{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Palo Alto network threat\n"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "query": "",
        "crossComponentResources": [],
        "parameters": [
          {
            "id": "d0ccb5c6-8a07-4b7e-9abf-38fa4dcc0baf",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 43200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT' and DeviceEventClassID != 'url' and DeviceEventClassID != 'file';\r\ndata\r\n| summarize Count = count() by DeviceEventClassID\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceEventClassID)\r\n on DeviceEventClassID\r\n| project-away DeviceEventClassID1, TimeGenerated\r\n| extend DeviceEventClassIDs = DeviceEventClassID\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend DeviceEventClassID = 'All', DeviceEventClassIDs = '*' \r\n)\r\n| project DeviceEventClassID, Count, Trend\r\n| order by Count desc\r\n| take 10",
        "size": 3,
        "exportFieldName": "DeviceEventClassID",
        "exportParameterName": "SelectedSubtype",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Threats, by subtypes",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "DeviceEventClassID",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "blueDark",
              "showIcon": true
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "33",
      "name": "Threats by subtypes"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT'\r\n| where DeviceEventClassID =~'wildfire';\r\ndata\r\n| summarize Count = count() by DeviceCustomString2\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceCustomString2)\r\n on DeviceCustomString2\r\n| project-away DeviceCustomString21, TimeGenerated\r\n| extend DeviceCustomString2s = DeviceCustomString2\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend DeviceCustomString2 = 'All', DeviceCustomString2s = '*' \r\n)\r\n| project DeviceCustomString2, Count, Trend\r\n| order by Count desc\r\n| take 10",
        "size": 3,
        "exportFieldName": "DeviceCustomString2",
        "exportParameterName": "SelectedWildfire",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "WildFire verdicts",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "DeviceCustomString2",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "blueDark",
              "showIcon": true
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "33",
      "name": "WildFire verdicts"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT' and LogSeverity != 'url' and LogSeverity != 'file';\r\ndata\r\n| summarize Count = count() by LogSeverity\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by LogSeverity)\r\n on LogSeverity\r\n| project-away LogSeverity1, TimeGenerated\r\n| extend LogSeveritys = LogSeverity\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend LogSeverity = 'All', LogSeveritys = '*' \r\n)\r\n| project LogSeverity, Count, Trend\r\n| order by Count desc\r\n| take 10",
        "size": 3,
        "exportFieldName": "LogSeverity",
        "exportParameterName": "SelectedSeverity",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Threats severity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "LogSeverity",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Count",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "lightBlue",
                "showIcon": true
              }
            }
          ],
          "labelSettings": []
        },
        "tileSettings": {
          "titleContent": {
            "columnMatch": "LogSeverity",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "blueDark",
              "showIcon": true
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "33",
      "name": "Threats severity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT' and DeviceEventClassID != 'url' and DeviceEventClassID != 'file'\r\n| where '{SelectedSubtype}' == \"All\" or '{SelectedSubtype}'==DeviceEventClassID\r\n| where '{SelectedWildfire}' == \"All\" or '{SelectedWildfire}'==DeviceCustomString2\r\n| where '{SelectedSeverity}' == \"All\" or '{SelectedSeverity}'==LogSeverity\r\n| summarize count() by bin(TimeGenerated, 1h), DeviceEventClassID\r\n| render timechart\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Threat subtypes over time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "37.5",
      "name": "Threat subtypes over time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT' and DeviceEventClassID != 'url' and DeviceEventClassID != 'file'\r\n| where '{SelectedSubtype}' == \"All\" or '{SelectedSubtype}'==DeviceEventClassID\r\n| where '{SelectedWildfire}' == \"All\" or '{SelectedWildfire}'==DeviceCustomString2\r\n| where '{SelectedSeverity}' == \"All\" or '{SelectedSeverity}'==LogSeverity\r\n| summarize count() by bin(TimeGenerated, 1h), LogSeverity\r\n| render timechart\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Threat severity over time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "37.5",
      "name": "Threat severity over time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT' and DeviceEventClassID != 'url' and DeviceEventClassID != 'file'\r\n| where '{SelectedSubtype}' == \"All\" or '{SelectedSubtype}'==DeviceEventClassID\r\n| where '{SelectedWildfire}' == \"All\" or '{SelectedWildfire}'==DeviceCustomString2\r\n| where '{SelectedSeverity}' == \"All\" or '{SelectedSeverity}'==LogSeverity;\r\ndata\r\n| summarize Count = count() by ApplicationProtocol\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ApplicationProtocol)\r\n on ApplicationProtocol\r\n| project-away ApplicationProtocol1, TimeGenerated\r\n| extend ApplicationProtocols = ApplicationProtocol\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend ApplicationProtocol = 'All', ApplicationProtocols = '*' \r\n)\r\n| project ApplicationProtocol, Count, Trend\r\n| order by Count desc\r\n| take 10",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Threats, by application",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ApplicationProtocol",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "showIcon": true
              }
            }
          ],
          "labelSettings": []
        },
        "tileSettings": {
          "titleContent": {
            "columnMatch": "ApplicationProtocol",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "blueDark",
              "showIcon": true
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "25",
      "name": "Threats by application"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where Activity =~ 'THREAT'\r\n| where '{SelectedSubtype}' == \"All\" or '{SelectedSubtype}'==DeviceEventClassID\r\n| where '{SelectedWildfire}' == \"All\" or '{SelectedWildfire}'==DeviceCustomString2\r\n| where '{SelectedSeverity}' == \"All\" or '{SelectedSeverity}'==LogSeverity\r\n| project TimeGenerated, ReceiptTime, LogSeverity, DeviceAction, ['URL Category'] =DeviceCustomString2, DestinationPort, DestinationIP, Message, SourcePort, SourceIP, DestinationUserID, RequestURL",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Threat events",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true,
          "labelSettings": []
        }
      },
      "name": "All Threat Events"
    },
    {
      "type": 1,
      "content": {
        "json": "---"
      },
      "name": "text - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where DeviceEventClassID =~ 'vulnerability' \r\n| extend ThreatId = coalesce(\r\n                            column_ifexists(\"DeviceEventCategory\", \"\"),\r\n                            extract('cat=([^;]+)',1,AdditionalExtensions),\r\n                            \"\"\r\n                        )\r\n| summarize Amount=count() by ThreatId, LogSeverity\r\n| top 20 by Amount",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Top vulnerability events",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ThreatId",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "LogSeverity",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Amount",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            },
            {
              "columnMatch": "count_",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "labelSettings": []
        }
      },
      "customWidth": "50",
      "name": "Top vulnerability events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| search DeviceEventClassID:'*virus*'\r\n| summarize Amount=count() by RequestURL, DeviceEventClassID, DestinationIP, SourceIP, ApplicationProtocol\r\n| top 20 by Amount",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Virus and malware events",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "RequestURL",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "DeviceEventClassID",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "DestinationIP",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "SourceIP",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "ApplicationProtocol",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Amount",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            },
            {
              "columnMatch": "SourceUserID",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "count_",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "labelSettings": []
        }
      },
      "customWidth": "50",
      "name": "Virus and malware events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct has 'PAN-OS'\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n//| where DeviceEventClassID =~ 'correlation' \r\n| extend ThreatId = coalesce(\r\n                            column_ifexists(\"DeviceEventCategory\", \"\"),\r\n                            extract('cat=([^;]+)',1,AdditionalExtensions),\r\n                            \"\"\r\n                        )\r\n| extend ThreatCategory = extract('PanOSThreatCategory=([^;]+)',1, AdditionalExtensions)\r\n| summarize Amount=count() by ThreatId, ThreatCategory, LogSeverity\r\n| top 20 by Amount",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Top correlation events",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ThreatId",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "ThreatCategory",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "LogSeverity",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Amount",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            },
            {
              "columnMatch": "count_",
              "formatter": 4,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ],
          "labelSettings": []
        }
      },
      "name": "Top correlation events"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-PaloAltoNetworkThreat",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}