{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ebc4e534-7a4a-41be-b365-ddcd4f564090", "version": "KqlParameterItem/1.0", "name": "time_range", "label": "Time Range", "type": 4, "description": "As a time filter", "isGlobal": true, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "ced5d7b4-3302-4479-bee9-563947af3a5d", "version": "KqlParameterItem/1.0", "name": "Illumio_PCE", "label": "Illumio PCE", "type": 2, "description": "Select the Illumio PCE from which you want to see events for", "isRequired": true, "isGlobal": true, "query": "Illumio_Flow_Events_CL\n| project pce_fqdn, table = \"Illumio_Flow_Events_CL\"\n| union (\n IllumioSyslogAuditEvents\n | project pce_fqdn, table = \"IllumioSyslogAuditEvents\"\n)\n| union (\n print pce_fqdn = 'No PCE', table = 'Illumio_Flow_Events_CL'\n)\n| distinct table, pce_fqdn", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "Illumio_Flow_Events_CL" }, { "id": "01dea62f-0a96-4799-ad15-4410632e9665", "version": "KqlParameterItem/1.0", "name": "TableToSearchFrom", "type": 1, "description": "use Illumio_PCE to define what table to fetch events from", "isGlobal": true, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "{Illumio_PCE:value}" } } ] }, { "id": "eb392fcd-b6ea-4c7f-86d6-fc4053e65632", "version": "KqlParameterItem/1.0", "name": "port_scan_threshold", "label": "Port Scan Threshold", "type": 1, "description": "A port scan event is accounted for when a traffic flow with unique (src, dst, network) is observed for any destination port", "value": "2" }, { "id": "1c8b3527-5c77-4f1e-93d6-aeb1b39d8dd9", "version": "KqlParameterItem/1.0", "name": "allowed_ips", "label": "Allowed IPs", "type": 2, "description": "Exclude source ips from port scan counts", "multiSelect": true, "quote": "", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize by src_ip", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 1800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Port Scan Events", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\nlet port_scan_threshold_param = toint(coalesce('{port_scan_threshold}', '2')); // 2 is a default\nlet allowed_ips_param = '{allowed_ips}';\n//print port_scan_threshold_param, table_to_search_from, allowed_ips_param\ntable(table_to_search_from)\n| where dir == 'I' and TimeGenerated between ({time_range:start}..{time_range:end})\n| summarize distinct_ports = dcount(dst_port) by src_ip, dst_ip, network, TimeGenerated\n| summarize ports_scanned = sum(distinct_ports) by bin(TimeGenerated, 60s)\n| where ports_scanned > port_scan_threshold_param\n| summarize count()\n\n", "size": 3, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize count() by bin(TimeGenerated, 1h)", "size": 0, "title": "Traffic every hour", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "showLegend": true, "showDataPoints": true, "xSettings": { "label": "Time" }, "ySettings": { "label": "Traffic Connections" } } }, "name": "traffic-every-hour" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Trafficked Workload Stats", "items": [ { "type": 1, "content": { "json": "#### Enter the number of workloads for which the inbound and outbound connections are to be fetched. These workloads will be ordered by connection count. ", "style": "info" }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0dead08f-24f5-40b3-a011-a59e007a8e70", "version": "KqlParameterItem/1.0", "name": "workload_count", "label": "Workload Count", "type": 1, "description": "Provide an integer that denotes the limit for retrieving most trafficked workloads", "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": 5, \\\"label\\\": 5, \\\"selected\\\": true}\"}\n", "timeContext": { "durationMs": 86400000 }, "queryType": 8, "value": "10" } ], "style": "pills", "queryType": 8 }, "name": "parameters - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let workload_count = {workload_count};\nlet table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| extend hostname = coalesce(src_hostname, dst_hostname)\n| summarize Count = count() by hostname, dir\n| summarize InboundCount = sum(iff(dir == \"I\", Count, 0)), OutboundCount = sum(iff(dir == \"O\", Count, 0)) by hostname\n| top workload_count by hostname\n", "size": 0, "title": "Most Trafficked Workloads", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "workload", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "hostname", "showLegend": true, "xSettings": { "label": "Workloads" }, "ySettings": { "label": "Traffic Connections" } } }, "name": "Most Trafficked Workloads" } ] }, "name": "MostTraffickedWorkload" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Traffic Explorer", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Filters for querying traffic data", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "## Traffic Explorer\n### Please enter source ip, destination ip, destination port, protocol, time range to filter traffic records. \n### All records are returned unless provided.\n", "style": "info" }, "name": "text - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8ab7ce90-16a6-4e7e-85b7-292234a9d3c1", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 2, "description": "Select source ip", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize by src_ip", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "24f11ee0-0b0b-4c79-918b-01df57233aa2", "version": "KqlParameterItem/1.0", "name": "dst_ip", "label": "Destination IP", "type": 2, "description": "Select destination ips", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize by dst_ip", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "eb9fe16e-be04-479d-9389-0095c2b43d50", "version": "KqlParameterItem/1.0", "name": "dst_port", "label": "Destination Port", "type": 2, "description": "Select destination port", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize by dst_port", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "416ab303-c10f-47c1-9f01-7c1324699b49", "version": "KqlParameterItem/1.0", "name": "protocol", "label": "Protocol", "type": 2, "description": "Protocol for fetching traffic records. For multiple, use comma as delimiter like 6,17", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize by proto\n| extend protocolName = case(\n proto == -1, \"all\",\n proto == 0, \"hopopt\",\n proto == 1, \"icmp\",\n proto == 2, \"igmp\",\n proto == 3, \"ggp\",\n proto == 4, \"ipv4\",\n proto == 5, \"st\",\n proto == 6, \"tcp\",\n proto == 7, \"cbt\",\n proto == 8, \"egp\",\n proto == 9, \"igp\",\n proto == 10, \"bbn-rcc-mon\",\n proto == 11, \"nvp-ii\",\n proto == 12, \"pup\",\n proto == 13, \"argus\",\n proto == 14, \"emcon\",\n proto == 15, \"xnet\",\n proto == 16, \"chaos\",\n proto == 17, \"udp\",\n proto == 18, \"mux\",\n proto == 19, \"dcn-meas\",\n proto == 20, \"hmp\",\n proto == 21, \"prm\",\n proto == 22, \"xns-idp\",\n proto == 23, \"trunk-1\",\n proto == 24, \"trunk-2\",\n proto == 25, \"leaf-1\",\n proto == 26, \"leaf-2\",\n proto == 27, \"rdp\",\n proto == 28, \"irtp\",\n proto == 29, \"iso-tp4\",\n proto == 30, \"netblt\",\n proto == 31, \"mfe-nsp\",\n proto == 32, \"merit-inp\",\n proto == 33, \"dccp\",\n proto == 34, \"3pc\",\n proto == 35, \"idpr\",\n proto == 36, \"xtp\",\n proto == 37, \"ddp\",\n proto == 38, \"idpr-cmtp\",\n proto == 39, \"tp++\",\n proto == 40, \"il\",\n proto == 41, \"ipv6\",\n proto == 42, \"sdrp\",\n proto == 43, \"ipv6-route\",\n proto == 44, \"ipv6-frag\",\n proto == 45, \"idrp\",\n proto == 46, \"rsvp\",\n proto == 47, \"gre\",\n proto == 48, \"dsr\",\n proto == 49, \"bna\",\n proto == 50, \"esp\",\n proto == 51, \"ah\",\n proto == 52, \"i-nlsp\",\n proto == 53, \"swipe\",\n proto == 54, \"narp\",\n proto == 55, \"mobile\",\n proto == 56, \"tlsp\",\n proto == 57, \"skip\",\n proto == 58, \"ipv6-icmp\",\n proto == 59, \"ipv6-nonxt\",\n proto == 60, \"ipv6-opts\",\n proto == 62, \"cftp\",\n proto == 64, \"sat-expak\",\n proto == 65, \"kryptolan\",\n proto == 66, \"rvd\",\n proto == 67, \"ippc\",\n proto == 69, \"sat-mon\",\n proto == 70, \"visa\",\n proto == 71, \"ipcv\",\n proto == 72, \"cpnx\",\n proto == 73, \"cphb\",\n proto == 74, \"wsn\",\n proto == 75, \"pvp\",\n proto == 76, \"br-sat-mon\",\n proto == 77, \"sun-nd\",\n proto == 78, \"wb-mon\",\n proto == 79, \"wb-expak\",\n proto == 80, \"iso-ip\",\n proto == 81, \"vmtp\",\n proto == 82, \"secure-vmtp\",\n proto == 83, \"vines\",\n proto == 84, \"iptm\",\n proto == 85, \"nsfnet-igp\",\n proto == 86, \"dgp\",\n proto == 87, \"tcf\",\n proto == 88, \"eigrp\",\n proto == 89, \"ospfigp\",\n proto == 90, \"sprite-rpc\",\n proto == 91, \"larp\",\n proto == 92, \"mtp\",\n proto == 93, \"ax.25\",\n proto == 94, \"ipip\",\n proto == 95, \"micp\",\n proto == 96, \"scc-sp\",\n proto == 97, \"etherip\",\n proto == 98, \"encap\",\n proto == 100, \"gmtp\",\n proto == 101, \"ifmp\",\n proto == 102, \"pnni\",\n proto == 103, \"pim\",\n proto == 104, \"aris\",\n proto == 105, \"scps\",\n proto == 106, \"qnx\",\n proto == 107, \"a/n\",\n proto == 108, \"ipcomp\",\n proto == 109, \"snp\",\n proto == 110, \"compaq-peer\",\n proto == 111, \"ipx-in-ip\",\n proto == 112, \"vrrp\",\n proto == 113, \"pgm\",\n proto == 115, \"l2tp\",\n proto == 116, \"ddx\",\n proto == 117, \"iatp\",\n proto == 118, \"stp\",\n proto == 119, \"srp\",\n proto == 120, \"uti\",\n proto == 121, \"smp\",\n proto == 122, \"sm\",\n proto == 123, \"ptp\",\n proto == 124, \"isis over ipv4\",\n proto == 125, \"fire\",\n proto == 126, \"crtp\",\n proto == 127, \"crudp\",\n proto == 128, \"sscopmce\",\n proto == 129, \"iplt\",\n proto == 130, \"sps\",\n proto == 131, \"pipe\",\n proto == 132, \"sctp\",\n proto == 133, \"fc\",\n proto == 134, \"rsvp-e2e-ignore\",\n proto == 135, \"mobility header\",\n proto == 136, \"udplite\",\n proto == 137, \"mpls-in-ip\",\n proto == 138, \"manet\",\n proto == 139, \"hip\",\n proto == 140, \"shim6\",\n proto == 141, \"wesp\",\n proto == 142, \"rohc\",\n proto == 143, \"ethernet\",\n proto == 144, \"aggfrag\",\n proto == 145, \"nsh\",\n proto >= 146 and proto <= 252, \"unknown\",\n proto == 253, \"unknown\",\n proto == 254, \"unknown\",\n proto == 255, \"reserved\",\n \"unknown\"\n)\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f07c08c2-ff0f-42a7-adc6-4fd5d7f1cb19", "version": "KqlParameterItem/1.0", "name": "src_label", "label": "Source Label", "type": 2, "description": "Filter for source labels", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where src_labels != ''\n| extend parsed_labels = parse_json(src_labels)\n| mv-expand kind=array parsed_labels\n| extend src_label=tostring(parsed_labels[1])\n| summarize by src_label", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "9d5cb77f-31a5-41ed-8849-aaee2b513f54", "version": "KqlParameterItem/1.0", "name": "dst_label", "label": "Destination Label", "type": 2, "description": "Filter for destination label", "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where dst_labels != ''\n| extend parsed_labels = parse_json(dst_labels)\n| mv-expand kind=array parsed_labels\n| extend dst_label=tostring(parsed_labels[1])\n| summarize by dst_label", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "formHorizontal", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "all_traffic_params", "styleSettings": { "maxWidth": "30" } } ], "exportParameters": true }, "name": "parameters_group" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol})) \n| extend policy_decision = \n case(pd == 0, \"Allowed\",\n pd == 1, \"Potentially Blocked\",\n pd == 2, \"Blocked\",\n \"Unknown\")\n| summarize count() by policy_decision\n", "size": 2, "title": "Flow count by policy decision", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Potentially Blocked", "color": "yellow" }, { "seriesName": "Allowed", "color": "green" }, { "seriesName": "Blocked", "color": "red" }, { "seriesName": "Unknown", "color": "gray" } ] } }, "customWidth": "50", "name": "Flow count by policy decision", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nlet table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\n| extend class_type = \n case(class == 'B', 'Broadcast',\n class == 'M', 'Multicast',\n class == 'U', \"Unicast\",\n \"Unknown\")\n| summarize count() by class_type\n", "size": 2, "title": "Flows by class", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "Flows by class", "styleSettings": { "maxWidth": "50" } }, { "type": 1, "content": { "json": "### A service is indicated with a destination port and protocol, represented in the below graph as \"destination_port/protocol\"", "style": "info" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\n| extend protocolName = case(\n proto == -1, \"all\",\n proto == 0, \"hopopt\",\n proto == 1, \"icmp\",\n proto == 2, \"igmp\",\n proto == 3, \"ggp\",\n proto == 4, \"ipv4\",\n proto == 5, \"st\",\n proto == 6, \"tcp\",\n proto == 7, \"cbt\",\n proto == 8, \"egp\",\n proto == 9, \"igp\",\n proto == 10, \"bbn-rcc-mon\",\n proto == 11, \"nvp-ii\",\n proto == 12, \"pup\",\n proto == 13, \"argus\",\n proto == 14, \"emcon\",\n proto == 15, \"xnet\",\n proto == 16, \"chaos\",\n proto == 17, \"udp\",\n proto == 18, \"mux\",\n proto == 19, \"dcn-meas\",\n proto == 20, \"hmp\",\n proto == 21, \"prm\",\n proto == 22, \"xns-idp\",\n proto == 23, \"trunk-1\",\n proto == 24, \"trunk-2\",\n proto == 25, \"leaf-1\",\n proto == 26, \"leaf-2\",\n proto == 27, \"rdp\",\n proto == 28, \"irtp\",\n proto == 29, \"iso-tp4\",\n proto == 30, \"netblt\",\n proto == 31, \"mfe-nsp\",\n proto == 32, \"merit-inp\",\n proto == 33, \"dccp\",\n proto == 34, \"3pc\",\n proto == 35, \"idpr\",\n proto == 36, \"xtp\",\n proto == 37, \"ddp\",\n proto == 38, \"idpr-cmtp\",\n proto == 39, \"tp++\",\n proto == 40, \"il\",\n proto == 41, \"ipv6\",\n proto == 42, \"sdrp\",\n proto == 43, \"ipv6-route\",\n proto == 44, \"ipv6-frag\",\n proto == 45, \"idrp\",\n proto == 46, \"rsvp\",\n proto == 47, \"gre\",\n proto == 48, \"dsr\",\n proto == 49, \"bna\",\n proto == 50, \"esp\",\n proto == 51, \"ah\",\n proto == 52, \"i-nlsp\",\n proto == 53, \"swipe\",\n proto == 54, \"narp\",\n proto == 55, \"mobile\",\n proto == 56, \"tlsp\",\n proto == 57, \"skip\",\n proto == 58, \"ipv6-icmp\",\n proto == 59, \"ipv6-nonxt\",\n proto == 60, \"ipv6-opts\",\n proto == 62, \"cftp\",\n proto == 64, \"sat-expak\",\n proto == 65, \"kryptolan\",\n proto == 66, \"rvd\",\n proto == 67, \"ippc\",\n proto == 69, \"sat-mon\",\n proto == 70, \"visa\",\n proto == 71, \"ipcv\",\n proto == 72, \"cpnx\",\n proto == 73, \"cphb\",\n proto == 74, \"wsn\",\n proto == 75, \"pvp\",\n proto == 76, \"br-sat-mon\",\n proto == 77, \"sun-nd\",\n proto == 78, \"wb-mon\",\n proto == 79, \"wb-expak\",\n proto == 80, \"iso-ip\",\n proto == 81, \"vmtp\",\n proto == 82, \"secure-vmtp\",\n proto == 83, \"vines\",\n proto == 84, \"iptm\",\n proto == 85, \"nsfnet-igp\",\n proto == 86, \"dgp\",\n proto == 87, \"tcf\",\n proto == 88, \"eigrp\",\n proto == 89, \"ospfigp\",\n proto == 90, \"sprite-rpc\",\n proto == 91, \"larp\",\n proto == 92, \"mtp\",\n proto == 93, \"ax.25\",\n proto == 94, \"ipip\",\n proto == 95, \"micp\",\n proto == 96, \"scc-sp\",\n proto == 97, \"etherip\",\n proto == 98, \"encap\",\n proto == 100, \"gmtp\",\n proto == 101, \"ifmp\",\n proto == 102, \"pnni\",\n proto == 103, \"pim\",\n proto == 104, \"aris\",\n proto == 105, \"scps\",\n proto == 106, \"qnx\",\n proto == 107, \"a/n\",\n proto == 108, \"ipcomp\",\n proto == 109, \"snp\",\n proto == 110, \"compaq-peer\",\n proto == 111, \"ipx-in-ip\",\n proto == 112, \"vrrp\",\n proto == 113, \"pgm\",\n proto == 115, \"l2tp\",\n proto == 116, \"ddx\",\n proto == 117, \"iatp\",\n proto == 118, \"stp\",\n proto == 119, \"srp\",\n proto == 120, \"uti\",\n proto == 121, \"smp\",\n proto == 122, \"sm\",\n proto == 123, \"ptp\",\n proto == 124, \"isis over ipv4\",\n proto == 125, \"fire\",\n proto == 126, \"crtp\",\n proto == 127, \"crudp\",\n proto == 128, \"sscopmce\",\n proto == 129, \"iplt\",\n proto == 130, \"sps\",\n proto == 131, \"pipe\",\n proto == 132, \"sctp\",\n proto == 133, \"fc\",\n proto == 134, \"rsvp-e2e-ignore\",\n proto == 135, \"mobility header\",\n proto == 136, \"udplite\",\n proto == 137, \"mpls-in-ip\",\n proto == 138, \"manet\",\n proto == 139, \"hip\",\n proto == 140, \"shim6\",\n proto == 141, \"wesp\",\n proto == 142, \"rohc\",\n proto == 143, \"ethernet\",\n proto == 144, \"aggfrag\",\n proto == 145, \"nsh\",\n proto >= 146 and proto <= 252, \"unknown\",\n proto == 253, \"unknown\",\n proto == 254, \"unknown\",\n proto == 255, \"reserved\",\n \"unknown\"\n)\n| extend service = strcat(dst_port, '/', protocolName)\n| summarize service_count = count() by service\n| top 5 by service_count\n", "size": 0, "title": "Top 5 Services by Flow Count", "color": "blue", "noDataMessage": "No services found", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "service", "yAxis": [ "service_count" ], "xSettings": { "label": "Destination Service" }, "ySettings": { "label": "Count" } } }, "name": "Top 5 Services by Flow Count" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where pd == 2 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\n| extend protocol = case(\n proto == -1, \"all\",\n proto == 0, \"hopopt\",\n proto == 1, \"icmp\",\n proto == 2, \"igmp\",\n proto == 3, \"ggp\",\n proto == 4, \"ipv4\",\n proto == 5, \"st\",\n proto == 6, \"tcp\",\n proto == 7, \"cbt\",\n proto == 8, \"egp\",\n proto == 9, \"igp\",\n proto == 10, \"bbn-rcc-mon\",\n proto == 11, \"nvp-ii\",\n proto == 12, \"pup\",\n proto == 13, \"argus\",\n proto == 14, \"emcon\",\n proto == 15, \"xnet\",\n proto == 16, \"chaos\",\n proto == 17, \"udp\",\n proto == 18, \"mux\",\n proto == 19, \"dcn-meas\",\n proto == 20, \"hmp\",\n proto == 21, \"prm\",\n proto == 22, \"xns-idp\",\n proto == 23, \"trunk-1\",\n proto == 24, \"trunk-2\",\n proto == 25, \"leaf-1\",\n proto == 26, \"leaf-2\",\n proto == 27, \"rdp\",\n proto == 28, \"irtp\",\n proto == 29, \"iso-tp4\",\n proto == 30, \"netblt\",\n proto == 31, \"mfe-nsp\",\n proto == 32, \"merit-inp\",\n proto == 33, \"dccp\",\n proto == 34, \"3pc\",\n proto == 35, \"idpr\",\n proto == 36, \"xtp\",\n proto == 37, \"ddp\",\n proto == 38, \"idpr-cmtp\",\n proto == 39, \"tp++\",\n proto == 40, \"il\",\n proto == 41, \"ipv6\",\n proto == 42, \"sdrp\",\n proto == 43, \"ipv6-route\",\n proto == 44, \"ipv6-frag\",\n proto == 45, \"idrp\",\n proto == 46, \"rsvp\",\n proto == 47, \"gre\",\n proto == 48, \"dsr\",\n proto == 49, \"bna\",\n proto == 50, \"esp\",\n proto == 51, \"ah\",\n proto == 52, \"i-nlsp\",\n proto == 53, \"swipe\",\n proto == 54, \"narp\",\n proto == 55, \"mobile\",\n proto == 56, \"tlsp\",\n proto == 57, \"skip\",\n proto == 58, \"ipv6-icmp\",\n proto == 59, \"ipv6-nonxt\",\n proto == 60, \"ipv6-opts\",\n proto == 62, \"cftp\",\n proto == 64, \"sat-expak\",\n proto == 65, \"kryptolan\",\n proto == 66, \"rvd\",\n proto == 67, \"ippc\",\n proto == 69, \"sat-mon\",\n proto == 70, \"visa\",\n proto == 71, \"ipcv\",\n proto == 72, \"cpnx\",\n proto == 73, \"cphb\",\n proto == 74, \"wsn\",\n proto == 75, \"pvp\",\n proto == 76, \"br-sat-mon\",\n proto == 77, \"sun-nd\",\n proto == 78, \"wb-mon\",\n proto == 79, \"wb-expak\",\n proto == 80, \"iso-ip\",\n proto == 81, \"vmtp\",\n proto == 82, \"secure-vmtp\",\n proto == 83, \"vines\",\n proto == 84, \"iptm\",\n proto == 85, \"nsfnet-igp\",\n proto == 86, \"dgp\",\n proto == 87, \"tcf\",\n proto == 88, \"eigrp\",\n proto == 89, \"ospfigp\",\n proto == 90, \"sprite-rpc\",\n proto == 91, \"larp\",\n proto == 92, \"mtp\",\n proto == 93, \"ax.25\",\n proto == 94, \"ipip\",\n proto == 95, \"micp\",\n proto == 96, \"scc-sp\",\n proto == 97, \"etherip\",\n proto == 98, \"encap\",\n proto == 100, \"gmtp\",\n proto == 101, \"ifmp\",\n proto == 102, \"pnni\",\n proto == 103, \"pim\",\n proto == 104, \"aris\",\n proto == 105, \"scps\",\n proto == 106, \"qnx\",\n proto == 107, \"a/n\",\n proto == 108, \"ipcomp\",\n proto == 109, \"snp\",\n proto == 110, \"compaq-peer\",\n proto == 111, \"ipx-in-ip\",\n proto == 112, \"vrrp\",\n proto == 113, \"pgm\",\n proto == 115, \"l2tp\",\n proto == 116, \"ddx\",\n proto == 117, \"iatp\",\n proto == 118, \"stp\",\n proto == 119, \"srp\",\n proto == 120, \"uti\",\n proto == 121, \"smp\",\n proto == 122, \"sm\",\n proto == 123, \"ptp\",\n proto == 124, \"isis over ipv4\",\n proto == 125, \"fire\",\n proto == 126, \"crtp\",\n proto == 127, \"crudp\",\n proto == 128, \"sscopmce\",\n proto == 129, \"iplt\",\n proto == 130, \"sps\",\n proto == 131, \"pipe\",\n proto == 132, \"sctp\",\n proto == 133, \"fc\",\n proto == 134, \"rsvp-e2e-ignore\",\n proto == 135, \"mobility header\",\n proto == 136, \"udplite\",\n proto == 137, \"mpls-in-ip\",\n proto == 138, \"manet\",\n proto == 139, \"hip\",\n proto == 140, \"shim6\",\n proto == 141, \"wesp\",\n proto == 142, \"rohc\",\n proto == 143, \"ethernet\",\n proto == 144, \"aggfrag\",\n proto == 145, \"nsh\",\n proto >= 146 and proto <= 252, \"unknown\",\n proto == 253, \"unknown\",\n proto == 254, \"unknown\",\n proto == 255, \"reserved\",\n \"unknown\"\n)\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\n\n", "size": 0, "title": "Blocked Traffic", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Blocked Traffic" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where pd == 1 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\n| extend protocol = case(\n proto == -1, \"all\",\n proto == 0, \"hopopt\",\n proto == 1, \"icmp\",\n proto == 2, \"igmp\",\n proto == 3, \"ggp\",\n proto == 4, \"ipv4\",\n proto == 5, \"st\",\n proto == 6, \"tcp\",\n proto == 7, \"cbt\",\n proto == 8, \"egp\",\n proto == 9, \"igp\",\n proto == 10, \"bbn-rcc-mon\",\n proto == 11, \"nvp-ii\",\n proto == 12, \"pup\",\n proto == 13, \"argus\",\n proto == 14, \"emcon\",\n proto == 15, \"xnet\",\n proto == 16, \"chaos\",\n proto == 17, \"udp\",\n proto == 18, \"mux\",\n proto == 19, \"dcn-meas\",\n proto == 20, \"hmp\",\n proto == 21, \"prm\",\n proto == 22, \"xns-idp\",\n proto == 23, \"trunk-1\",\n proto == 24, \"trunk-2\",\n proto == 25, \"leaf-1\",\n proto == 26, \"leaf-2\",\n proto == 27, \"rdp\",\n proto == 28, \"irtp\",\n proto == 29, \"iso-tp4\",\n proto == 30, \"netblt\",\n proto == 31, \"mfe-nsp\",\n proto == 32, \"merit-inp\",\n proto == 33, \"dccp\",\n proto == 34, \"3pc\",\n proto == 35, \"idpr\",\n proto == 36, \"xtp\",\n proto == 37, \"ddp\",\n proto == 38, \"idpr-cmtp\",\n proto == 39, \"tp++\",\n proto == 40, \"il\",\n proto == 41, \"ipv6\",\n proto == 42, \"sdrp\",\n proto == 43, \"ipv6-route\",\n proto == 44, \"ipv6-frag\",\n proto == 45, \"idrp\",\n proto == 46, \"rsvp\",\n proto == 47, \"gre\",\n proto == 48, \"dsr\",\n proto == 49, \"bna\",\n proto == 50, \"esp\",\n proto == 51, \"ah\",\n proto == 52, \"i-nlsp\",\n proto == 53, \"swipe\",\n proto == 54, \"narp\",\n proto == 55, \"mobile\",\n proto == 56, \"tlsp\",\n proto == 57, \"skip\",\n proto == 58, \"ipv6-icmp\",\n proto == 59, \"ipv6-nonxt\",\n proto == 60, \"ipv6-opts\",\n proto == 62, \"cftp\",\n proto == 64, \"sat-expak\",\n proto == 65, \"kryptolan\",\n proto == 66, \"rvd\",\n proto == 67, \"ippc\",\n proto == 69, \"sat-mon\",\n proto == 70, \"visa\",\n proto == 71, \"ipcv\",\n proto == 72, \"cpnx\",\n proto == 73, \"cphb\",\n proto == 74, \"wsn\",\n proto == 75, \"pvp\",\n proto == 76, \"br-sat-mon\",\n proto == 77, \"sun-nd\",\n proto == 78, \"wb-mon\",\n proto == 79, \"wb-expak\",\n proto == 80, \"iso-ip\",\n proto == 81, \"vmtp\",\n proto == 82, \"secure-vmtp\",\n proto == 83, \"vines\",\n proto == 84, \"iptm\",\n proto == 85, \"nsfnet-igp\",\n proto == 86, \"dgp\",\n proto == 87, \"tcf\",\n proto == 88, \"eigrp\",\n proto == 89, \"ospfigp\",\n proto == 90, \"sprite-rpc\",\n proto == 91, \"larp\",\n proto == 92, \"mtp\",\n proto == 93, \"ax.25\",\n proto == 94, \"ipip\",\n proto == 95, \"micp\",\n proto == 96, \"scc-sp\",\n proto == 97, \"etherip\",\n proto == 98, \"encap\",\n proto == 100, \"gmtp\",\n proto == 101, \"ifmp\",\n proto == 102, \"pnni\",\n proto == 103, \"pim\",\n proto == 104, \"aris\",\n proto == 105, \"scps\",\n proto == 106, \"qnx\",\n proto == 107, \"a/n\",\n proto == 108, \"ipcomp\",\n proto == 109, \"snp\",\n proto == 110, \"compaq-peer\",\n proto == 111, \"ipx-in-ip\",\n proto == 112, \"vrrp\",\n proto == 113, \"pgm\",\n proto == 115, \"l2tp\",\n proto == 116, \"ddx\",\n proto == 117, \"iatp\",\n proto == 118, \"stp\",\n proto == 119, \"srp\",\n proto == 120, \"uti\",\n proto == 121, \"smp\",\n proto == 122, \"sm\",\n proto == 123, \"ptp\",\n proto == 124, \"isis over ipv4\",\n proto == 125, \"fire\",\n proto == 126, \"crtp\",\n proto == 127, \"crudp\",\n proto == 128, \"sscopmce\",\n proto == 129, \"iplt\",\n proto == 130, \"sps\",\n proto == 131, \"pipe\",\n proto == 132, \"sctp\",\n proto == 133, \"fc\",\n proto == 134, \"rsvp-e2e-ignore\",\n proto == 135, \"mobility header\",\n proto == 136, \"udplite\",\n proto == 137, \"mpls-in-ip\",\n proto == 138, \"manet\",\n proto == 139, \"hip\",\n proto == 140, \"shim6\",\n proto == 141, \"wesp\",\n proto == 142, \"rohc\",\n proto == 143, \"ethernet\",\n proto == 144, \"aggfrag\",\n proto == 145, \"nsh\",\n proto >= 146 and proto <= 252, \"unknown\",\n proto == 253, \"unknown\",\n proto == 254, \"unknown\",\n proto == 255, \"reserved\",\n \"unknown\"\n)\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\n\n", "size": 0, "title": "Potentially blocked traffic", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Potentially blocked traffic" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where pd == 0 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\n| extend protocol = case(\n proto == -1, \"all\",\n proto == 0, \"hopopt\",\n proto == 1, \"icmp\",\n proto == 2, \"igmp\",\n proto == 3, \"ggp\",\n proto == 4, \"ipv4\",\n proto == 5, \"st\",\n proto == 6, \"tcp\",\n proto == 7, \"cbt\",\n proto == 8, \"egp\",\n proto == 9, \"igp\",\n proto == 10, \"bbn-rcc-mon\",\n proto == 11, \"nvp-ii\",\n proto == 12, \"pup\",\n proto == 13, \"argus\",\n proto == 14, \"emcon\",\n proto == 15, \"xnet\",\n proto == 16, \"chaos\",\n proto == 17, \"udp\",\n proto == 