{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43936bfc-5e25-43c1-802e-b51f4ed995a9", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Parameters" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Firewall", "subTarget": "Firewall", "style": "link" }, { "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "DNS", "subTarget": "DNS", "style": "link" }, { "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "DHCP", "subTarget": "DHCP", "style": "link" } ] }, "name": "links - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\";\ndata\n| summarize Count = count() by DeviceAction\n| join kind = inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceAction)\n on DeviceAction\n | project-away TimeGenerated\n| extend Actions = DeviceAction\n| union (\n data \n | summarize Count = count() \n | extend jkey = 1\n | join kind=inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1) on jkey\n | extend DeviceAction = 'All', Actions = '*'\n)\n| extend Order = iif(DeviceAction == \"All\", 0, iff(DeviceAction == \"Allow\", 1, 2))\n| order by Order asc\n", "size": 4, "title": "Event Counts", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "DeviceAction", "exportParameterName": "FWActionPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "DeviceAction", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "name": "Event Counts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| where DeviceAction == '{FWActionPicker}' or '{FWActionPicker}' == \"All\";\ndata\n| summarize Count = count() by DeviceAction, bin(TimeGenerated, 5m)\n", "size": 0, "showAnalytics": true, "title": "Event Counts over Time", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeBrush", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "name": "Event Counts over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceInboundInterface == \"eth2\" and DeviceAction == \"Drop\" \n| summarize count() by SourceIP, sourceGeoCountryName = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoCountryName)\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceIP\n | project-away TimeGenerated\n) on SourceIP\n| project SourceIP, Country = sourceGeoCountryName, Count = count_, Trend\n| sort by Count desc\n| take 10\n\n\n", "size": 0, "showAnalytics": true, "title": "Top 10 blocked by Source IP (Inbound)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "exportFieldName": "SourceIP", "exportParameterName": "FWSourceIPBlockedPicker", "exportDefaultValue": "All", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "Top 10 blocked by Source IP (Inbound)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n)\n| where SourceIP == '{FWSourceIPBlockedPicker}' or '{FWSourceIPBlockedPicker}' == \"All\";\ndata\n| where DeviceAction == \"Drop\" \n| extend Direction = iff(DeviceInboundInterface == \"eth2\", \"Inbound\", \"Outbound\")\n| summarize count() by DestinationPort, Direction\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by DestinationPort\n | project-away TimeGenerated\n) on DestinationPort\n| project DestinationPort , Direction, Count = count_, Trend\n| sort by Count desc\n| take 10\n", "size": 0, "title": "Top 10 Blocked Ports", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "Top 10 Blocked Ports" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceInboundInterface == \"eth2\" and DeviceAction == \"Allow\" \n| summarize count() by SourceIP, sourceGeoCountryName = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoCountryName)\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceIP\n | project-away TimeGenerated\n) on SourceIP\n| project SourceIP, Country = sourceGeoCountryName, Count = count_, Trend\n| sort by Count desc\n| take 10\n\n\n", "size": 0, "title": "Top 10 allowed by Source IP (Inbound)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "exportFieldName": "SourceIP", "exportParameterName": "FWSourceIPAllowedPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "Top 10 allowed by Source IP (Inbound)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| where SourceIP == '{FWSourceIPAllowedPicker}' or '{FWSourceIPAllowedPicker}' == \"All\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceAction == \"Allow\" \n| extend Direction = iff(DeviceInboundInterface == \"eth2\", \"Inbound\", \"Outbound\")\n| summarize count() by DestinationPort, Direction\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by DestinationPort\n | project-away TimeGenerated\n) on DestinationPort\n| project DestinationPort, Direction, Count = count_, Trend\n| sort by Count desc\n| take 10\n\n\n", "size": 0, "title": "Top 10 Allowed Ports", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "Top 10 Allowed Ports" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceInboundInterface == \"eth2\"\n| extend SourceGeoLongitude = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoLongitude),\n SourceGeoLatitude = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoLatitude),\n SourceGeoCountryName = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoCountryName)\n", "size": 0, "showAnalytics": true, "title": "Map of Inbound Sources", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "SourceGeoLatitude", "longitude": "SourceGeoLongitude", "sizeSettings": "SourceGeoCountryName", "sizeAggregation": "Count", "labelSettings": "SourceGeoCountryName", "legendMetric": "SourceGeoCountryName", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "SourceGeoCountryName", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "showPin": true, "name": "InboundSourceLocations", "styleSettings": { "maxWidth": "50%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceInboundInterface == \"eth2\"\n| extend SourceGeoCountryName = tostring(parse_json(AdditionalExtensionsParsed).sourceGeoCountryName)\n| summarize count() by SourceIP, SourceGeoCountryName, DeviceAction\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceIP\n | project-away TimeGenerated\n) on SourceIP\n| project SourceIP, Country = SourceGeoCountryName, Action = DeviceAction, Count = count_, Trend\n| sort by Count desc\n", "size": 0, "title": "Top IP by Geo", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "IP", "formatter": 1 }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "Country" ], "expandTopLevel": true } }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "Top IP by Geo" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"Firewall\";\ndata\n//| where DeviceEventClassID == \"IPS\"\n| where DeviceAction == \"BLOCK\"\n| extend Direction = iff(DeviceInboundInterface == \"eth2\", \"Inbound\", \"OutBound\")\n| summarize Count = count() by SourceIP, Direction, DestinationIP\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceIP\n | project-away TimeGenerated\n) on SourceIP\n| project SourceIP, DestinationIP, Count, Trend\n| sort by Count desc\n", "size": 0, "title": "IPS Events", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "hotCold" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "SourceIP" ] } } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Firewall" }, "customWidth": "50", "name": "IPS Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\";\ndata\n| summarize Count = count() by DeviceAction\n| join kind = inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceAction)\n on DeviceAction\n | project-away TimeGenerated\n| extend Actions = DeviceAction\n| union (\n data \n | summarize Count = count() \n | extend jkey = 1\n | join kind=inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1) on jkey\n | extend DeviceAction = 'All', Actions = '*'\n)\n| extend Order = iif(DeviceAction == \"All\", 0, iff(DeviceAction == \"Allow\", 1, 2))\n| order by Order asc\n", "size": 4, "title": "Action Counts", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "DeviceAction", "exportParameterName": "DNSActionPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "DeviceAction", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "DNS Action Counts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n);\ndata\n| where DeviceAction == \"query\"\n| extend QueryType = tostring(parse_json(AdditionalExtensionsParsed).querytype)\n| summarize Count = count() by Type = QueryType\n\n", "size": 4, "title": "Query Types", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "QueryType", "exportParameterName": "DNSQueryPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "action_s", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "DNS - Query Types" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\"\n| extend AdditionalExtensions = extract_all(@\"(?P\\w+)=(?P[a-zA-Z0-9-_:/@. ]+)\", dynamic([\"key\",\"value\"]), AdditionalExtensions)\n| mv-apply AdditionalExtensions on (\n summarize AdditionalExtensionsParsed = make_bag(pack(tostring(AdditionalExtensions[0]), AdditionalExtensions[1]))\n)\n| extend QueryType = tostring(parse_json(AdditionalExtensionsParsed).querytype)\n| where DeviceAction == '{DNSActionPicker}' or '{DNSActionPicker}' == \"All\";\ndata\n| summarize Count = count() by Action = DeviceAction, bin(TimeGenerated, 1m)", "size": 0, "title": "DNS Requests Over Time", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "DNS Requests Over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\"\n| where DeviceAction == '{DNSActionPicker}' or '{DNSActionPicker}' == \"All\";\ndata\n| where isnotempty(DestinationDnsDomain)\n| summarize Count = count() by DestinationDnsDomain\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by DestinationDnsDomain\n | project-away TimeGenerated\n) on DestinationDnsDomain\n| project Domain = DestinationDnsDomain, Count, Trend\n| order by Count\n", "size": 0, "title": "Top Domain Names", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "DomainName", "exportParameterName": "DNSDomainNamePicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "Top Domain Names", "styleSettings": { "maxWidth": "50%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\"\n| where DeviceAction == '{DNSActionPicker}' or '{DNSActionPicker}' == \"All\"\n| where DestinationDnsDomain == '{DNSDomainNamePicker}' or '{DNSDomainNamePicker}' == \"All\";\ndata\n| where isnotempty(DestinationDnsDomain)\n| summarize Count = count() by SourceIP\n| join kind=inner (\n data\n | make-series Trend=count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceIP\n | project-away TimeGenerated\n) on SourceIP\n| project SourceIP, Count, Trend\n| order by Count", "size": 0, "title": "Top Clients", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "SourceIP", "exportParameterName": "DNSSourceIPPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "Top Clients", "styleSettings": { "maxWidth": "50%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DNS\"\n| where DeviceAction == '{DNSActionPicker}' or '{DNSActionPicker}' == \"All\"\n| where DestinationDnsDomain == '{DNSDomainNamePicker}' or '{DNSDomainNamePicker}' == \"All\";\ndata\n| extend NameParts = split(DestinationDnsDomain, '.')\n| extend Top_Level_Domain = strcat(NameParts[toint(array_length(NameParts)-2)],'.',NameParts[toint(array_length(NameParts)-1)])\n| summarize SubDomainCount = count() by Top_Level_Domain, DestinationDnsDomain\n| join kind= inner (\n data\n | extend NameParts = split(DestinationDnsDomain, '.')\n | extend Top_Level_Domain = strcat(NameParts[toint(array_length(NameParts)-2)],'.',NameParts[toint(array_length(NameParts)-1)])\n | extend Top_Level_Domain = iif(strlen(Top_Level_Domain)<7, strcat(NameParts[toint(array_length(NameParts)-3)],'.',Top_Level_Domain),Top_Level_Domain)\n | summarize Total_Sub_Domains = count() by Top_Level_Domain\n) on Top_Level_Domain\n| extend pk = SubDomainCount/todouble(Total_Sub_Domains)\n| extend h1= -log2(pk)*pk\n| summarize Sub_Domain_Entropy = sum(h1), Total_Sub_Domains = any(Total_Sub_Domains) , Domain_List = make_list(DestinationDnsDomain) by Top_Level_Domain\n| order by Sub_Domain_Entropy desc\n\n", "size": 0, "title": "Domain Entropy", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Sub_Domain_Entropy", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Total_Sub_Domains", "formatter": 4, "formatOptions": { "palette": "blue" } } ] } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DNS" }, "name": "Domain Entropy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DHCP\";\ndata\n| summarize Count = count() by DeviceAction\n| join kind = inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceAction)\n on DeviceAction\n | project-away TimeGenerated\n| extend Actions = DeviceAction\n| union (\n data \n | summarize Count = count() \n | extend jkey = 1\n | join kind=inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1) on jkey\n | extend DeviceAction = 'All', Actions = '*'\n)\n| extend Order = iif(DeviceAction == \"All\", 0, iff(DeviceAction == \"Allow\", 1, 2))\n| order by Order asc\n", "size": 4, "title": "DHCP Actions", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "DeviceAction", "exportParameterName": "DHCPActionPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "DeviceAction", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "name": "DHCPActions" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DHCP\"\n| where DeviceAction == '{DHCPActionPicker}' or '{DHCPActionPicker}' == \"All\";\ndata\n| summarize Count = count() by DeviceAction, bin(TimeGenerated, 5m)\n", "size": 0, "title": "DHCP Actions over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "DHCPActionsOverTime" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DHCP\"\n| where DeviceAction == '{DHCPActionPicker}' or '{DHCPActionPicker}' == \"All\";\ndata\n| where DeviceAction == \"DHCPREQUEST\" or DeviceAction == \"DHCPINFORM\" or DeviceAction == \"DHCPDISCOVER\"\n| summarize Count = count() by DeviceAction, bin(TimeGenerated, 5m)\n", "size": 0, "title": "DHCP Requests by Type", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart" }, "name": "DHCPRequestsByType" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = CommonSecurityLog\n| where DeviceVendor == \"Unifi\" and DeviceEventClassID == \"DHCP\"\n| where DeviceAction == '{DHCPActionPicker}' or '{DHCPActionPicker}' == \"All\";\ndata\n| where DeviceAction == \"DHCPPACK\" or DeviceAction == \"DHCPOFFER\"\n| summarize Count = count() by DeviceAction, bin(TimeGenerated, 5m)\n", "size": 0, "title": "DHCP Responses by Type", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart" }, "name": "DHCPResponsesbyType" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DHCP" }, "name": "DHCP" } ], "styleSettings": {}, "fromTemplateId": "sentinel-UnifSG", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }