{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## FortiNDR Cloud workbook\n---\n>**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Fortinet%20FortiNDR%20Cloud/Parsers/Fortinet_FortiNDR_Cloud.md) to create the Kusto function alias **Fortinet_FortiNDR_Cloud**." }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "29a65c20-978d-447b-b11c-f437f6c7fd7e", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "FortiNDR Cloud Main Dashboard", "subTarget": "Main", "style": "link" }, { "id": "514047f6-4d61-4f59-9f79-6c22c20645c0", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "FortiNDR Cloud Suricata Dashboard", "subTarget": "Suricata", "style": "link" }, { "id": "f20fabf1-3a44-417d-9e97-3d62d1990c8d", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "FortiNDR Cloud Observation Dashboard", "subTarget": "Observation", "style": "link" }, { "id": "392a41e1-a18c-4a6d-8144-c51e27a8bf4e", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "FortiNDR Cloud Detection Dashboard", "subTarget": "Detection", "style": "link" } ] }, "name": "links - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "50650aa0-d12f-49ad-ba0d-e7a6a10b0a85", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| where su_timestamp between ({TimeRange:start} .. {TimeRange:end})\n| summarize Count=count() by su_sig_category", "size": 0, "showAnalytics": true, "title": "Suricata Counts By Category", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "main-Suricata" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsObservation_CL'\n| where ob_timestamp between ({TimeRange:start} .. {TimeRange:end})\n| summarize Count=count() by ob_observation_title", "size": 0, "showAnalytics": true, "title": "Observation Counts by Title", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "main-observation" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| where de_created between ({TimeRange:start} .. {TimeRange:end})\n| summarize Count = count() by de_severity", "size": 0, "showAnalytics": true, "title": "Detection Counts by Severity", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "main-detections-s" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| where de_created between ({TimeRange:start} .. {TimeRange:end})\n| summarize Count = count() by de_confidence", "size": 0, "showAnalytics": true, "title": "Detection Counts by Confidence", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "main-detections-s - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Main" }, "name": "Main Dashboard" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**FortiDNR Cloud Suricata Chart:**" }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7b566fdf-c574-466d-8a25-eec9e314f560", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" }, { "id": "0ce88674-9bf5-4c52-8286-28d3cf030e18", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| summarize by su_sig_category\n| where isnotempty(su_sig_category)\n| order by su_sig_category asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Signature Category" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3", "styleSettings": { "padding": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| where su_timestamp between ({TimeRange:start} .. {TimeRange:end})\n| where isempty('{Category}') or (su_sig_category == '{Category}')\n| summarize Count=count() by su_sig_category, bin(su_timestamp, 1d)", "size": 0, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "name": "query - 2" }, { "type": 1, "content": { "json": "**FortiDNR Cloud Suricata List:**" }, "name": "text - 4 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5d5a54f3-6fca-4368-aea2-a2d0326daa62", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" }, { "id": "03cace3a-c0d6-4184-a1aa-346c67578b6b", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| summarize by su_sig_category\n| where isnotempty(su_sig_category)\n| order by su_sig_category asc", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Signature Category" }, { "id": "0eea038f-b090-4021-9998-3b85c1abe20b", "version": "KqlParameterItem/1.0", "name": "Name", "label": "Signature Name", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| summarize by su_sig_name\n| where isnotempty(su_sig_name)\n| order by su_sig_name asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "d60df3de-0e80-4f12-8234-bb8a4ea27cfb", "version": "KqlParameterItem/1.0", "name": "SensorID", "label": "Sensor ID", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL' or Type == 'FncEventsObservation_CL' or Type == 'FncEventsDetections_CL'\n| extend CombinedSensor = coalesce(su_sensor_id, ob_sensor_id, de_sensor_id)\n| summarize by CombinedSensor\n| where isnotempty(CombinedSensor)\n| order by CombinedSensor asc", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsSuricata_CL'\n| where su_timestamp between ({TimeRange:start} .. {TimeRange:end})\n| where isempty('{Category}') or (su_sig_category == '{Category}')\n| where isempty('{Name}') or (su_sig_name == '{Name}')\n| where isempty('{SensorID}') or (su_sensor_id == '{SensorID}')\n| project-away ob_*, de_*", "size": 0, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "observation_title", "formatter": 5 }, { "columnMatch": "confidence", "formatter": 5 }, { "columnMatch": "Category", "formatter": 5 }, { "columnMatch": "class", "formatter": 5 }, { "columnMatch": "context", "formatter": 5 }, { "columnMatch": "evidence_iql", "formatter": 5 }, { "columnMatch": "evidence_end_timestamp", "formatter": 5 }, { "columnMatch": "evidence_start_timestamp", "formatter": 5 }, { "columnMatch": "description", "formatter": 5 }, { "columnMatch": "observation_uuid", "formatter": 5 }, { "columnMatch": "sensor_ids", "formatter": 5 }, { "columnMatch": "device_ip", "formatter": 5 }, { "columnMatch": "status", "formatter": 5 }, { "columnMatch": "indicators", "formatter": 5 }, { "columnMatch": "last_seen", "formatter": 5 } ], "filter": true, "labelSettings": [ { "columnId": "su_timestamp", "label": "timestamp" }, { "columnId": "su_event_type", "label": "event_type" }, { "columnId": "su_src_ip", "label": "src_ip" }, { "columnId": "su_src_port", "label": "src_port" }, { "columnId": "su_dst_ip", "label": "dst_ip" }, { "columnId": "su_dst_port", "label": "dst_port" }, { "columnId": "su_intel", "label": "intel" }, { "columnId": "su_sig_name", "label": "sig_name" }, { "columnId": "su_sig_id", "label": "sig_id" }, { "columnId": "su_sig_rev", "label": "sig_rev" }, { "columnId": "su_sig_category", "label": "sig_category" }, { "columnId": "su_sig_severity", "label": "sig_severity" }, { "columnId": "su_payload", "label": "payload" }, { "columnId": "su_source", "label": "source" }, { "columnId": "su_proto", "label": "proto" }, { "columnId": "su_sensor_id", "label": "sensor_id" }, { "columnId": "su_src_internal", "label": "src_internal" }, { "columnId": "su_src_geo_lat", "label": "src_geo_lat" }, { "columnId": "su_src_geo_lon", "label": "src_geo_lon" }, { "columnId": "su_src_geo_country", "label": "src_geo_country" }, { "columnId": "su_src_geo_subdivision", "label": "src_geo_subdivision" }, { "columnId": "su_src_geo_city", "label": "src_geo_city" }, { "columnId": "su_src_asn_asn", "label": "src_asn_asn" }, { "columnId": "su_src_asn_org", "label": "src_asn_org" }, { "columnId": "su_src_asn_isp", "label": "src_asn_isp" }, { "columnId": "su_src_asn_asn_org", "label": "src_asn_asn_org" }, { "columnId": "su_src_annotations_applications", "label": "src_annotations_applications" }, { "columnId": "su_src_annotations_environments", "label": "src_annotations_environments" }, { "columnId": "su_src_annotations_locations", "label": "src_annotations_locations" }, { "columnId": "su_src_annotations_owners", "label": "src_annotations_owners" }, { "columnId": "su_src_annotations_roles", "label": "src_annotations_roles" }, { "columnId": "su_src_annotations_tags", "label": "src_annotations_tags" }, { "columnId": "su_dst_internal", "label": "dst_internal" }, { "columnId": "su_dst_geo_lat", "label": "dst_geo_lat" }, { "columnId": "su_dst_geo_lon", "label": "dst_geo_lon" }, { "columnId": "su_dst_geo_country", "label": "dst_geo_country" }, { "columnId": "su_dst_geo_subdivision", "label": "dst_geo_subdivision" }, { "columnId": "su_dst_geo_city", "label": "dst_geo_city" }, { "columnId": "su_dst_asn_asn", "label": "dst_asn_asn" }, { "columnId": "su_dst_asn_org", "label": "dst_asn_org" }, { "columnId": "su_dst_asn_isp", "label": "dst_asn_isp" }, { "columnId": "su_dst_asn_asn_org", "label": "dst_asn_asn_org" }, { "columnId": "su_dst_annotations_applications", "label": "dst_annotations_applications" }, { "columnId": "su_dst_annotations_environments", "label": "dst_annotations_environments" }, { "columnId": "su_dst_annotations_locations", "label": "dst_annotations_locations" }, { "columnId": "su_dst_annotations_owners", "label": "dst_annotations_owners" }, { "columnId": "su_dst_annotations_roles", "label": "dst_annotations_roles" }, { "columnId": "su_dst_annotations_tags", "label": "dst_annotations_tags" }, { "columnId": "su_geo_distance", "label": "geo_distance" }, { "columnId": "su_http_status", "label": "http_status" }, { "columnId": "su_http_protocol", "label": "http_protocol" }, { "columnId": "su_http_url", "label": "http_url" }, { "columnId": "su_http_hostname", "label": "http_hostname" }, { "columnId": "su_http_host_internal", "label": "http_host_internal" }, { "columnId": "su_http_host_geo_lat", "label": "http_host_geo_lat" }, { "columnId": "su_http_host_geo_lon", "label": "http_host_geo_lon" }, { "columnId": "su_http_host_geo_country", "label": "http_host_geo_country" }, { "columnId": "su_http_host_geo_subdivision", "label": "http_host_geo_subdivision" }, { "columnId": "su_http_host_geo_city", "label": "http_host_geo_city" }, { "columnId": "su_http_host_asn_asn", "label": "http_host_asn_asn" }, { "columnId": "su_http_host_asn_org", "label": "http_host_asn_org" }, { "columnId": "su_http_host_asn_isp", "label": "http_host_asn_isp" }, { "columnId": "su_http_host_asn_asn_org", "label": "http_host_asn_asn_org" }, { "columnId": "su_http_host_annotations_applications", "label": "http_host_annotations_applications" }, { "columnId": "su_http_host_annotations_environments", "label": "http_host_annotations_environments" }, { "columnId": "su_http_host_annotations_locations", "label": "http_host_annotations_locations" }, { "columnId": "su_http_host_annotations_owners", "label": "http_host_annotations_owners" }, { "columnId": "su_http_host_annotations_roles", "label": "http_host_annotations_roles" }, { "columnId": "su_http_host_annotations_tags", "label": "http_host_annotations_tags" }, { "columnId": "su_http_host_domain_entropy", "label": "http_host_domain_entropy" }, { "columnId": "su_http_length", "label": "http_length" }, { "columnId": "su_http_method", "label": "http_method" }, { "columnId": "su_http_content_type", "label": "http_content_type" }, { "columnId": "su_http_refer", "label": "http_refer" }, { "columnId": "su_http_user_agent", "label": "http_user_agent" }, { "columnId": "su_http_redirect", "label": "http_redirect" }, { "columnId": "su_http_xtf", "label": "http_xtf" }, { "columnId": "su_uuid", "label": "uuid" }, { "columnId": "su_customer_id", "label": "customer_id" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "http_hostname_enrichments_ip_enrichments_asn_asn_d", "sizeAggregation": "Sum", "legendMetric": "http_hostname_enrichments_ip_enrichments_asn_asn_d", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "http_hostname_enrichments_ip_enrichments_asn_asn_d", "heatmapPalette": "greenRed" } } }, "name": "FNC Suricata List" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Suricata" }, "name": "Suricata" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**FortiNDR Cloud Observation Chart:**" }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "fcd15fc8-790a-448e-8a61-1a1ec5f70e05", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" }, { "id": "fd7ebd99-2ba4-4240-86de-1c109bc10fba", "version": "KqlParameterItem/1.0", "name": "Title", "label": "Observation Title", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsObservation_CL'\n| summarize by ob_observation_title\n| where isnotempty(ob_observation_title)\n| order by ob_observation_title asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsObservation_CL'\n| where ob_timestamp between({TimeRange:start} .. {TimeRange:end})\n| where isempty('{Title}') or (ob_observation_title == '{Title}')\n| summarize Count = count() by ob_observation_title, bin(ob_timestamp, 1d)", "size": 0, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "High", "sizeAggregation": "Sum", "legendMetric": "High", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "High", "heatmapPalette": "greenRed" } } }, "name": "query - 5" }, { "type": 1, "content": { "json": "**FortiNDR Cloud Observation List:**" }, "name": "text - 4 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "55ad269b-ead8-4f61-b429-669d632b53e1", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" }, { "id": "43131f54-c638-41a3-a54c-d8768c2df468", "version": "KqlParameterItem/1.0", "name": "Title", "label": "Observation Title", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsObservation_CL'\n| summarize by ob_observation_title\n| where