18, \"mux\",\n proto == 19, \"dcn-meas\",\n proto == 20, \"hmp\",\n proto == 21, \"prm\",\n proto == 22, \"xns-idp\",\n proto == 23, \"trunk-1\",\n proto == 24, \"trunk-2\",\n proto == 25, \"leaf-1\",\n proto == 26, \"leaf-2\",\n proto == 27, \"rdp\",\n proto == 28, \"irtp\",\n proto == 29, \"iso-tp4\",\n proto == 30, \"netblt\",\n proto == 31, \"mfe-nsp\",\n proto == 32, \"merit-inp\",\n proto == 33, \"dccp\",\n proto == 34, \"3pc\",\n proto == 35, \"idpr\",\n proto == 36, \"xtp\",\n proto == 37, \"ddp\",\n proto == 38, \"idpr-cmtp\",\n proto == 39, \"tp++\",\n proto == 40, \"il\",\n proto == 41, \"ipv6\",\n proto == 42, \"sdrp\",\n proto == 43, \"ipv6-route\",\n proto == 44, \"ipv6-frag\",\n proto == 45, \"idrp\",\n proto == 46, \"rsvp\",\n proto == 47, \"gre\",\n proto == 48, \"dsr\",\n proto == 49, \"bna\",\n proto == 50, \"esp\",\n proto == 51, \"ah\",\n proto == 52, \"i-nlsp\",\n proto == 53, \"swipe\",\n proto == 54, \"narp\",\n proto == 55, \"mobile\",\n proto == 56, \"tlsp\",\n proto == 57, \"skip\",\n proto == 58, \"ipv6-icmp\",\n proto == 59, \"ipv6-nonxt\",\n proto == 60, \"ipv6-opts\",\n proto == 62, \"cftp\",\n proto == 64, \"sat-expak\",\n proto == 65, \"kryptolan\",\n proto == 66, \"rvd\",\n proto == 67, \"ippc\",\n proto == 69, \"sat-mon\",\n proto == 70, \"visa\",\n proto == 71, \"ipcv\",\n proto == 72, \"cpnx\",\n proto == 73, \"cphb\",\n proto == 74, \"wsn\",\n proto == 75, \"pvp\",\n proto == 76, \"br-sat-mon\",\n proto == 77, \"sun-nd\",\n proto == 78, \"wb-mon\",\n proto == 79, \"wb-expak\",\n proto == 80, \"iso-ip\",\n proto == 81, \"vmtp\",\n proto == 82, \"secure-vmtp\",\n proto == 83, \"vines\",\n proto == 84, \"iptm\",\n proto == 85, \"nsfnet-igp\",\n proto == 86, \"dgp\",\n proto == 87, \"tcf\",\n proto == 88, \"eigrp\",\n proto == 89, \"ospfigp\",\n proto == 90, \"sprite-rpc\",\n proto == 91, \"larp\",\n proto == 92, \"mtp\",\n proto == 93, \"ax.25\",\n proto == 94, \"ipip\",\n proto == 95, \"micp\",\n proto == 96, \"scc-sp\",\n proto == 97, \"etherip\",\n proto == 98, \"encap\",\n proto == 100, \"gmtp\",\n proto == 101, \"ifmp\",\n proto == 102, \"pnni\",\n proto == 103, \"pim\",\n proto == 104, \"aris\",\n proto == 105, \"scps\",\n proto == 106, \"qnx\",\n proto == 107, \"a/n\",\n proto == 108, \"ipcomp\",\n proto == 109, \"snp\",\n proto == 110, \"compaq-peer\",\n proto == 111, \"ipx-in-ip\",\n proto == 112, \"vrrp\",\n proto == 113, \"pgm\",\n proto == 115, \"l2tp\",\n proto == 116, \"ddx\",\n proto == 117, \"iatp\",\n proto == 118, \"stp\",\n proto == 119, \"srp\",\n proto == 120, \"uti\",\n proto == 121, \"smp\",\n proto == 122, \"sm\",\n proto == 123, \"ptp\",\n proto == 124, \"isis over ipv4\",\n proto == 125, \"fire\",\n proto == 126, \"crtp\",\n proto == 127, \"crudp\",\n proto == 128, \"sscopmce\",\n proto == 129, \"iplt\",\n proto == 130, \"sps\",\n proto == 131, \"pipe\",\n proto == 132, \"sctp\",\n proto == 133, \"fc\",\n proto == 134, \"rsvp-e2e-ignore\",\n proto == 135, \"mobility header\",\n proto == 136, \"udplite\",\n proto == 137, \"mpls-in-ip\",\n proto == 138, \"manet\",\n proto == 139, \"hip\",\n proto == 140, \"shim6\",\n proto == 141, \"wesp\",\n proto == 142, \"rohc\",\n proto == 143, \"ethernet\",\n proto == 144, \"aggfrag\",\n proto == 145, \"nsh\",\n proto >= 146 and proto <= 252, \"unknown\",\n proto == 253, \"unknown\",\n proto == 254, \"unknown\",\n proto == 255, \"reserved\",\n \"unknown\"\n)\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\n", "size": 0, "title": "Allowed traffic", "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Allowed traffic" } ] }, "name": "Traffic Explorer" } ], "fromTemplateId": "sentinel-FlowDataWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }