{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Illusive ADS Dashboard\n"
      },
      "name": "text - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "\n"
      },
      "customWidth": "65",
      "name": "text - 2 - Copy"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "e5b79f84-7773-4162-9750-702cd0001041",
            "version": "KqlParameterItem/1.0",
            "name": "NumberOfDays",
            "label": "Number of Days ",
            "type": 2,
            "description": "Select range of days to query",
            "isRequired": true,
            "value": "30",
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "jsonData": "[1,7,14,21,30]",
            "resourceType": "microsoft.insights/components"
          },
          {
            "id": "ba9324e9-07f9-49dc-81b6-f87833a09afc",
            "version": "KqlParameterItem/1.0",
            "name": "ManagementIP",
            "label": "Management IP",
            "type": 2,
            "description": "Filter managment ip",
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nwhere DeviceAddress != \"\" |\r\nsummarize count() by DeviceAddress | \r\nproject DeviceAddress\r\n",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "All"
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "35",
      "name": "parameters - 6",
      "styleSettings": {
        "margin": "0px",
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let binSize = iff({NumberOfDays} > 1, 1d, 1h);\nunion CommonSecurityLog | \nwhere (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\")|\nwhere Message !contains \"hasForensics\" |\nwhere TimeGenerated > ago({NumberOfDays}d) | \nwhere \"{ManagementIP}\" contains \"All\" or \"{ManagementIP}\" contains DeviceAddress |\nextend DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2) |\nsummarize by bin(TimeGenerated,binSize) ,DeviceCustomNumber2 |\nmake-series event_count=count() default=0 on TimeGenerated in range (ago({NumberOfDays}d), now(), binSize) |\nmvexpand TimeGenerated, event_count |\nproject todatetime(TimeGenerated), toint(event_count)",
        "size": 0,
        "aggregation": 3,
        "title": "Incidents over time",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "event_count",
              "color": "red"
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "Incidents over time",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let binSize = iff({NumberOfDays} > 1, 1d, 1h);\nunion CommonSecurityLog | \nwhere (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\")|\nwhere Message !contains \"hasForensics\" |\nwhere TimeGenerated > ago({NumberOfDays}d) | \nwhere \"{ManagementIP}\" contains \"All\" or \"{ManagementIP}\" contains DeviceAddress |\nsummarize by bin(TimeGenerated,binSize) ,ExternalID |\nmake-series event_count=count() default=0 on TimeGenerated in range (ago({NumberOfDays}d), now(), binSize) |\nmvexpand TimeGenerated, event_count |\nproject todatetime(TimeGenerated), toint(event_count)",
        "size": 0,
        "aggregation": 3,
        "title": "Events over time",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "event_count",
              "color": "yellow"
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "Events over time",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let binSize = iff({NumberOfDays} > 1, 1d, 1h);\r\nunion CommonSecurityLog \r\n| extend DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\r\n | where (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\")|\r\nwhere Message !contains \"hasForensics\" |\r\nwhere TimeGenerated > ago({NumberOfDays}d) | \r\nwhere \"{ManagementIP}\" contains \"All\" or \"{ManagementIP}\" contains DeviceAddress |\r\nsummarize by DestinationServiceName ,DeviceCustomNumber2 |\r\nsummarize incident_count=count() by DestinationServiceName",
        "size": 0,
        "title": "Number of Incidents in which Trigger Type is found",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "group": "DestinationServiceName",
          "createOtherGroup": 8
        }
      },
      "customWidth": "33",
      "name": "TriggerType"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog \r\n| extend DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)|\r\nwhere (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\")|\r\nwhere Message !contains \"hasForensics\" |\r\nwhere TimeGenerated > ago({NumberOfDays}d) | \r\nwhere \"{ManagementIP}\" contains \"All\" or \"{ManagementIP}\" contains DeviceAddress |\r\nsummarize by DeviceEventClassID ,DeviceCustomNumber2 |\r\nsummarize incident_count=count() by DeviceEventClassID",
        "size": 0,
        "title": "Number of Incidents in which Event Type is found",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "group": "DeviceEventClassID",
          "createOtherGroup": 8
        }
      },
      "customWidth": "33",
      "name": "EventType"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog|  \r\nextend DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)|\r\nwhere (DeviceEventClassID == \"illusive:login\" or DeviceEventClassID == \"illusive:access\" or DeviceEventClassID == \"illusive:suspicious\")|\r\nwhere Message !contains \"hasForensics\" |\r\nwhere TimeGenerated > ago({NumberOfDays}d) | \r\nwhere \"{ManagementIP}\" contains \"All\" or \"{ManagementIP}\" contains DeviceAddress |\r\nsummarize by AlertingHost=iff(SourceHostName != \"\" and SourceHostName != \"Failed to obtain\", SourceHostName, SourceIP)   ,DeviceCustomNumber2 |\r\nwhere AlertingHost != \"\" and AlertingHost != \"Failed to obtain\" |\r\nsummarize incident_count=count() by AlertingHost |\r\norder by incident_count |\r\nlimit 10",
        "size": 0,
        "title": "Top 10 alerting hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "chartSettings": {
          "group": "DeviceEventClassID",
          "createOtherGroup": 8
        }
      },
      "customWidth": "33",
      "name": "TopHosts"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-IllusiveADS",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}