isnotempty(ob_observation_title)\n| order by ob_observation_title asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "9ff7f038-1fa5-4ac1-84cb-ef8c6e91a183", "version": "KqlParameterItem/1.0", "name": "Sensor_ID", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type in ('FncEventsSuricata_CL', 'FncEventsObservation_CL', 'FncEventsDetections_CL')\n| extend CombinedSensor = coalesce(su_sensor_id, ob_sensor_id, de_sensor_id)\n| summarize by CombinedSensor\n| where isnotempty(CombinedSensor)\n| order by CombinedSensor asc", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "3e100d32-5ad3-4a4f-a486-f65be2c62101", "version": "KqlParameterItem/1.0", "name": "Confidence", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\n {\"value\":\"high\", \"label\":\"High\"},\n {\"value\":\"moderate\", \"label\":\"Moderate\"},\n {\"value\":\"low\", \"label\":\"Low\"}\n]", "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsObservation_CL'\n| where ob_timestamp between({TimeRange:start} .. {TimeRange:end})\n| where ob_confidence in ({Confidence})\n| where isempty('{Sensor_ID}') or (ob_sensor_id == '{Sensor_ID}')\n| where isempty('{Title}') or (ob_observation_title == '{Title}')\n| project-away su_*, de_*", "size": 0, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ob_confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "moderate", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] } }, { "columnMatch": "ob_context", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Context", "linkIsContextBlade": true } }, { "columnMatch": "ob_evidence_iql", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Evidence IQL", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "labelSettings": [ { "columnId": "Type", "label": "Type" }, { "columnId": "ob_timestamp", "label": "timestamp" }, { "columnId": "ob_observation_title", "label": "observation_title" }, { "columnId": "ob_confidence", "label": "confidence" }, { "columnId": "ob_category", "label": "category" }, { "columnId": "ob_class", "label": "class" }, { "columnId": "ob_context", "label": "context" }, { "columnId": "ob_evidence_iql", "label": "evidence_iql" }, { "columnId": "ob_evidence_end_timestamp", "label": "evidence_end_timestamp" }, { "columnId": "ob_evidence_start_timestamp", "label": "evidence_start_timestamp" }, { "columnId": "ob_description", "label": "description" }, { "columnId": "ob_observation_uuid", "label": "observation_uuid" }, { "columnId": "ob_sensor_ids", "label": "sensor_ids" }, { "columnId": "ob_event_type", "label": "event_type" }, { "columnId": "ob_src_ip", "label": "src_ip" }, { "columnId": "ob_dst_ip", "label": "dst_ip" }, { "columnId": "ob_intel", "label": "intel" }, { "columnId": "ob_source", "label": "source" }, { "columnId": "ob_sensor_id", "label": "sensor_id" }, { "columnId": "ob_src_internal", "label": "src_internal" }, { "columnId": "ob_src_geo_lat", "label": "src_geo_lat" }, { "columnId": "ob_src_geo_lon", "label": "src_geo_lon" }, { "columnId": "ob_src_geo_country", "label": "src_geo_country" }, { "columnId": "ob_src_geo_subdivision", "label": "src_geo_subdivision" }, { "columnId": "ob_src_geo_city", "label": "_src_geo_city" }, { "columnId": "ob_src_asn_asn", "label": "src_asn_asn" }, { "columnId": "ob_src_asn_org", "label": "src_asn_org" }, { "columnId": "ob_src_asn_isp", "label": "src_asn_isp" }, { "columnId": "ob_src_asn_asn_org", "label": "src_asn_asn_org" }, { "columnId": "ob_src_annotations_applications", "label": "src_annotations_applications" }, { "columnId": "ob_src_annotations_environments", "label": "src_annotations_environments" }, { "columnId": "ob_src_annotations_locations", "label": "src_annotations_locations" }, { "columnId": "ob_src_annotations_owners", "label": "src_annotations_owners" }, { "columnId": "ob_src_annotations_roles", "label": "src_annotations_roles" }, { "columnId": "ob_src_annotations_tags", "label": "src_annotations_tags" }, { "columnId": "ob_dst_internal", "label": "dst_internal" }, { "columnId": "ob_dst_geo_lat", "label": "dst_geo_lat" }, { "columnId": "ob_dst_geo_lon", "label": "dst_geo_lon" }, { "columnId": "ob_dst_geo_country", "label": "dst_geo_country" }, { "columnId": "ob_dst_geo_subdivision", "label": "dst_geo_subdivision" }, { "columnId": "ob_dst_geo_city", "label": "dst_geo_city" }, { "columnId": "ob_dst_asn_asn", "label": "dst_asn_asn" }, { "columnId": "ob_dst_asn_org", "label": "dst_asn_org" }, { "columnId": "ob_dst_asn_isp", "label": "dst_asn_isp" }, { "columnId": "ob_dst_asn_asn_org", "label": "dst_asn_asn_org" }, { "columnId": "ob_dst_annotations_applications", "label": "dst_annotations_applications" }, { "columnId": "ob_dst_annotations_environments", "label": "dst_annotations_environments" }, { "columnId": "ob_dst_annotations_locations", "label": "_dst_annotations_locations" }, { "columnId": "ob_dst_annotations_owners", "label": "dst_annotations_owners" }, { "columnId": "ob_dst_annotations_roles", "label": "dst_annotations_roles" }, { "columnId": "ob_dst_annotations_tags", "label": "dst_annotations_tags" }, { "columnId": "ob_geo_distance", "label": "geo_distance" }, { "columnId": "ob_uuid", "label": "uuid" }, { "columnId": "ob_customer_id", "label": "customer_id" } ] } }, "name": "FNC Observation List" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Observation" }, "name": "Observation" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**FortiNDR Cloud Detections Charts**" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3e9b6847-1b6c-4ba5-87d6-a3d4b0e36046", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } }, { "id": "88270ace-134e-4577-b2fd-58b4a7a0cb36", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "jsonData": "[\n {\"value\":\"high\", \"label\":\"High\"},\n {\"value\":\"moderate\", \"label\":\"Moderate\"},\n {\"value\":\"low\", \"label\":\"Low\"}\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "16f11673-0de7-4f81-94d8-5fcea8b83222", "version": "KqlParameterItem/1.0", "name": "Confidence", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\n {\"value\":\"high\", \"label\":\"High\"},\n {\"value\":\"moderate\", \"label\":\"Moderate\"},\n {\"value\":\"low\", \"label\":\"Low\"}\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "cab3ce23-4ea0-4565-a7fb-2009f888198f", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| summarize by de_category\n| where isnotempty(de_category)\n| order by de_category asc", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| where de_created between ({TimeRange:start} .. {TimeRange:end})\n| where de_severity in ({Severity})\n| where isempty('{Category}') or (de_category == '{Category}')\n| summarize Count = count() by de_severity, bin(de_created, 1d)\n| render barchart", "size": 0, "showAnalytics": true, "title": "Detection Counts by Severity", "color": "lightBlue", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "moderate", "color": "orange" }, { "seriesName": "low", "color": "yellow" }, { "seriesName": "high", "color": "redBright" } ] } }, "customWidth": "50", "name": "query - 8 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| where de_created between ({TimeRange:start} .. {TimeRange:end})\n| where de_confidence in ({Confidence})\n| where isempty('{Category}') or (de_category == '{Category}')\n| summarize Count = count() by de_confidence, bin(de_created, 1d)\n| render barchart", "size": 0, "showAnalytics": true, "title": "Detection Counts by Confidence", "color": "lightBlue", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "moderate", "color": "orange" }, { "seriesName": "low", "color": "yellow" }, { "seriesName": "high", "color": "redBright" } ] } }, "customWidth": "50", "name": "query - 8 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "**FortiNDR Cloud Detections List**" }, "name": "text - 5 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a613556b-fcd7-440a-af79-47b839e8f76b", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 7776000000 } }, { "id": "9196914a-cd13-4897-8d8f-2e497721452a", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "jsonData": "[\n {\"value\":\"high\", \"label\":\"High\"},\n {\"value\":\"moderate\", \"label\":\"Moderate\"},\n {\"value\":\"low\", \"label\":\"Low\"}\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "0b5bbec6-76d8-422c-89a4-95162c9300cb", "version": "KqlParameterItem/1.0", "name": "Confidence", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\n {\"value\":\"high\", \"label\":\"High\"},\n {\"value\":\"moderate\", \"label\":\"Moderate\"},\n {\"value\":\"low\", \"label\":\"Low\"}\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all" }, { "id": "876e2140-cacb-4d7c-88ed-354ecd7e86a2", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| summarize by de_category\n| where isnotempty(de_category)\n| order by de_category asc", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "fb9f063f-c68e-4f27-8693-160f8759f8b2", "version": "KqlParameterItem/1.0", "name": "RuleNames", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| summarize by de_rule_name\n| where isnotempty(de_rule_name)\n| order by de_rule_name asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Fortinet_FortiNDR_Cloud\n| where Type == 'FncEventsDetections_CL'\n| where de_created between ({TimeRange:start} .. {TimeRange:end})\n| where de_severity in ({Severity})\n| where de_confidence in ({Confidence})\n| where de_rule_name in ({RuleNames})\n| where isempty('{Category}') or (de_category == '{Category}')\n| sort by de_created desc\n| project-away su_*, ob_*\n\n\n\n", "size": 0, "showAnalytics": true, "title": "FNC Detection List", "showRefreshButton": true, "showExportToExcel": true, "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "de_event_count", "formatter": 8, "formatOptions": { "min": 0, "palette": "yellowGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "de_events", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Events", "linkIsContextBlade": true } }, { "columnMatch": "de_indicators", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Indicators", "linkIsContextBlade": true } }, { "columnMatch": "de_status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "active", "representation": "greenDark", "text": "Active" }, { "operator": "==", "thresholdValue": "resolved", "representation": "gray", "text": "Resolved" }, { "operator": "Default", "text": "{0}{1}" } ] } }, { "columnMatch": "de_severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "Sev0", "text": "High" }, { "operator": "==", "thresholdValue": "moderate", "representation": "Sev1", "text": "Moderate" }, { "operator": "==", "thresholdValue": "low", "representation": "Sev2", "text": "Low" }, { "operator": "Default", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "de_confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "low", "representation": "Sev2", "text": "Low" }, { "operator": "==", "thresholdValue": "moderate", "representation": "Sev1", "text": "Moderate" }, { "operator": "==", "thresholdValue": "high", "representation": "Sev0", "text": "High" }, { "operator": "Default", "text": "{0}{1}" } ] } }, { "columnMatch": "de_rule_url", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "indicators", "formatter": 5, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "labelSettings": [ { "columnId": "de_device_ip", "label": "device_ip" }, { "columnId": "de_event_count", "label": "event_count" }, { "columnId": "de_events", "label": "events" }, { "columnId": "de_indicators", "label": "indicators" }, { "columnId": "de_last_seen", "label": "last_seen" }, { "columnId": "de_status", "label": "status" }, { "columnId": "de_rule_name", "label": "rule_name" }, { "columnId": "de_severity", "label": "severity" }, { "columnId": "de_confidence", "label": "confidence" }, { "columnId": "de_resolved_by", "label": "resolved_by" }, { "columnId": "de_resolution", "label": "resolution" }, { "columnId": "de_resolution_comment", "label": "resolution_comment" }, { "columnId": "de_date_resolved", "label": "date_resolved" }, { "columnId": "de_rule_uuid", "label": "rule_uuid" }, { "columnId": "de_category", "label": "category" }, { "columnId": "de_created", "label": "created" }, { "columnId": "de_updated", "label": "updated" }, { "columnId": "de_first_seen", "label": "first_seen" }, { "columnId": "de_muted", "label": "muted" }, { "columnId": "de_rule_muted", "label": "rule_muted" }, { "columnId": "de_mute_comment", "label": "mute_comment" }, { "columnId": "de_muted_by", "label": "muted_by" }, { "columnId": "de_date_muted", "label": "date_muted" }, { "columnId": "de_sensor_id", "label": "sensor_id" }, { "columnId": "de_account_id", "label": "account_id" }, { "columnId": "de_uuid", "label": "uuid" }, { "columnId": "de_username", "label": "username" }, { "columnId": "de_hostname", "label": "hostname" }, { "columnId": "de_primary_attack_id", "label": "primary_attack_id" }, { "columnId": "de_secondary_attack_id", "label": "secondary_attack_id" }, { "columnId": "de_rule_url", "label": "rule_url" } ] }, "tileSettings": { "showBorder": false } }, "name": "query - 6" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Detection" }, "name": "Detection" } ], "fromTemplateId": "sentinel-FortiNdrCloud", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }