{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Gain insights into SecurityBridge logs.\n---\n\nSecurityBridge is the first and only holistic, natively integrated security platform, addressing all aspects needed to protect organizations running SAP from internal and external threats against their core business applications. The SecurityBridge platform is an SAP-certified add-on, used by organizations around the globe, and addresses the clients’ need for advanced cybersecurity, real-time monitoring, compliance, code security, and patching to protect against internal and external threats.This Microsoft Sentinel Solution allows you to integrate SecurityBridge Threat Detection events from all your on-premise and cloud based SAP instances into your security monitoring.Use this Microsoft Sentinel Solution to receive normalized and speaking security events, pre-built dashboards and out-of-the-box templates for your SAP security monitoring.\nThis data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-SecurityBridgeLogs-parser) to create the Kusto Functions alias, SecurityBridgeLogs" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "961f51be-788f-4f9a-b2a0-0a596216d59f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 5184000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "e49c1a95-361b-4a51-8207-1dda7041d855", "version": "KqlParameterItem/1.0", "name": "Help", "label": "Show Help", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]", "value": "Yes" }, { "id": "51cb8cb1-3d50-47f4-9485-2519a992c735", "version": "KqlParameterItem/1.0", "name": "urlprefix", "label": "URL Prefix", "type": 1, "description": "Add the url prefix of the system to view the links for events", "isRequired": true, "value": "\"http://abex3.abap-experts.com:8003/sap/bc/ui5_ui5/abex/sefwmd/#/events/details/\"" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "38cf22e5-8dc6-477e-8e6c-c8107de22596", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Events Monitor", "subTarget": "monitor", "style": "link" }, { "id": "2e2baa8d-3b34-4818-a3c7-df5c179f6385", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Events Analyze", "subTarget": "analyze", "style": "link" } ] }, "name": "links - 22" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| extend Severity = tostring(Severity)\r\n| summarize Count = count() by Severity\r\n| extend SeverityNumber = case(Severity == \"Low\", 3, Severity == \"Medium\", 7, Severity == \"High\", 9, Severity == \"Critical\", 10, 0)\r\n| sort by SeverityNumber", "size": 4, "title": "Events by Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Low", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev4", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1 }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Severity", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 3" }, { "type": 1, "content": { "json": "Select the filters below to display relevant events", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "63aff516-725f-4c6c-bb0a-b2bb484176d1", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| extend Severity = tostring(Severity)\r\n| distinct Severity", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "afb7a9f8-5e29-411e-8d9e-99f4bc855b0b", "version": "KqlParameterItem/1.0", "name": "User", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| distinct duser", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "57735ba8-7c80-477c-899c-b0507bacb946", "version": "KqlParameterItem/1.0", "name": "SAPSID", "label": "SAP SID", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| distinct SAPsid", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b6d548e0-6685-4bac-9419-25d74a4972d7", "version": "KqlParameterItem/1.0", "name": "Terminal", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| distinct shost", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "60ff9487-e9a9-4c08-9207-8d7c8b186f91", "version": "KqlParameterItem/1.0", "name": "Listener", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| distinct DeviceEventClassID", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1521e9a7-53ea-4737-8e8e-819599655b13", "version": "KqlParameterItem/1.0", "name": "Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| distinct Name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where Severity in ({Severity})\r\n| where duser in ({User}) or \"*\" in ({User})\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| where shost in ({Terminal}) or \"*\" in ({Terminal})\r\n| where DeviceEventClassID in ({Listener}) or \"*\" in ({Listener})\r\n| where Name in ({Action}) or \"*\" in ({Action})\r\n| project TimeGenerated, Severity, DeviceEventClassID, Name, msg, [\"Link to Event\"]= strcat(({urlprefix}), externalid), shost, duser, SAPsid, SAPclient\r\n| sort by TimeGenerated", "size": 0, "title": "Event by Selected Filters", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Link to Event", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Link to the Event" } } ], "sortBy": [ { "itemKey": "shost", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "shost", "sortOrder": 2 } ] }, "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "analyze" }, "name": "group - 23" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This tab helps in analyzing events.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a0a31cee-67ce-43c1-b0e5-a4f744edf81e", "version": "KqlParameterItem/1.0", "name": "SAPSID", "label": "SAP SID", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityBridgeLogs\r\n| distinct SAPsid", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 1, "content": { "json": "This bar chart shows the events by event name.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by Name", "size": 0, "title": "Events by Event Name", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "name": "query - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This barchart shows the events ingestion with respect to time", "style": "info" }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize [\"Number of Events\"] = count() by bin(todatetime(rt), 1d)", "size": 1, "title": "Events Ingestion by Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "customWidth": "100", "name": "query - 1 - Copy - Copy" } ] }, "customWidth": "50", "name": "group - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This barchart shows the events ingestion with respect to severity and time", "style": "info" }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by bin(todatetime(rt), 1h), Severity", "size": 1, "title": "Events by Time with respect to Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Critical", "color": "red" }, { "seriesName": "Low", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - 1 - Copy" } ] }, "customWidth": "50", "name": "group - 13 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This barchart shows the events ingestion with respect to SAPsid", "style": "info" }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by SAPsid", "size": 1, "title": "Events Ingestion by Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "customWidth": "100", "name": "query - 1 - Copy - Copy" } ] }, "customWidth": "50", "name": "group - 13 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by Severity", "size": 0, "title": "Events by Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "30", "name": "query - 1 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by duser\r\n| sort by count_\r\n| take 5", "size": 0, "title": "Top 5 Users", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "30", "name": "query - 1 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by dhost\r\n| sort by count_\r\n| take 5", "size": 0, "title": "Top 5 Workstations", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "30", "name": "query - 1 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by duser\r\n| join (\r\nSecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| extend user = duser\r\n| make-series TrendList = count() on todatetime(rt) in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by duser ) on duser\r\n| project duser, [\"Total events\"] = count_, TrendLine = TrendList\r\n| top 10 by [\"Total events\"] desc", "size": 0, "title": "Event Stats by Users", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TrendLine", "formatter": 9, "formatOptions": { "palette": "green" } } ] }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 1 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| summarize count() by dhost\r\n| join (\r\nSecurityBridgeLogs\r\n| where SAPsid in ({SAPSID}) or \"*\" in ({SAPSID})\r\n| extend user = dhost\r\n| make-series TrendList = count() on todatetime(rt) in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by dhost ) on dhost\r\n| project dhost, [\"Total events\"] = count_, TrendLine = TrendList\r\n| top 10 by [\"Total events\"] desc", "size": 0, "title": "Event Stats by Host", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TrendLine", "formatter": 9, "formatOptions": { "palette": "green" } } ] }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "monitor" }, "name": "group - 24" } ], "fromTemplateId": "sentinel-SecurityBridge", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }