fda0", "cellValue": "isRest", "linkTarget": "parameter", "linkLabel": "Syslog", "subTarget": "0", "preText": "d", "postText": "d", "style": "secondary" }, { "id": "aee69a87-0e6f-4aab-ab21-14423e4d2d3d", "cellValue": "isRest", "linkTarget": "parameter", "linkLabel": "REST", "subTarget": "1", "style": "link" } ] }, "name": "links - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3ec1d354-0588-43dd-b3e5-7ebab2195c40", "version": "KqlParameterItem/1.0", "name": "host_token", "label": "Veeam Backup & Replication Data Sources", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Veeam_GetSecurityEvents\r\n| summarize by original_host", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "26fbaaa0-3b0f-4506-885b-9fd8cd87ece9", "version": "KqlParameterItem/1.0", "name": "vone_host_token", "label": "Veeam ONE Data Sources", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Veeam_GetVeeamONEAlarms\r\n| summarize by VoneHostName", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "parameters - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3b155c6e-4243-4c04-8675-3901414969df", "version": "KqlParameterItem/1.0", "name": "vbr_host_name", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "union \r\n (VeeamMalwareEvents_CL | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\r\n (VeeamAuthorizationEvents_CL | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\r\n (VeeamSecurityComplianceAnalyzer_CL\r\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end})\r\n \r\n | summarize by VbrHostName\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Veeam Backup & Replication Data Sources" }, { "id": "f3074530-90f9-44b3-96a4-6141a273e18b", "version": "KqlParameterItem/1.0", "name": "vone_host_name", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VeeamOneTriggeredAlarms_CL \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\n| summarize by VoneHostName", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Veeam ONE Data Sources" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "1" }, "name": "parameters - rest" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Custom Tables Events Overview" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\n| summarize Count = count() by Status\n| top 20 by Count\n| project Status, Count\n| render piechart", "size": 3, "title": "Veeam ONE Triggered Alarms by Status", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "VoneTriggeredAlarmsStatusRestAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Warning", "color": "orange" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Resolved", "color": "blue" }, { "seriesName": "Error", "color": "redBright" } ] } }, "customWidth": "25", "name": "query - vone-alarms-status" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name})\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\n| summarize Count = count() by Severity\n| top 20 by Count\n| project Severity, Count\n| render piechart", "size": 3, "title": "Malware Events by Severity", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "MalwareEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Infected", "color": "redBright" }, { "seriesName": "Clean", "color": "green" } ] } }, "customWidth": "25", "name": "query - malware-severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\n| summarize Count = count() by State\n| top 20 by Count\n| project State, Count\n| render piechart", "size": 3, "title": "Authorization Events by State", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "AuthorizationEventsStateAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "ProcessedTime", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "ProcessedTime", "sortOrder": 2 } ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Approved", "color": "green" }, { "seriesName": "Info", "color": "blue" }, { "seriesName": "Rejected", "color": "redBright" } ] } }, "customWidth": "25", "name": "query - authorization-state" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamSecurityComplianceAnalyzer_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name})\n| summarize Count = count() by Status\n| top 20 by Count\n| project Status, Count\n| render piechart", "size": 3, "title": "Security & Compliance Analyzer Results by Status", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "BestPracticesAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Violation", "color": "redBright" }, { "seriesName": "OK", "color": "green" }, { "seriesName": "UnableToCheck", "color": "orange" } ] } }, "customWidth": "25", "name": "query - best-practices-status" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VoneTriggeredAlarmsStatusRestAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeamOneTriggeredAlarms_CL\r\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \r\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\r\n| join kind=inner (filters) on $left.Status == $right.Series\r\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode", "size": 0, "title": "Veeam ONE Triggered Alarms by Status Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "VoneTriggeredAlarmsStatusRestAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "MalwareEventsAllFields", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesAllFields", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsStateAllFields", "comparison": "isEqualTo" } ], "name": "VeeamONETriggeredAlarmsDrilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{AuthorizationEventsStateAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeamAuthorizationEvents_CL\r\n| where \"'All'\" == \"{vbr_host_name}\" or VbrHostName in ({vbr_host_name}) \r\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\r\n| where State in (toscalar(filters | summarize make_set(Series)))\r\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State", "size": 0, "title": "Authorization Events by State Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "VoneTriggeredAlarmsStatusRestAllFields", "comparison": "isEqualTo" }, { "parameterName": "MalwareEventsAllFields", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsStateAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "BestPracticesAllFields", "comparison": "isEqualTo" } ], "name": "Authorization Events Drilldown " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{MalwareEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeamMalwareEvents_CL\r\n| where \"'All'\" == \"{vbr_host_name}\" or VbrHostName in ({vbr_host_name}) \r\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\r\n| where Severity in (toscalar(filters | summarize make_set(Series)))\r\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine", "size": 0, "title": "Malware Events by Severity Drilldown", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "MalwareEventsAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "VoneTriggeredAlarmsStatusRestAllFields", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesAllFields", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsStateAllFields", "comparison": "isEqualTo" } ], "name": "MalwareEventsDrilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BestPracticesAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\n\r\nVeeamSecurityComplianceAnalyzer_CL\r\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name})\r\n| join kind=inner (filters) on $left.Status == $right.Series\r\n| project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note", "size": 0, "title": "Security & Compliance Analyzer Results by Status Drilldown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "MalwareEventsAllFields", "comparison": "isEqualTo" }, { "parameterName": "VoneTriggeredAlarmsStatusRestAllFields", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsStateAllFields", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesAllFields", "comparison": "isNotEqualTo" } ], "name": "BestPracticesAnalysisDrilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\n| summarize Count = count() by Name\n| top 20 by Count\n| project Name, Count\n| render piechart", "size": 3, "title": "Veeam ONE Triggered Alarms by Name", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VoneTriggeredAlarmsName" }, { "parameterName": "VoneTriggeredAlarmsNamesRestAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Warning", "color": "orange" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Success", "color": "yellow" } ] } }, "customWidth": "33", "name": "query - vone-alarms-name" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VoneTriggeredAlarmsNamesRestAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\r\n| where Name in (toscalar(filters | summarize make_set(Series)))\r\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode", "size": 0, "title": "Veeam ONE Triggered Alarms by Name Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibility": { "parameterName": "VoneTriggeredAlarmsName", "comparison": "isNotEqualTo" }, "name": "VeeamONETriggeredAlarmsDrilldown - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\n| where Severity == \"Infected\"\n| count", "size": 2, "title": "Infected Files Detected", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "statSettings": { "showBorder": false, "colorSettings": { "colorizeBody": true, "thresholds": [ { "criteria": "isGreaterThan", "value": "0", "color": "red" } ] } } }, "customWidth": "33", "name": "infected-files-stat", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union \n (VeeamOneTriggeredAlarms_CL | where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}),\n (VeeamMalwareEvents_CL | where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\n (VeeamAuthorizationEvents_CL | where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\n (VeeamSecurityComplianceAnalyzer_CL | where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}),\n (VeeamCovewareFindings_CL | where EventTime >= {TimeRange:start} and EventTime <= {TimeRange:end})\n| summarize Count = count() by Type\n| project [\"Event Type\"] = Type, Count\n| render piechart", "size": 3, "title": "All Custom Table Events by Type", "exportFieldName": "Event Type", "exportParameterName": "CustomTableEventType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - custom-tables-distribution" }, { "type": 1, "content": { "json": "## Daily Trends" }, "name": "text - daily-trends" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Coveware Findings" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| where EventTime >= {TimeRange:start}\r\n| where EventTime <= {TimeRange:end}\r\n| summarize Count = count() by EventType\r\n| top 20 by Count\r\n| project EventType, Count\r\n| render piechart", "size": 3, "title": "Coveware Findings by Name", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "", "parameterName": "CovewareFindingsNameAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "group": "EventType", "createOtherGroup": 0, "showMetrics": true, "showLegend": false } }, "customWidth": "30", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| where EventTime >= {TimeRange:start}\r\n| where EventTime <= {TimeRange:end}\r\n| summarize Count = count() by DateOnly = startofday(EventTime), RiskLevel\r\n| order by DateOnly asc\r\n| render timechart", "size": 0, "title": "Daily Coveware Findings by Risk Level", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "CovewareRiskLevelAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "medium", "color": "orange" }, { "seriesName": "low", "color": "blue" }, { "seriesName": "high", "color": "redBright" }, { "seriesName": "critical", "color": "purple" } ] } }, "customWidth": "70", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Step 1: Parse the Sentinel widget export into a filter table\r\nlet filters =\r\n print arr = parse_json(\r\n replace(\r\n @\"\\\"\"(\\{.*?\\})\\\"\"\", \r\n @\"\\1\", \r\n strcat('[', '{CovewareFindingsNameAllFields}', ']')\r\n )\r\n )\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\n// Step 2: Filter main table by matching series\r\nVeeamCovewareFindings_CL\r\n| where EventTime >= {TimeRange:start}\r\n| where EventTime <= {TimeRange:end}\r\n| where EventType in (toscalar(filters | summarize make_set(Series)))\r\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash", "size": 0, "title": "Coveware Findings by Name Drilldown", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "CovewareFindingsNameAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "CovewareRiskLevelAllFields", "comparison": "isEqualTo" } ], "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Step 1: Parse the Sentinel widget export into a filter table\r\nlet filters =\r\n print arr = parse_json(\r\n replace(\r\n @\"\\\"\"(\\{.*?\\})\\\"\"\", \r\n @\"\\1\", \r\n strcat('[', '{CovewareRiskLevelAllFields}', ']')\r\n )\r\n )\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeamCovewareFindings_CL\r\n| where EventTime >= {TimeRange:start}\r\n| where EventTime <= {TimeRange:end}\r\n | extend DateOnly = startofday(EventTime)\r\n| join kind=inner (filters) on DateOnly, $left.RiskLevel == $right.Series\r\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash", "size": 0, "title": "Coveware Findings by Risk Level Drilldown", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "EventTime", "formatter": 6 }, { "columnMatch": "EventActivity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "92.8571ch" } } ] } }, "conditionalVisibilities": [ { "parameterName": "CovewareFindingsNameAllFields", "comparison": "isEqualTo" }, { "parameterName": "CovewareRiskLevelAllFields", "comparison": "isNotEqualTo" } ], "name": "query - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| where EventTime >= {TimeRange:start}\r\n| where EventTime <= {TimeRange:end}\r\n | order by EventTime desc | project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash", "size": 0, "title": "Coveware Findings Details", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 2" } ] }, "name": "group - 17", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\n| summarize Count = count() by bin(TriggeredTime, 1d), Status\n| order by TriggeredTime asc\n| render timechart", "size": 0, "title": "Daily Veeam ONE Triggered Alarms", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "", "parameterName": "DailyVeeamONETriggeredAlarmsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Warning", "color": "orange" }, { "seriesName": "Error", "color": "redBright" } ] } }, "customWidth": "50", "name": "daily-vone-alarms" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\n| summarize Count = count() by bin(DetectionTimeUtc, 1d), Severity\n| order by DetectionTimeUtc asc\n| render timechart", "size": 0, "title": "Daily Malware Events", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "", "parameterName": "DailyMalwareEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Infected", "color": "redBright" }, { "seriesName": "Clean", "color": "green" } ] } }, "customWidth": "50", "name": "daily-malware-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{DailyVeeamONETriggeredAlarmsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\r\n| extend DateOnly = startofday(TriggeredTime)\r\n| join kind=inner (filters) on DateOnly, $left.Status == $right.Series\r\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode", "size": 0, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "Comment", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Comment", "sortOrder": 1 } ] }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamONETriggeredAlarmsAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "DailyMalwareEventsAllFields", "comparison": "isEqualTo" } ], "name": "query - 23" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{DailyMalwareEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeamMalwareEvents_CL\r\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\r\n| extend DateOnly = startofday(DetectionTimeUtc)\r\n| join kind=inner (filters) on DateOnly, $left.Severity == $right.Series\r\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine", "size": 0, "title": "Daily Malware Events Drilldown", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamONETriggeredAlarmsAllFields", "comparison": "isEqualTo" }, { "parameterName": "DailyMalwareEventsAllFields", "comparison": "isNotEqualTo" } ], "name": "query - 23 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\n| summarize Count = count() by bin(ProcessedTime, 1d), State\n| order by ProcessedTime asc\n| render timechart", "size": 0, "title": "Daily Four-Eyes Authorization Events", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "", "parameterName": "DailyFourEyesAuthorizationEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Approved", "color": "green" }, { "seriesName": "Info", "color": "blue" }, { "seriesName": "Rejected", "color": "redBright" } ] } }, "customWidth": "100", "name": "daily-authorization-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{DailyFourEyesAuthorizationEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\nVeeamAuthorizationEvents_CL\r\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\r\n| extend DateOnly = startofday(ProcessedTime)\r\n| join kind=inner (filters) on DateOnly, $left.State == $right.Series\r\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\r\n", "size": 0, "title": "Daily Four-Eyes Authorization Events Drilldown", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "DailyFourEyesAuthorizationEventsAllFields", "comparison": "isNotEqualTo" }, "name": "query - 23 - Copy - Copy" }, { "type": 1, "content": { "json": "## Latest Events" }, "name": "text - latest-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| where \"'All'\" == \"{vone_host_name}\" or VoneHostName in ({vone_host_name}) \n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\n | order by TriggeredTime desc | project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\n| top 15 by TriggeredTime desc", "size": 0, "title": "Latest Veeam ONE Triggered Alarms", "exportFieldName": "Alarm Name", "exportParameterName": "SelectedVoneAlarm", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-vone-alarms" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\n | order by DetectionTimeUtc desc | project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\n| top 15 by DetectionTime desc", "size": 0, "title": "Latest Malware Events", "exportFieldName": "Machine", "exportParameterName": "SelectedMalwareMachine", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-malware-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\n | order by ProcessedTime desc | project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\n", "size": 0, "title": "Latest Authorization Events", "exportFieldName": "Event Name", "exportParameterName": "SelectedAuthEvent", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-authorization-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamSecurityComplianceAnalyzer_CL\n| where \"{vbr_host_name}\" == \"'All'\" or VbrHostName in ({vbr_host_name}) \n | order by TimeGenerated desc | project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\n| top 15 by TimeGenerated desc", "size": 0, "title": "Latest Security & Compliance Analysis", "exportFieldName": "Best Practice", "timeContextFromParameter": "TimeRange", "exportParameterName": "SelectedBestPractice", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-best-practices" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "1" }, "name": "REST Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Overview" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\n| summarize Count = count() by [\"SeverityDescription\"]\n| top 20 by Count\n| project [\"SeverityDescription\"], Count\n| render piechart \n", "size": 3, "title": "Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "VeeamONEAlarmsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\" or SyslogMessage has \"predefined_alarm_id\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\r\n| extend eventId = strcat(\r\n tostring(extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage)), \r\n tostring(extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage))\r\n)\r\n| where eventId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\",\"23630\",\"23631\",\"23632\",\"23633\",\"24020\",\"24114\",\"24131\",\"24140\",\"24142\",\"24143\",\"24160\",\"24170\",\"25000\",\"25210\",\"25220\",\"25400\",\"25700\",\"25800\",\"26000\",\"26600\",\"26700\",\"26800\",\"26900\",\"27200\",\"27300\",\"27500\",\"27600\",\"27900\",\"28400\",\"28800\",\"28850\",\"28940\",\"29110\",\"29140\",\"30700\",\"30800\",\"31000\",\"32100\",\"32400\",\"32800\",\"40202\",\"41200\",\"41401\",\"42280\",\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\",\"378\")\r\n| extend host = Computer\r\n| count", "size": 0, "title": "All Security Activities", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "All Security Activities", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by SeverityDescription\n| top 20 by Count\n| render piechart\n", "size": 3, "title": "Veeam Backup & Replication Security Events", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 3", "styleSettings": { "maxWidth": "50%" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VeeamONEAlarmsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Veeam ONE Alarms Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsAllFields", "comparison": "isEqualTo" }, { "parameterName": "VeeamONEAlarmsAllFields", "comparison": "isNotEqualTo" } ], "name": "Veeam ONE Alarms by Severity Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage", "size": 0, "title": "Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "VeeamONEAlarmsAllFields", "comparison": "isEqualTo" } ], "name": "Veeam Backup & Replication Security Events Drilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| summarize Count = count() by [\"Event Name\"]\r\n| project [\"Event Name\"], Count\r\n| render piechart ", "size": 3, "title": "Veeam ONE Alarms by Name", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "VeeamONEAlarmsNameAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by [\"Event Name\"]\r\n| top 20 by Count\r\n| render piechart\r\n", "size": 3, "title": "Veeam Backup & Replication Security Events by Name", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsNameAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "50", "name": "query - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VeeamONEAlarmsNameAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| join kind=inner (filters) on $left.[\"Event Name\"] == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage\r\n", "size": 0, "title": "Veeam ONE Alarms Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsNameAllFields", "comparison": "isEqualTo" }, { "parameterName": "VeeamONEAlarmsNameAllFields", "comparison": "isNotEqualTo" } ], "name": "Veeam ONE Alarms by Name Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsNameAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.[\"Event Name\"] == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage", "size": 0, "title": "Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "Message Details", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Message Details", "sortOrder": 1 } ] }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsNameAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "VeeamONEAlarmsNameAllFields", "comparison": "isEqualTo" } ], "name": "Veeam Backup & Replication Security Events Drilldown - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where instanceId == \"42220\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Marked as Infected", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "MarkedAsInfectedCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Marked as Infected", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| extend original_host = Computer\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Four-Eyes Authorization Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "FourEyesAuthorizationEventsCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Four-Eyes Authorization Events", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"41600\"\r\n| extend original_host = Computer\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Marked as Suspicious", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "MarkedAsSuspiciousCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Marked as Suspicious", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Four-Eyes Authorization Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isNotEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isEqualTo" } ], "name": "Four-Eyes Authorization Events Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42220\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Marked as Infected Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isNotEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isEqualTo" } ], "name": "Marked as Infected Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"41600\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Four-Eyes Authorization Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isNotEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isEqualTo" } ], "name": "Four-Eyes Authorization Events Drilldown" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Overview", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Daily Security Activities" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription", "size": 0, "aggregation": 5, "title": "Daily Veeam Backup & Replication Security Events", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "DailyVeeamBackupReplicationSecurityEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Information", "color": "blue" }, { "seriesName": "Critical", "color": "purple" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Medium", "color": "orange" } ] } }, "customWidth": "50", "name": "Daily Veeam Backup & Replication Security Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\r\n| order by TimeGenerated asc\r\n| render timechart ", "size": 0, "aggregation": 5, "title": " Daily Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "", "parameterName": "DailyVeeamONEAlarmsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "purple" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "High", "color": "redBright" } ] } }, "customWidth": "50", "name": " Daily Veeam ONE Alarms" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{DailyVeeamBackupReplicationSecurityEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Daily Veeam Backup & Replication Security Events Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamBackupReplicationSecurityEventsAllFields", "comparison": "isNotEqualTo" }, { "parameterName": "DailyVeeamONEAlarmsAllFields", "comparison": "isEqualTo" } ], "name": "Daily Veeam Backup & Replication Security Events Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{DailyVeeamONEAlarmsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nVeeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Daily Veeam ONE Alarms Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamBackupReplicationSecurityEventsAllFields", "comparison": "isEqualTo" }, { "parameterName": "DailyVeeamONEAlarmsAllFields", "comparison": "isNotEqualTo" } ], "name": "Daily Veeam ONE Alarms Drilldown - Copy" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Daily Security Activities" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Latest Security Activities" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, SeverityDescription, SyslogMessage", "size": 0, "title": "Latest Veeam Backup & Replication Security Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VBRSyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Latest Veeam Backup & Replication Security Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"'All'\" or VoneHostName in ({vone_host_token})\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Latest Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VoneSyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "customWidth": "50", "name": "Latest Veeam ONE Alarms" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VBRSyslogMessage}\r\n```" }, "conditionalVisibilities": [ { "parameterName": "VBRSyslogMessage", "comparison": "isNotEqualTo" }, { "parameterName": "VoneSyslogMessage", "comparison": "isEqualTo" } ], "name": "text - 3" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VoneSyslogMessage}\r\n```" }, "conditionalVisibilities": [ { "parameterName": "VoneSyslogMessage", "comparison": "isNotEqualTo" }, { "parameterName": "VBRSyslogMessage", "comparison": "isEqualTo" } ], "name": "text - 4" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Latest Security Activities" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Four-Eyes Authorization Events" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let watchlist = _GetWatchlist(\"operation_names_lookup\"); \r\nSyslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"'All'\" or Computer in ({host_token})\r\n| extend OperationId = extract(\"OperationId=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| lookup kind=inner (watchlist) \r\n on $left.OperationId == $right.[\"Operation Id\"]\r\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\r\n", "size": 0, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "FourEyesAuthorizationEventsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let watchlist = _GetWatchlist(\"operation_names_lookup\"); \r\n\r\nlet filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{FourEyesAuthorizationEventsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\n// Step 2: Join main table with filters on both Date and Series\r\nSyslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"'All'\" or Computer in ({host_token})\r\n| extend OperationId = extract(\"OperationId=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| lookup kind=inner (watchlist) \r\n on $left.OperationId == $right.[\"Operation Id\"]\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.OperationName == $right.Series\r\n| project TimeGenerated, Computer, EventTime, Facility, HostName, SeverityLevel, instanceId, OperationId, LastUpdatedTime = LastUpdatedTimeUTC, SearchKey, OperationName, SyslogMessage\r\n\r\n", "size": 0, "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibility": { "parameterName": "FourEyesAuthorizationEventsAllFields", "comparison": "isNotEqualTo" }, "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Four-Eyes Authorization Events" } ], "fromTemplateId": "sentinel-VeeamSecurityActivities", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }