{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "# Netskope Events\nThe Netskope Events workbook has the following components:\n### Network Events: \nProvides insight into cloud firewall and network private access events.\n### Application Events: \nProvides insights into application usage; specifically by devices, users, users and traffic patterns.\n### Security Alerts: \nProvides visibility into security incidents and violations and the ability to identify effects of a breach.\n### Web Transactions:\nProvide granular information about the web sites that users have accessed.", "style": "info" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "tabStyle": "bigger", "links": [ { "id": "5f83eaaf-12a1-40f0-aa28-49205c862664", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Network Events", "subTarget": "Network Events", "style": "link" }, { "id": "27da20b3-9380-4f04-ae43-b8e3afa7f9d1", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Application Events", "subTarget": "Application Events", "style": "link" }, { "id": "26b633c0-0eca-458c-b511-06ee39ac2bd0", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Security Alerts", "subTarget": "Security Alerts", "style": "link" }, { "id": "313991f3-5e35-42b2-a00c-deb1e88f5c2a", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Web Transactions", "subTarget": "Web Transcations", "style": "link" } ] }, "name": "links - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "af56e016-34e8-4776-8a90-79f17a31c40f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by device_s\n", "size": 2, "title": "Device Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Device Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by os_s", "size": 2, "title": "OS Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "OS Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by browser_s\n", "size": 2, "title": "Browser Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Browser Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by ccl_s", "size": 2, "title": "Cloud Confidence Level Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ccl_s", "formatter": 1 }, "leftContent": { "columnMatch": "cci_d", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "ccl_s", "formatter": 1 }, "centerContent": { "columnMatch": "cci_d", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": "Cloud Confidence Level Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by activity_s\n", "size": 2, "title": "Top Application Activities", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Application Activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by app_s\n", "size": 2, "title": "Top Applications Accessed", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time Generated" }, { "columnId": "Category", "label": "Category" }, { "columnId": "count", "label": "Count" } ] }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Applications Accessed" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count() by Category", "size": 2, "title": "Top Applications Categories", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time Generated" }, { "columnId": "Category", "label": "Category" }, { "columnId": "count", "label": "Count" } ] }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Applications Categories" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\" and ccl_s == \"poor\"\n| summarize Count = count () by bin(TimeGenerated, {TimeRange:grain}), app_s", "size": 2, "title": "Top Applications Accessed by Users with Poor CCI Over Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "67", "name": "Applications Accessed by Users with Poor CCI" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"application\"\n| summarize Count = count(access_method_s) by user_s, access_method_s\n\n", "size": 2, "title": "Top Users by Access Method", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "labelSettings": [ { "columnId": "user_s", "label": "User" } ] }, "sortBy": [], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "access_method_s", "formatter": 1 }, "leftContent": { "columnMatch": "Total", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "access_method_s", "formatter": 1 }, "centerContent": { "columnMatch": "Total", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "access_method_s", "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } } } }, "name": "Top Users by Access Method" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"page\"\n| summarize TotalBytes = sum (numbytes_d/1024/1024) by bin(TimeGenerated, {TimeRange:grain}), app_s\n| top 10 by TotalBytes ", "size": 2, "title": "Top Applications by Traffic Volume", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "TotalBytes" ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "Top Applications by Traffic Volume" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"page\"\n| summarize TotalBytes = sum (numbytes_d/1024/1024) by bin(TimeGenerated, {TimeRange:grain}), user_s\n| top 10 by TotalBytes ", "size": 2, "title": "Top Users by Traffic Volume", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "TotalBytes" ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "Top Users by Traffic Volume" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Application Events" }, "name": "Application Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "9dd14451-b5c7-48bd-adbf-a5a7d239a498", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Cloud Firewall", "subTarget": "Cloud Firewall", "style": "link" }, { "id": "8ed347bc-8e58-4f13-abf2-a76cc6c28aeb", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Network Private Access", "subTarget": "Network Private Access", "style": "link" } ] }, "name": "links - 23", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9d8ed5ac-2177-4252-8e02-a28761cc4cc9", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 7776000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| summarize numbytes_d = sum (numbytes_d/1024.0/1024.0) by app_s\n", "size": 2, "title": "Top Private Applications by Total Bytes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 2 } } } } }, "customWidth": "33", "name": "Private Applications by Total Bytes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| summarize client_bytes_d = sum (client_bytes_d/1024.0/1024.0) by app_s\n", "size": 2, "title": "Top Private Applications By Uploaded Bytes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 2 } } } } }, "customWidth": "33", "name": "Private Applications By Uploaded Bytes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| summarize server_bytes_d = sum (server_bytes_d/1024.0/1024.0) by app_s", "size": 2, "title": "Top Private Applications By Downloaded Bytes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 2 } } } } }, "customWidth": "33", "name": "Private Applications By Downloaded Bytes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| distinct policy_s, app_s\n| summarize count = count() by policy_s, app_s", "size": 2, "title": "Most Used Policies", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "query - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| project TimeGenerated, network_session_id_s, user_s\n| summarize NetworkSessions=dcount(network_session_id_s) by bin(TimeGenerated,{TimeRange:grain}), user=user_s\n| top 10 by NetworkSessions", "size": 2, "title": "Top Users By Session Count", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Users By Session Count" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| project TimeGenerated, network_session_id_s, app_s, dsthost_s\n| summarize AppSessions=dcount(network_session_id_s) by dsthost_s\n| top 10 by AppSessions", "size": 2, "title": "Top Applications By Session Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Applications By Session Count" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| summarize AppHit = count() by bin(TimeGenerated, {TimeRange:grain}), app_s\n", "size": 2, "title": "Private Applications and Policy Hits", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dsthost_s", "formatter": 1 }, "leftContent": { "columnMatch": "numbytes_d", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dsthost_s", "formatter": 1 }, "centerContent": { "columnMatch": "Recived MB", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "AppHit" ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "Private Applications and Policy Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL \n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| project TimeGenerated, user_s, app_s\n| summarize UserCount=dcount(user_s) by bin(TimeGenerated, {TimeRange:grain}), app_s", "size": 2, "title": "Daily User Count for Private Applications", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "Daily User Count for Private Applications" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and publisher_name_s != \"\" and action_s == \"allow\"\n| summarize TotalBytes = sum (numbytes_d/1024.0/1024.0) by bin(TimeGenerated, {TimeRange:grain}), app_s\n", "size": 2, "title": "Top Private Applications Traffic Volume", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dsthost_s", "formatter": 1 }, "leftContent": { "columnMatch": "numbytes_d", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dsthost_s", "formatter": 1 }, "centerContent": { "columnMatch": "Recived MB", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "TotalBytes" ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "Private Applications Traffic Volume" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL \n| where event_type_s == \"network\" and publisher_name_s != \"\"\n//| summarize any(dstport_d) by dsthost_s, ip_protocol_s\n| distinct publisher_name_s, policy_s, dsthost_s, dstport_d, ip_protocol_s\n| sort by publisher_name_s asc, dstport_d asc\n", "size": 0, "title": "Private Applications Ports", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "publisher_name_s", "label": "Publisher Name" }, { "columnId": "policy_s", "label": "Policy Name" }, { "columnId": "dsthost_s", "label": "Destination Host" }, { "columnId": "dstport_d", "label": "Destination Port" }, { "columnId": "ip_protocol_s", "label": "Protocol" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "publisher_name_s", "formatter": 1 }, "leftContent": { "columnMatch": "dstport_d", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 13" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Network Private Access" }, "name": "Network Private Access" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d2694df1-7d4f-4fcf-be0a-f239d5c4401f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "label": "Time Range" }, { "id": "949c6b79-4304-4a4d-a094-2cb0557b7d79", "version": "KqlParameterItem/1.0", "name": "SourceIP", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Netskope_Events_CL\n| where srcip_s != \"\"\n| summarize Count = count() by srcip_s\n| project Value = srcip_s, Label = strcat(srcip_s, \" count: \", Count)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ], "label": "Source IP" }, { "id": "2a39eab8-b0ae-4dd3-9e20-d84f0de5e749", "version": "KqlParameterItem/1.0", "name": "SourcePort", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Netskope_Events_CL\n| where srcip_s != \"\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\")\n| where srcport_d != \"\" \n| summarize Count = count() by srcport_d\n| project Value = srcport_d, Label = strcat(\"Port: \",srcport_d, \" count: \", Count)\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ], "label": "Source Port" }, { "id": "05f8797b-984a-458d-9348-aad0a7aed886", "version": "KqlParameterItem/1.0", "name": "DestinationIP", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Netskope_Events_CL\n| where dstip_s != \"\"\n| summarize Count = count() by dstip_s\n| project Value = dstip_s, Label = strcat(dstip_s, \" count: \", Count)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ], "label": "Destination IP" }, { "id": "a50afb6e-78e6-45f1-9bdc-402ac458ef0a", "version": "KqlParameterItem/1.0", "name": "DestinationPort", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Netskope_Events_CL\n| where dstip_s != \"\"\n| where (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\")\n| where dstport_d != \"\" \n| summarize Count = count() by dstport_d\n| project Value = dstport_d, Label = strcat(\"Port: \",dstport_d, \" count: \", Count)\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ], "label": "Destination Port" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| summarize Count = count() by ip_protocol_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top Blocked Protocols", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Blocked Protocols" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where access_method_s != \"null\"\n| summarize Count = count() by access_method_s\n| order by Count\n| take 10", "size": 2, "title": "Top Blocked By Access Method", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "selAccessMethod", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Blocked By Access Method" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| summarize Count = count() by dst_country_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top Blocked Destination Countries", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "selCountry", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dst_region_s", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dst_region_s", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "dst_country_s", "latitude": "Count", "longitude": "Count", "sizeSettings": "Count", "sizeAggregation": "Average", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "categorical" } } }, "customWidth": "33", "name": "Blocked Destination Countries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL \n| where event_type_s == \"network\" and action_s == \"block\"\n| where dst_country_s == '{selCountry}'\n| project src_country_s, dst_country_s, dst_region_s, dsthost_s, dstip_s, dstport_d, ip_protocol_s, policy_s, access_method_s, traffic_type_s, user_s, userip_s\n//| take 10", "size": 2, "title": "Show Blocked Details by Country", "noDataMessage": "Select Country", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "src_country_s", "label": "Source Country" }, { "columnId": "dst_country_s", "label": "Destination Country" }, { "columnId": "dst_region_s", "label": "Destination Region" }, { "columnId": "dsthost_s", "label": "Destination Host" }, { "columnId": "dstip_s", "label": "Destination IP" }, { "columnId": "dstport_d", "label": "Destination Port" }, { "columnId": "ip_protocol_s", "label": "Protcol" }, { "columnId": "policy_s", "label": "Policy Name" }, { "columnId": "access_method_s", "label": "Access Method" }, { "columnId": "traffic_type_s", "label": "Traffic Type" }, { "columnId": "user_s", "label": "User" }, { "columnId": "userip_s", "label": "User IP" } ] } }, "name": "Show Blocked Details by Country" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| summarize Count = count() by dst_region_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top Blocked Destination Regions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dst_region_s", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dst_region_s", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } }, "mapSettings": { "locInfo": "LatLong", "latitude": "Count", "longitude": "Count", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Blocked Destination Regions" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where dstip_s != \"\" \n| summarize Count = count() by dstip_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top Blocked Destination IP Addresses", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Blocked Destination IP Addresses" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where dstport_d != \"null\" \n| extend dst_port = tostring(toint(dstport_d))\n| summarize Count = count() by dst_port\n| order by Count desc\n| take 10", "size": 2, "title": "Top Blocked Destination Ports", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dst_port", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dst_port", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Blocked Destination Ports", "styleSettings": { "margin": "0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where srcip_s != \"\" \n| summarize Count = count() by srcip_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top Blocked Source IP Addresses", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "Blocked Source IP Addresses" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL\n| where event_type_s == \"network\" and action_s == \"block\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where srcport_d != \"null\" \n| extend src_port = tostring(toint(srcport_d))\n| summarize Count = count() by src_port\n| order by Count desc\n| top 10 by Count desc nulls last", "size": 2, "title": "Top Blocked Source Ports", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "dst_port", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "dst_port", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Blocked Source Ports", "styleSettings": { "margin": "0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Events_CL \n| where event_type_s == \"network\" and traffic_type_s == \"non-web\" and action_s == \"allow\"\n| where (srcip_s in ({SourceIP}) or '{SourceIP:label}' == \"All\") and (srcport_d in ({SourcePort}) or '{SourcePort:label}' == \"All\") and (dstip_s in ({DestinationIP}) or '{DestinationIP:label}' == \"All\") and (dstport_d in ({DestinationPort}) or '{DestinationPort:label}' == \"All\")\n| where policy_s != \"default\" \n//| summarize count() by bin(TimeGenerated, {TimeRange:grain}), policy_s\n| summarize count() by policy_s", "size": 2, "title": "Non-Default Firewall Policies Getting Triggered", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Non-Default Firewall Policies Getting Triggered" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Cloud Firewall" }, "name": "Cloud Firewall" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Network Events" }, "name": "Network Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "fb58eb7d-4b4e-4b9e-8ccf-d1b519798721", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 25" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "db048291-ae29-4351-baad-78e8d7044120", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "58bfee18-a20c-4869-8f28-c33c981049fe", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Malware", "subTarget": "Malware", "style": "link" }, { "id": "beb6a698-1509-4daf-96e8-275001abf02f", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Data Loss Prevention", "subTarget": "Data Loss Prevention", "style": "link" }, { "id": "5f149675-5fa2-4c65-b6eb-c36fa8035b7f", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Malsite", "subTarget": "Malsite", "style": "link" }, { "id": "65da146b-5655-48f9-8032-376fe4168375", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Compromised Credentials", "subTarget": "Compromised Credentials", "style": "link" }, { "id": "addc1833-256c-4996-b9b9-0cadb5f3a1dd", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Behavior Analytics", "subTarget": "Behavior Analytics", "style": "link" } ] }, "name": "links - 25", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_s == \"yes\"\n| summarize Count = count() by alert_type_s\n| sort by Count desc\n", "size": 2, "title": "Alert Type Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Alert Type Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| summarize Count = count() by app_s\n| top 10 by Count\n", "size": 2, "title": "Top 10 Applications by Alerts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Applications by Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| summarize Count = count() by alert_name_s\n| top 10 by Count\n", "size": 2, "title": "Top 10 Alerts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "alert_name_s", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "alert_name_s", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| summarize Count = count() by user_s\n| top 10 by Count\n", "size": 2, "title": "Top 10 Users By Alerts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "alert_name_s", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "alert_name_s", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Users By Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| summarize Count = count() by src_country_s", "size": 2, "title": "Alerts Location by Source Country", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "sortBy": [], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "src_country_s", "latitude": "src_latitude_d", "longitude": "src_longitude_d", "sizeSettings": "Count", "sizeAggregation": "Sum", "labelSettings": "src_country_s", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "67", "name": "Alerts Location by Source Country" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain}), alert_type_s\n", "size": 2, "title": "Alert Types Over Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "Alert Types Over Time" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "Alert Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count(malware_type_s) by malware_type_s\n| sort by Count desc", "size": 2, "title": "Malware Types Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malware Types Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count(activity_s) by activity_s\n| sort by Count desc", "size": 2, "title": "Malware Activities Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malware Activities Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by malware_name_s\n| sort by Count desc", "size": 2, "title": "Malware Names Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malware Names Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by malware_severity_s\n| sort by Count desc", "size": 2, "title": "Malware Severity Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Malware Severity Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by file_type_s\n| top 10 by Count", "size": 2, "title": "Top 10 Affected FileTypes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 0 } }, "customWidth": "33", "name": "Top 10 Affected FileTypes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by app_s\n| sort by Count desc", "size": 2, "title": "Malware Incidents by Applications", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malware Incidents by Applications" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by user_s\n| sort by Count desc\n| top 10 by Count", "size": 2, "title": "Top 10 Users Triggered Malware Events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Users Triggered Malware Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain}), malware_name_s\n", "size": 2, "title": "Blocked Malwares Over Time", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "malware", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "67", "name": "Blocked Malwares Over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Malware\"\n| where malware_name_s == '{malware}'\n| project TimeGenerated, user_s, app_name_s, activity_s, detection_engine_s, detection_type_s, file_name_s, file_type_s, malware_severity_s, malware_name_s", "size": 0, "title": "Blocked Malware Log Details", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "TimeGenerated", "label": "TimeGenerated" }, { "columnId": "user_s", "label": "User" }, { "columnId": "app_name_s", "label": "App_Name" }, { "columnId": "activity_s", "label": "Activity" }, { "columnId": "detection_engine_s", "label": "Detection_Engine" }, { "columnId": "detection_type_s", "label": "Detection_Type" }, { "columnId": "file_name_s", "label": "File_Name" }, { "columnId": "file_type_s", "label": "File_Type" }, { "columnId": "malware_severity_s", "label": "Severity" }, { "columnId": "malware_name_s", "label": "Malware_Name" } ] } }, "name": "Blocked Malware Log Details" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Malware" }, "name": "Malware" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| summarize Count = count() by malsite_category_s", "size": 2, "title": "Malsite Blocked by Category", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malsite Blocked by Category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| summarize Count = count() by severity_level_s", "size": 2, "title": "Malsite Blocked by Severity", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "severity", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malsite Blocked by Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| summarize Count = count() by malsite_country_s", "size": 2, "title": "Malsite Blocked by Destination Location", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Malsite Blocked by Destination Location" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| where severity_level_s == '{severity}'\n| project TimeGenerated, user_s, url_s, malsite_category_s, malsite_country_s, malsite_ip_host_s, threat_match_value_s, severity_level_s\n", "size": 0, "title": "Malsite Incidents Details by Severity Level", "noDataMessage": "Select Severity Level", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "user_s", "label": "User" }, { "columnId": "url_s", "label": "URL" }, { "columnId": "malsite_category_s", "label": "Category" }, { "columnId": "malsite_country_s", "label": "Country" }, { "columnId": "malsite_ip_host_s", "label": "IP" }, { "columnId": "threat_match_value_s", "label": "Threat Match" }, { "columnId": "severity_level_s", "label": "Severity" } ] } }, "name": "Malsite Incidents Details by Severity Level" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| summarize Count = count() by user_s", "size": 2, "title": "Top 10 Users Accessing Malsites", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "user", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Users Accessing Malsites" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"malsite\"\n| where user_s == '{user}'\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), user_s\n", "size": 2, "title": "User Accessing Malsites Over time", "noDataMessage": "Select User", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar" }, "customWidth": "67", "name": "User Accessing Malsites Over time" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Malsite" }, "name": "Malsite" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by app_s", "size": 2, "title": "DLP Incidents by Applications", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "DLP Incidents by Applications" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by dlp_rule_severity_s", "size": 2, "title": "DLP Incidents By Severity", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "severity", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "DLP Incidents By Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by activity_s", "size": 2, "title": "DLP Incidents by Activity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "DLP Incidents by Activity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| where dlp_rule_severity_s == '{severity}'\n| project TimeGenerated, dlp_rule_s, dlp_rule_severity_s, dlp_file_s, object_type_s, activity_s, user_s, from_user_s", "size": 2, "title": "DLP Incididents Details by Severity", "noDataMessage": "Select Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "TimeGenerated", "label": "TimeGenerated" }, { "columnId": "dlp_rule_s", "label": "DLP Rule" }, { "columnId": "dlp_rule_severity_s", "label": "Severity" }, { "columnId": "dlp_file_s", "label": "File Name" }, { "columnId": "object_type_s", "label": "File Type" }, { "columnId": "activity_s", "label": "Activity" }, { "columnId": "user_s", "label": "User" }, { "columnId": "from_user_s", "label": "From User" } ] } }, "name": "DLP Incididents Details by Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by os_s", "size": 2, "title": "DLP Incidents by OS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "DLP Incidents by OS" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by dlp_rule_s\n| top 10 by Count", "size": 2, "title": "Top 10 DLP Rules Triggered", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 DLP Rules Triggered" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by dlp_profile_s\n| top 10 by Count", "size": 2, "title": "Top 10 DLP Profiles", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 DLP Profiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by user_s\n| top 10 by Count", "size": 2, "title": "Top 10 Users Triggered DLP Events", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 Users Triggered DLP Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by dlp_file_s\n| top 10 by Count\n", "size": 2, "title": "Top 10 DLP Incidents by File", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 DLP Incidents by File" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by policy_s\n| top 10 by Count\n", "size": 2, "title": "Top 10 DLP Incidents by Policy Voilations", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top 10 DLP Incidents by Policy Voilations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"DLP\"\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain}), policy_s", "size": 2, "title": "DLP Incidents by Policy Over Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "DLP Incidents by Policy Over Time" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Data Loss Prevention" }, "name": "Data Loss Prevention" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Compromised Credential\"\n| summarize Count = count() by alert_name_s\n| sort by Count desc", "size": 2, "title": "Compromised Credentials by Source of Info", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Compromised Credentials by Source of Info" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Compromised Credential\"\n| project breach_date_t, alert_name_s, breach_description_s, breach_id_g, breach_score_d\n| top 10 by breach_score_d desc ", "size": 2, "title": "Top 10 breaches by Breach Score", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "labelSettings": [ { "columnId": "breach_date_t", "label": "Breach_Date" }, { "columnId": "alert_name_s", "label": "Alert_Name" }, { "columnId": "breach_description_s", "label": "Description" }, { "columnId": "breach_id_g", "label": "Breach_id" }, { "columnId": "breach_score_d", "label": "Breach_Score" } ] } }, "customWidth": "67", "name": "Top 10 breaches by Breach Score" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"Compromised Credential\"\n| project TimeGenerated, alert_name_s, user_s, breach_id_g, breach_date_t, breach_score_d, matched_username_s, breach_media_references_s, breach_target_references_s", "size": 0, "title": "Compromised Credentials", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "labelSettings": [ { "columnId": "TimeGenerated", "label": "Alert_Date" }, { "columnId": "alert_name_s", "label": "Alert_Name" }, { "columnId": "user_s", "label": "User" }, { "columnId": "breach_id_g", "label": "Breach_id" }, { "columnId": "breach_date_t", "label": "Breach_Date" }, { "columnId": "breach_score_d", "label": "Breach_Score" }, { "columnId": "matched_username_s", "label": "Matched_Username" }, { "columnId": "breach_media_references_s", "label": "Media_Reference" }, { "columnId": "breach_target_references_s", "label": "Target_Reference" } ] } }, "name": "Compromised Credentials" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Compromised Credentials" }, "name": "Compromised Credentials" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize Count = count () by activity_s", "size": 2, "title": "Anomalies by Activity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Anomalies by Activity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize Count = count () by app_s", "size": 2, "title": "Anomalies by App", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Anomalies by App" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize Count = count () by Category", "size": 2, "title": "Anomalies by Category", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Anomalies by Category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize Count = count () by alert_name_s", "size": 2, "title": "Anomalies by Alert Names", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "alertname", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Anomalies by Alert Names" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| where alert_name_s == '{alertname}'\n| summarize Count = count () by TimeGenerated, srcip_s, user_s, from_user_s, app_s, severity_s, alert_name_s", "size": 2, "title": "Users by Anomaly Alert Name", "noDataMessage": "Select Alert Name", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "TimeGenerated", "label": "TimeGenerated" }, { "columnId": "srcip_s", "label": "Source IP" }, { "columnId": "user_s", "label": "User" }, { "columnId": "from_user_s", "label": "From_User" }, { "columnId": "app_s", "label": "Application" }, { "columnId": "severity_s", "label": "Severity" }, { "columnId": "alert_name_s", "label": "Alert_Name" }, { "columnId": "Count", "label": "Count" } ] } }, "customWidth": "67", "name": "Users by Anomaly Alert Name" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize Count = count () by severity_s", "size": 2, "title": "Anomalies by Severity Level", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Anomalies by Severity Level" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_Alerts_CL\n| where alert_type_s == \"uba\"\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), severity_s", "size": 2, "title": "Anomalies Over Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "67", "name": "Anomalies Over Time" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Behavior Analytics" }, "name": "UBA" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Security Alerts" }, "name": "Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0f03bf28-2c13-4018-ac1b-4dbec5b168fc", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 7776000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL \n| summarize Count = count() by x_c_browser_s\n", "size": 2, "title": "Browser Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Browser Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL \n| summarize Count = count() by x_c_device_s\n", "size": 2, "title": "Device Breakdown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Device Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL \n| summarize Count = count() by cs_host_s\n", "size": 2, "title": "Top Hosts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top Hosts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL \n| summarize Count = count() by x_cs_app_s", "size": 2, "title": "Top Apps", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "app", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "Top Apps" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL \n| summarize Count = count() by cs_method_s", "size": 2, "title": "HTTP Methods by Names", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "method", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "HTTP Methods by Names" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL\n| where cs_method_s == '{method}' and x_cs_app_s == '{app}'\n| summarize Count = count() by TimeGenerated, cs_username_s, x_cs_app_s,cs_method_s \n| sort by Count desc", "size": 2, "title": "Users by App and HTTP Method", "noDataMessage": "No Record Found", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true, "labelSettings": [ { "columnId": "cs_username_s", "label": "User" }, { "columnId": "x_cs_app_s", "label": "App" }, { "columnId": "cs_method_s", "label": "HTTP_Method" }, { "columnId": "Count", "label": "Count" } ] } }, "customWidth": "33", "name": "Users by App and HTTP Method" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Netskope_WebTX_CL\n| summarize TotalBytes = sum (toint(bytes_s)/1024.0/1024.0) by bin(TimeGenerated, {TimeRange:grain}), x_cs_app_s", "size": 2, "title": "App Traffic Volume", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "TotalBytes" ], "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "App Traffic Volume" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Web Transcations" }, "name": "Web Transactions" } ], "styleSettings": {}, "fromTemplateId": "sentinel-Netskope", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }