{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5c2e0c7c-a71c-4aa5-8bcd-ec37fd82d245", "version": "KqlParameterItem/1.0", "name": "TimeRestriction", "label": "Time Restriction", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "e71e562e-0bd9-4994-8547-58a2ff2a96c4", "version": "KqlParameterItem/1.0", "name": "Sensor", "label": "Corelight Sensor", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "union isfuzzy=true\r\ncorelight_corelight_metrics_iface, corelight_corelight_metrics_system, corelight_corelight_metrics_memory, corelight_corelight_metrics_disk, corelight_corelight_metrics_zeek_doctor\r\n| distinct sensor_name\r\n| sort by sensor_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 1, "content": { "json": ">**NOTE:** If the overview dashboard and its panels are not showing data, please make sure you have configured your Corelight Sensors to export statistics to Sentinel. More Information can be found here: [**Corelight Support**](https://corelight.com/support/)." }, "name": "text - 23" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "6a60ca4a-0a15-4fc1-a2bf-9e4f81d7930b", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Sensor Overview", "subTarget": "sensor_overview", "preText": "Sensor Overview", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "5cc3d88d-e684-41d4-8fc6-70027e563d5c", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Rates", "subTarget": "Rates", "style": "link" }, { "id": "6634f9a2-7db9-4a07-9339-4909f0c98214", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "System", "subTarget": "System", "style": "link" }, { "id": "c807a2d8-acdc-44e1-a174-5a1c05101667", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Data Hygiene", "subTarget": "DataHygiene", "style": "link" } ] }, "name": "links - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_iface\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Monitor Traffic Rate - Mbps\"] = round(avg(monitor_total_mbps), 1) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "Combined Traffic Volume - Monitor Interfaces", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xSettings": { "label": "Monitor Traffic Rate" }, "ySettings": { "label": "" } } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_iface\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Monitor Traffic Packet Rate - Kpackets Per Second\"] = round(max(monitor_total_kpps), 1), [\"Monitor Traffic Drop Rate - Kpackets Per Second\"] = avg(monitor_total_drops_kpps) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "Combined Traffic Volume - Monitor Interfaces - Packets", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "rowLimit": 10000 } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_iface\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Inbound Traffic Rate - Mbps\"] = round(avg(mgmt_in_bytes_mbps), 2), [\"Outbound Traffic Rate - Mbps\"] = round(avg(mgmt_out_bytes_mbps), 2) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "Traffic Volume - Management Interface", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_iface\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Inbound Traffic Packet Rate - Kpackets Per Second\"] = round(avg(mgmt_in_packets_kpps), 2), [\"Outbound Traffic Packet Rate - Kpackets Per Second\"] = round(avg(mgmt_out_packets_kpps), 2) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "Traffic Volume - Management Interface - Packets", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Rates" }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_memory\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Memory Usage - Percent(%)\"] = avg(usage) default = 0 on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration\r\n", "size": 0, "showAnalytics": true, "title": "Memory Usage", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_system\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"CPU1 Temperature - Degrees Celsius\"] = avg(cpu_1_temperature) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration\r\n", "size": 0, "showAnalytics": true, "title": "System Temperature", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRestriction:end}, {TimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_corelight_metrics_disk\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series [\"Data Disk Usage - Percent(%)\"] = avg(usage_data), [\"OS Disk Usage - Percent(%)\"] = avg(usage_os) on TimeGenerated from {TimeRestriction:start} to {TimeRestriction:end} step bin_duration\r\n", "size": 0, "showAnalytics": true, "title": "Disk Usage", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 2" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "System" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_retransmissions_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_retransmissions_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg TCP Retransmissions", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_remote_to_remote_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_remote_to_remote_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))\r\n", "size": 4, "showAnalytics": true, "title": "Avg Remote to Remote", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_local_to_local_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_local_to_local_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg Local to Local", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_missed_bytes_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_missed_bytes_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))\r\n", "size": 4, "showAnalytics": true, "title": "Avg TCP Missed Bytes", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_scan_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_scan_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))\r\n", "size": 4, "showAnalytics": true, "title": "Avg TCP Scan", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_backscatter_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_backscatter_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))\r\n", "size": 4, "showAnalytics": true, "title": "Avg TCP Backscatter", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_no_ssl_on_443_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_no_ssl_on_443_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg No SSL On 443", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_bursty_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_bursty_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg Bursty", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_dns_half_duplex_orig_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_dns_half_duplex_orig_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg DNS Half Duplex Orig", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "33", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_dns_half_duplex_resp_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_dns_half_duplex_resp_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg DNS Half Duplex Resp", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "33", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_half_duplex_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_half_duplex_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2)) ", "size": 4, "showAnalytics": true, "title": "Avg TCP Half Duplex", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "34", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_no_three_way_handshake_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_no_three_way_handshake_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg TCP No Three Way Handshake", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_corelight_metrics_zeek_doctor\r\n| where isnotempty(check_tcp_byte_counts_wrong_percent) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_value = avg(check_tcp_byte_counts_wrong_percent)\r\n| project avg_value = iff(isnan(avg_value), toreal(0), round(avg_value, 2))", "size": 4, "showAnalytics": true, "title": "Avg TCP Byte Counts Wrong", "timeContextFromParameter": "TimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_value", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "2", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "2", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "heatmap", "mode": "foreground", "heatmapPalette": "greenRed" }, "tagText": "", "valueFontStyle": "auto" }, "textSettings": { "style": "bignumber" } }, "customWidth": "50", "name": "query - 0" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "DataHygiene" }, "name": "group - 3" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "sensor_overview" }, "name": "group - 8" }, { "type": 1, "content": { "json": "📝 **Refresh the web page to fetch details of recently collected events**" }, "name": "text - 5" } ] }, "name": "group - 0" } ], "fromTemplateId": "sentinel-Corelight_Operations", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }