{
"version": "Notebook/1.0",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Intro",
"items": [
{
"type": 1,
"content": {
"json": "## Summary Rules Workbook\r\n#### The _Summary Rules workbook_ provides a comprehensive analysis of the Summary Rules configured in Microsoft Sentinel. It enables users to monitor rule execution, evaluate performance, and assess overall efficiency. By offering insights into rule behavior and effectiveness, this workbook supports optimization of threat detection strategies and helps ensure that security operations are both responsive and resource-efficient. This workbook is designed to provide insights into the Summary Rules configured in Microsoft Sentinel. It consists of two main tabs:\r\n\r\n**Overview Tab**
\r\nThis tab presents general information about all active Summary Rules in the Sentinel environment. It includes:\r\n- A list of currently active Summary Rules.\r\n- Metadata such as rule names, creation dates, and status.\r\n- High-level metrics on rule execution frequency and data volume.\r\n- A visual summary of rule distribution and activity trends.\r\n\r\n\r\n**Summary Rule Analysis Tab**
\r\nThis tab allows for detailed analysis of a specific Summary Rule. Users must select:\r\n- RuleName – the name of the Summary Rule to analyze.\r\n- Frequency – how often the rule is executed.\r\n- TableName – the name of the table where the rule's output data is stored.\r\n\r\nOnce selected, the tab displays:
\r\n- Execution history and timestamps.\r\n- Volume and characteristics of the data produced.\r\n- Performance metrics such as execution duration and resource usage.\r\n- Visualizations to help assess rule efficiency and impact.\r\n"
},
"name": "text - 0"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "d398b694-0f95-4015-9d63-60e605656b0c",
"version": "KqlParameterItem/1.0",
"name": "Time",
"label": "TimeRange",
"type": 4,
"isGlobal": true,
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 2"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "e81a6a42-6f52-4b83-8717-3d02fc820f4a",
"cellValue": "View",
"linkTarget": "parameter",
"linkLabel": "Overview",
"subTarget": "Overview",
"style": "link"
},
{
"id": "25fff085-5348-45be-8f43-4e086ea7bb11",
"cellValue": "View",
"linkTarget": "parameter",
"linkLabel": "Summary Rule Analysis",
"subTarget": "SingleRule",
"style": "link"
}
]
},
"name": "Tabs"
}
],
"exportParameters": true
},
"name": "Intro"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Summary Rule analysis",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "9fd18145-6915-43b5-ade6-b96740084f19",
"version": "KqlParameterItem/1.0",
"name": "RuleName",
"type": 2,
"isRequired": true,
"query": "LASummaryLogs\r\n| distinct RuleName",
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": null
},
{
"id": "fc1b30bb-966a-4edb-a179-c4e6e2baaf2a",
"version": "KqlParameterItem/1.0",
"name": "Frequency",
"type": 2,
"description": "Possible values: 20m, 30m, 1h, 2h, 3h, 6h, 12h, 24h",
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\"20m\", \"30m\", \"1h\", \"2h\", \"3h\", \"6h\", \"12h\", \"24h\"]",
"value": "20m"
},
{
"id": "62bcf6a2-dc30-449e-a7f1-cb4b62a5bc59",
"version": "KqlParameterItem/1.0",
"name": "TableName",
"type": 1,
"value": ""
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where RuleName == '{RuleName}'\r\n| summarize count() by Status",
"size": 0,
"title": "Count of Started, Succeeded and Failed executions",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"customWidth": "50",
"name": "Succeeded Execution"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where RuleName == '{RuleName}'\r\n| summarize arg_max(TimeGenerated, *) by RuleName\r\n| project BinStartTime, BinSize, Status, QueryDurationMs, ResultsRecordCount",
"size": 0,
"title": "Most Recent Log regarding Rule {RuleName} - which actually is executed every {BinSize} Minutes",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"rowLimit": 1
}
},
"customWidth": "50",
"name": "Most Recent Log",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where RuleName == '{RuleName}'\r\n| project-away RuleName",
"size": 0,
"title": "Summary Rule Logs",
"timeContextFromParameter": "Time",
"exportParameterName": "exportedValues",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"sortBy": [
{
"itemKey": "ResultsRecordCount",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "ResultsRecordCount",
"sortOrder": 2
}
]
},
"name": "Summary Rule Logs"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let stringa = '{exportedValues}';\r\nlet stringajson = parse_json(stringa);\r\n{TableName}\r\n| where _BinStartTime == stringajson[\"BinStartTime\"]\r\n| project-away _BinSize, _BinStartTime, _RuleLastModifiedTime, _RuleName, Type, _ResourceId\r\n\r\n",
"size": 0,
"title": "Produced Logs in the relevant table",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 1
}
]
},
"name": "Produced Logs in the relevant table"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where RuleName == '{RuleName}'\r\n| summarize sum(ResultsRecordCount) by bin(BinStartTime, {Frequency})\r\n| project BinStartTime, entries=sum_ResultsRecordCount\r\n| render timechart",
"size": 0,
"title": "Count of entries produced by rule {RuleName}",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"sortBy": [
{
"itemKey": "sum_ResultsRecordCount",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "sum_ResultsRecordCount",
"sortOrder": 2
}
]
},
"name": "query - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where RuleName == '{RuleName}'\r\n| summarize avg(QueryDurationMs) by bin(BinStartTime, {Frequency})\r\n| project BinStartTime, averageMS=avg_QueryDurationMs\r\n| render timechart",
"size": 0,
"title": "Average of query time of rule {RuleName}",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"sortBy": [
{
"itemKey": "sum_ResultsRecordCount",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "sum_ResultsRecordCount",
"sortOrder": 2
}
]
},
"name": "query - 3 - Copy"
}
]
},
"conditionalVisibility": {
"parameterName": "View",
"comparison": "isEqualTo",
"value": "SingleRule"
},
"name": "Summary Rule analysis"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Overview",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where Status == \"Succeeded\"\r\n| summarize count() by RuleName",
"size": 0,
"title": "Count of Succeeded executions",
"noDataMessage": "No data",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"customWidth": "50",
"name": "Succeeded Execution"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where Status == \"Failed\"\r\n| summarize count() by RuleName",
"size": 0,
"title": "Count of Failed executions",
"noDataMessage": "No data",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"customWidth": "50",
"name": "Failed Execution"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated {Time:query}\r\n| where Status == \"Succeeded\"\r\n| summarize sum(ResultsRecordCount) by RuleName",
"size": 0,
"title": "Total Entries ingested for each Rule",
"noDataMessage": "No data",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"customWidth": "50",
"name": "Total Entries ingested for each Rule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "LASummaryLogs\r\n| where TimeGenerated > ago(90d)\r\n| summarize arg_max(TimeGenerated, *) by RuleName\r\n| project RuleName, RuleLastModifiedTime, LastTimeExecuted=BinStartTime",
"size": 0,
"title": "General Info",
"noDataMessage": "No data",
"timeContextFromParameter": "Time",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "50",
"name": "General Info"
}
]
},
"conditionalVisibility": {
"parameterName": "View",
"comparison": "isEqualTo",
"value": "Overview"
},
"name": "Overview"
}
],
"fromTemplateId": "sentinel-SummaryRulesWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}