{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", "crossComponentResources": [ "value::selected" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "label": "☁️ Subscription", "value": "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2" }, { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", "version": "KqlParameterItem/1.0", "name": "Workspace", "label": "πŸ—‚οΈ Workspace", "type": 5, "isRequired": true, "query": "resources\n| where type =~ 'microsoft.operationalinsights/workspaces' \n//| where subscriptionId == '{Subscription:id}'\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": "", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "eafaa0ec-7c3a-4ee5-babe-9850080c909d", "version": "KqlParameterItem/1.0", "name": "resourceGroup", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "value": { "durationMs": 1209600000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "label": "⏱️ Time Range" }, { "id": "27308a9d-46a2-4fca-8035-e813201fb4f8", "version": "KqlParameterItem/1.0", "name": "GBperday", "type": 1, "description": "Shows Average per Day over selected Duration (GB)", "query": "Usage\r\n| where TimeGenerated > startofday({TimeRange:start}) and TimeGenerated < startofday({TimeRange:end})\r\n// Only look at chargeable Tables\r\n| where IsBillable == True\r\n| summarize\r\nTotalBytes =round(sum(Quantity))\r\nby bin(TimeGenerated, 1d)\r\n| summarize GBperday = round(avg(TotalBytes)/1000,2)\r\n", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "22ed8771-4f7a-4ed1-bb14-882b863be85e", "version": "KqlParameterItem/1.0", "name": "selectDepthLevel", "label": "Select the detail level", "type": 10, "description": "Basic data will load much faster than Advanced, use Defender portal (default) for optimization in that portal", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"Basic\", \"label\": \"Basic\", \"selected\":true, \"selected\":true },\r\n { \"value\": \"Advanced\", \"label\": \"Advanced\" }\r\n ]" }, { "id": "c71f3009-a3f4-4aa5-aaf0-d0f667100e56", "version": "KqlParameterItem/1.0", "name": "Help", "label": "πŸ“– Help", "type": 10, "description": "This will show some help information to help you understand the page you are on", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n { \"value\": \"No\", \"label\": \"No\", \"selected\":true },\r\n { \"value\": \"Change Log\", \"label\": \"Change Log\"},\r\n { \"value\": \"search\", \"label\": \"Tenant Search\"}\r\n]" }, { "id": "bd9b6f2d-3e7b-4d2c-83b4-f77154f6af42", "version": "KqlParameterItem/1.0", "name": "GBtotal", "type": 1, "query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == True\r\n| parse ResourceUri with *'/subscriptions/' SubscriptionId '/resourcegroups/'*\r\n| where SubscriptionId == '{Subscription:id}'\r\n| summarize Gbytes = sum(Quantity)/1000 by SubscriptionId\r\n| project TotalGBytes = round(Gbytes,2)", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ \"microsoft.operationsmanagement/solutions\"\r\n| where name has \"SecurityInsights\"\r\n| parse name with * \"(\" s_workspace \")\" *\r\n| project workspaceName = tolower(s_workspace), location, subscriptionId, name\r\n| join kind=leftouter (\r\n ResourceContainers\r\n | where type == \"microsoft.resources/subscriptions\"\r\n | project subscriptionId, subscriptionName = name\r\n) on subscriptionId\r\n| join kind=leftouter (\r\n ManagedServicesResources\r\n | extend ManagedTenant =\r\n coalesce(\r\n tostring(properties.registrationDefinition.properties.manageeTenantName),\r\n tostring(properties.manageeTenantName)\r\n )\r\n | extend ManagedTenant = trim(@\"[^\\w\\s\\.-]+\", ManagedTenant)\r\n | where isnotempty(ManagedTenant)\r\n | extend ManagedBy = tostring(properties.registrationDefinition.properties.registrationDefinitionName)\r\n // Reduce to 1 row per subscription to avoid duplicating workspaces\r\n | summarize\r\n Directory = any(ManagedTenant),\r\n ManagedBy = any(ManagedBy),\r\n AzureLighthouse = \"Yes\"\r\n by subscriptionId\r\n) on subscriptionId\r\n| extend AzureLighthouse = coalesce(AzureLighthouse, \"No\")\r\n| project subscriptionName, workspaceName, subscriptionId, location, AzureLighthouse, Directory, ManagedBy\r\n| order by AzureLighthouse desc, workspaceName asc", "size": 1, "title": "Find a Tenant or subscription , count: {$rowCount}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "value::all" ], "gridSettings": { "rowLimit": 1000, "filter": true } }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "search" }, "name": "query - Tenant Search" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "4df9243a-749d-4698-98f6-188e0b687e13", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ” Workspace Info", "subTarget": "WorkspaceInfo", "style": "link" }, { "id": "4c0faa80-5c85-4d02-989d-37921b12ae87", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ“ˆ Latency", "subTarget": "Latency", "style": "link" }, { "id": "ffceb6e6-3756-466e-860b-c017f0421e9f", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ’° Cost Analysis", "subTarget": "Cost", "style": "link" }, { "id": "25b0dfdf-9de1-4a16-b66f-c5b3822c8018", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ”’ Microsoft Sentinel", "subTarget": "Sentinel", "style": "link" }, { "id": "1e15a92e-c236-4e93-833e-fe95f5b1d6e6", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ“… Regular Checks (D/W/M)", "subTarget": "Checks", "style": "link" }, { "id": "82bcdf4d-0e66-4f27-a958-41dd2b96d266", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ’½ Azure Data Explorer (ADX)", "subTarget": "ADX", "style": "link" }, { "id": "b509ee87-2901-416f-bc7d-043fc676ae1d", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ“ Data Collection Rules", "subTarget": "dcr", "style": "link" }, { "id": "0e10a678-63c6-46bf-8cab-fb416df17ecc", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ”— Function or Parsers", "subTarget": "function", "style": "link" } ] }, "name": "links - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend state = trim(' ', tostring(properties.provisioningState))\r\n\t\t,sku = trim(' ', tostring(properties.sku.name))\r\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\r\n\t\t,retentionDays = trim(' ', tostring(properties.retentionInDays))\r\n\t\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\r\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\"Not set\")\r\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\"Unknown\")\r\n| extend sentinel = iif(toint(retentionDays) < 90,\"If you have Sentinel, you can change your retention to 90days (free)?\",\"\")\r\n| project ['Log Analytics Workspace Name']=id, ['Resource Group']=resourceGroup, location, ['Data Retention(days)']=retentionDays, ['Last known SKU update']=skuUpdate, ['Daily Data Cap']=dailyquotaGB, ['Licence']=sku, ['Commitment Tier']=properties.sku.capacityReservationLevel, ['Notes'] = sentinel", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Data Retention(days)", "formatter": 0, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last known SKU update", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "is Empty", "thresholdValue": "\" \"", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Daily Data Cap", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "not set", "representation": "Unavailable", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "Data Retention", "formatter": 0, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } } ] } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, "name": "query - 18" }, { "type": 1, "content": { "json": "## Workspace Usage Report \r\n### Change Log\r\nUse this report to analyze the the sizes of the different tables and Latency in your workspace and agents. This report checks the overall workspace health.\r\n\r\n|Version|Description|link|\r\n|---|---|---|\r\n|v1.1|Added Events Per Second (EPS) to Workspace Info Tab.| |\r\n|v1.2|Added EPS with a breakdown for Device Vendor in CommonSecurityLog| |\r\n|v1.3|Added EPS Tab and Min, Max values||\r\n|v1.4|Added Checks Tab for Daily, Weekly and Monthly suggested checking routines. Also Defender for Cloud info in Costs Tab.||\r\n|v1.4.2|Added Groups to all Tabs. Added Price info and Help button.||\r\n|v1.4.3|Added to [COST] tab and report of \"GBytes used per Computer\"||\r\n|v1.4.4|Quick fix to get the TableName duplicate removed. Added value to Y axis of [Cost] trend graph, Remove content (EPS) that is planned for the Sentinel Health workbook.||\r\n|v1.4.5|Added extra Cost info, improve Weekly reports and other grids, testing release ONLY||\r\n|v1.4.6|Moved Price to Costs Analysis Tab (all pricing is now in the same place). Added some table data, description and links to Latency grid. Filter on Queries in Weekly report and Workspace audit filters||\r\n|v1.4.7|Add Pie chart of % billable vs. free to Cost Analysis. Add count of Rules, Rule Templates and Hunting Queries (just unique ones). Extra Defender for Cloud report for \"minimal\",\"common\" and \"all\". Additional troubleshooting displays, when Help toggle is on. % used for Tables. User filter for LAqueries.||\r\n|v1.4.8|[Cost Analysis] is now a Tab with Sub Menus to aid load times and readability. New features: Syslog Cost Analysis, CEF Cost Analysis. In the [OverView] sub menu, there are now reports on capacity / price per Subscription, Resource Group and Tags. The Sentinel tab has reports for Usage vs. Capacity Reservation and recommendations for the settings you are on, for Log Analytics and Sentinel.||\r\n|v1.4.9|Add extra filtering within 'Advanced Workspace Details', so you can select other Workspaces to audit, and provide a link to the related Workbook (if it's installed). Add a filter for a basic level of data in the complex reports (default) or selected Advanced for the original longer running query. Added Automation rules to Alert Rules in Weekly reporting. Removed Tags section for now in Overview report. Added Sentinel cost estimate for retention.||\r\n|v1.5.0|Added an ADX Tab (more to add here, maybe just a placeholder for now). Added some reports on Template rules vs Active Rule by *Type* (so you can see what is deployed vs. available by each rule type/category) in the Weekly reports. Fix for Chart bug that can cause a β€œout of memory” error. Wording swapped to \"Commitment Tiers\" rather than Capacity Reservation.||\r\n|v1.5.1|Performance tweaks. GB to GB correction. Drill down on Computer costs. Add link to ADX insights||\r\n|v1.6|Change to new product names + fix subscription issue||\r\n|v1.6.1|Improve Weekly view and Rules. Add Function Alias view, add DCR view||\r\n|v1.6.2|Add Table to Connectors / Solution mapping from external file|https://www.linkedin.com/pulse/little-slice-workspace-usage-workbook-reimagined-part-jon-shectman-8nxwe/|\r\n|v1.6.3|Update daily checks|https://www.linkedin.com/pulse/little-slice-ofweekly-queries-your-soc-run-part-2-jon-shectman-siyce/?trackingId=%2BgAKE1e6SnW4dgnr969EBw%3D%3D|\r\n|v1.6.4|Update Weekly checks| https://www.linkedin.com/feed/update/urn:li:activity:7440704185018236928?updateEntityUrn=urn%3Ali%3Afs_updateV2%3A%28urn%3Ali%3Aactivity%3A7440704185018236928%2CFEED_DETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29|\r\n|v1.6.5|Onboarding checks, E5 Benefit Page in Sentinel, Retention Estimator in Microsoft Sentinel, SOC Metrics in Microsoft Sentinel, Identity Metrics in Microsoft Sentinel, Solution Mapping in Microsoft Sentinel| https://www.linkedin.com/pulse/big-old-release-weekly-workspace-usage-workbook-part-2-jon-shectman-mkije/?trackingId=JwCjzo3WRHaAHhIzC4Y%2BTA%3D%3D |\r\n|v1.6.6|Main page and Latency page updates, small bug fixes from 1.6.5| |\r\n|v1.6.7|Adding some Key Hunting queries| |\r\n\r\n" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Change Log" }, "customWidth": "50", "name": "text - 0" }, { "type": 1, "content": { "json": "## Help File\r\n\r\nMore details in the Wiki: https://github.com/clivewatson/KQLpublic/wiki/Workbook-Usage\r\n\r\n## Usage\r\n\t- Please select your **Subscription** and **Workspace**\r\n\t- Time Range: is the time you wish to query back to. i.e 7days from now, into the past.\r\n\t- Help is available in various parts of this Workbook.\r\n\t- Select the Detail Level - is a toggle to reduce the page load time of certain queries.\r\n## Categories\r\n\t- Azure Monitor Logs (Workspace)\r\n\t- Sentinel\r\n\t- Defender for Cloud\r\n## Solutions\r\n|Solution|Description|\r\n|---|---|\r\n| Workspace Infomation | info about the workspace, usage and statistics|\r\n|Latency | Which Tables or machines have latency issues, average, minimun and maximum values|\r\n|Costs Analysis| Looking again at the tables in the [Workspace Info] tab, but also you can select a Price of your choosing (Β£,$). Sub menus have been added to aid drill-down to specific products or data|\r\n|Sentinel | specifc data about Sentinel|\r\n| Regular Checks | Daily, Weekly and Monthly suggested checks you can look at.|\r\n\r\n## Data Sources\r\n\t- Azure Resource Graph (ARG) and Various tables within Azure Monitor Logs (Workspace).\r\n\r\n## Anomoly Detection\r\nSome reports now show anomoly detection, this explains the Score: https://docs.microsoft.com/azure/data-explorer/anomaly-detection#time-series-anomaly-detection\r\n\r\nAnomaly scores above 1.5 or below -1.5 indicate a mild anomaly rise or decline respectively. Anomaly scores above 3.0 or below -3.0 indicate a strong anomaly." }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "customWidth": "50", "name": "text - 0 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Troubleshoot", "items": [ { "type": 1, "content": { "json": "Icon-manage-307 Log Analytics Troubleshooting\r\n- These queries are often empty, unless you have a problem." }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Operation | where OperationCategory == 'Data Collection Status'\r\n\r\n// https://docs.microsoft.com/azure/azure-monitor/platform/manage-cost-storage#troubleshooting-why-log-analytics-is-no-longer-collecting-data", "size": 4, "title": "Troubleshoot Workspace: Data Collection Issue", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage | where IsBillable | summarize DataGB = sum(Quantity / 1000.) //| where DataGB > 50\r\n\r\n// https://docs.microsoft.com/azure/azure-monitor/platform/manage-cost-storage#create-an-alert-when-data-collection-is-high", "size": 4, "title": "Troubleshoot Workspace: Data sent today", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This isn't a frequest operation, so you may have to go back a long way in the logs (if you have them)\r\nOperation\r\n| where OperationCategory == \"Workspace Configuration\"\r\n| extend msg = split(Detail,\".\").[0], reason = split(Detail,\".\").[1]", "size": 4, "title": "Troubleshoot Workspace: Configuration changes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//https://docs.microsoft.com/azure/azure-monitor/platform/monitor-workspace\r\n_LogOperation \r\n| summarize count() by Level", "size": 4, "title": "Troubleshoot Workspace: Ingestion Operations by type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//https://docs.microsoft.com/azure/azure-monitor/platform/monitor-workspace\r\n_LogOperation | where Category == \"Ingestion\" | where Operation == \"Ingestion rate\" | where Level == \"Warning\"", "size": 4, "title": "Troubleshoot Workspace: warning alert when the ingestion volume rate has reached 80% of the limit", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//https://docs.microsoft.com/azure/azure-monitor/platform/monitor-workspace\r\n_LogOperation | where Category == \"Ingestion\" | where Operation == \"Data Collection\" | where Level == \"Warning\"", "size": 4, "title": "Troubleshoot Workspace: warning alert when the data collection has reached the daily limit", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "query - 10 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_LogOperation\r\n| where TimeGenerated > ago(30d)\r\n| where Level in ('Warning','Error')\r\n| summarize count() by Level, Detail, bin(TimeGenerated,1d)\r\n", "size": 0, "title": "Warning & Errors for the past 30days", "timeContext": { "durationMs": 2592000000 }, "timeBrushParameterName": "exportEW", "timeBrushExportOnlyWhenBrushed": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart" }, "name": "query - warn & errors" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_LogOperation\r\n| where Level in ('Warning','Error')\r\n| summarize count() by Level, Detail, bin(TimeGenerated,1d)\r\n| order by count_ desc\r\n", "size": 0, "title": "Timebrush for: {exportEW:label}", "timeContextFromParameter": "exportEW", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Level", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Error", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "exportEW", "comparison": "isNotEqualTo" }, "name": "query - ew timebrush analysis" } ] }, "conditionalVisibilities": [ { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "group - Troubleshoot", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "price setting", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "170a6d54-0503-41ac-b52b-b0e3db2f427d", "version": "KqlParameterItem/1.0", "name": "Price", "label": "Price estimation", "type": 1, "description": "Enter your price (tip. Use the Azure Pricing Calculator, enter a value of 1GB and divide by 30days), or see Help toggle", "criteriaData": [ { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "4.0" } } ] } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1 - Copy" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, "name": "group - Price" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Workspace info: {Workspace:name} ", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "ea62a2a2-e300-4618-b6bc-42e75afba86a", "version": "KqlParameterItem/1.0", "name": "getPlan", "type": 1, "isRequired": true, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"properties.plan\",\"columnid\":\"plan\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "9f23ba90-cedc-458a-ac0f-95bd66cd5227", "version": "KqlParameterItem/1.0", "name": "selectPlan", "label": "Select TablePlan", "type": 2, "isRequired": true, "query": "(\r\nresources\r\n| take 1\r\n| project raw = replace_string(replace_string(replace_string(\"{getPlan}\", \"[\", \"\"), \"]\", \"\"), \"\\\"\", \"\")\r\n| extend items = split(raw, \",\")\r\n| mv-expand item = items\r\n| extend plan = trim(\" \", tostring(item))\r\n| where isnotempty(plan)\r\n| extend value = case(\r\n tolower(plan) has \"basic\", \"(@.properties.plan=='Basic')\",\r\n tolower(plan) has \"analytics\", \"(@.properties.plan=='Analytics')\",\r\n tolower(plan) has \"auxiliary\", \"(@.properties.plan=='Auxiliary')\",\r\n \"(@.properties.plan=='Unknown')\"\r\n)\r\n| extend label = case(\r\n tolower(plan) has \"basic\", \"Basic\",\r\n tolower(plan) has \"analytics\", \"Analytics\",\r\n tolower(plan) has \"auxiliary\", \"Auxiliary / data lake\",\r\n \"Unknown\"\r\n)\r\n| distinct label, value\r\n)\r\n| union (\r\nresources\r\n| take 1\r\n| project raw = replace_string(replace_string(replace_string(\"{getPlan}\", \"[\", \"\"), \"]\", \"\"), \"\\\"\", \"\")\r\n| extend items = split(raw, \",\")\r\n| mv-expand item = items\r\n| extend plan = trim(\" \", tostring(item))\r\n| where isnotempty(plan)\r\n| extend norm = case(\r\n tolower(plan) has \"basic\", \"Basic\",\r\n tolower(plan) has \"analytics\", \"Analytics\",\r\n tolower(plan) has \"auxiliary\", \"Auxiliary\",\r\n \"Unknown\"\r\n)\r\n| distinct norm\r\n| extend value = strcat(\"(@.properties.plan=='\", norm, \"')\")\r\n| summarize value = strcat_array(make_list(value), \" || \")\r\n| project label = \"All\", value\r\n)\r\n| extend sortOrder = iff(label == \"All\", 0, 1)\r\n| order by sortOrder asc, label asc\r\n| project value, label", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "(@.properties.plan=='Analytics')" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "name": "parameters - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?({selectPlan:value})]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 0, "title": "Retention and Plan details for All Tables, selected: {selectPlan:label} | {selectPlan:value}", "showRefreshButton": true, "showExportToExcel": true, "queryType": 12, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "text": "Auxiliary/data lake" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } } ], "rowLimit": 1000, "filter": true, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "TableRetentionQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Usage\r\n//| where StartTime {TimeRange:value}\r\n//| summarize ['Table Size'] =sum(Quantity)/1000 by ['Table Name'] =DataType,['IsBillable'] =IsBillable\r\n//| order by ['Table Size'] desc\r\n \r\nlet list_ = \r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n// Pre-aggregate mapping per table\r\nlet mapping =\r\nlist_\r\n| summarize\r\n solution_Names = array_sort_asc(make_set(solution_Name)),\r\n connector_ids = array_sort_asc(make_set(connector_id)), connector_description=any(connector_description), solution_support_link=any(solution_support_link)\r\n by Table\r\n| extend solution_Names = trim(@\"[^\\w]+\",tostring(solution_Names))\r\n| extend solution_Names = replace(@\"\"\"\", \" \", tostring(solution_Names))\r\n| extend connector_ids = trim(@\"[^\\w]+\",tostring(connector_ids))\r\n| extend connector_ids = replace(@\"\"\"\", \" \", tostring(connector_ids))\r\n;\r\n// Main query: table size + enrichment\r\nUsage\r\n| summarize ['Table Size'] = sum(Quantity) / 1000\r\n by ['Table Name'] = DataType, ['IsBillable'] = IsBillable\r\n| join kind=leftouter mapping\r\n on $left.['Table Name'] == $right.Table\r\n| extend solution_Names = iif(isempty(solution_Names) and ['Table Name'] endswith '_CL',\"Custom Log\",solution_Names) \r\n//| extend solution_Names = iif(isempty(solution_Names) and ['Table Name'] startswith 'Device',\"Microsoft Defender\",solution_Names) \r\n| project\r\n ['Table Name'],\r\n ['Table Size'],\r\n ['IsBillable'],\r\n solution_Names,\r\n connector_ids, connector_description\r\n| order by ['Table Size'] desc\r\n", "size": 0, "showAnalytics": true, "title": "Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "endsWith", "thresholdValue": "_CL", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "300px" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "green", "text": "True" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "conditionalVisibilities": [ { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "query -Usage Query Basic" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Usage\r\n//| where StartTime {TimeRange:value}\r\n//| summarize ['Table Size'] =sum(Quantity)/1000 by ['Table Name'] =DataType,['IsBillable'] =IsBillable\r\n//| order by ['Table Size'] desc\r\n \r\nlet list_ = \r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n// Pre-aggregate mapping per table\r\nlet mapping =\r\nlist_\r\n| summarize\r\n solution_Names = array_sort_asc(make_set(solution_Name)),\r\n connector_ids = array_sort_asc(make_set(connector_id)), connector_description=any(connector_description), solution_support_link=any(solution_support_link)\r\n by Table\r\n| extend solution_Names = trim(@\"[^\\w]+\",tostring(solution_Names))\r\n| extend solution_Names = replace(@\"\"\"\", \" \", tostring(solution_Names))\r\n| extend connector_ids = trim(@\"[^\\w]+\",tostring(connector_ids))\r\n| extend connector_ids = replace(@\"\"\"\", \" \", tostring(connector_ids))\r\n;\r\n// Main query: table size + enrichment\r\nUsage\r\n| summarize ['Table Size'] = sum(Quantity) / 1000\r\n by ['Table Name'] = DataType, ['IsBillable'] = IsBillable\r\n| join kind=leftouter mapping\r\n on $left.['Table Name'] == $right.Table\r\n| extend solution_Names = iif(isempty(solution_Names) and ['Table Name'] endswith '_CL',\"Custom Log\",solution_Names) \r\n//| extend solution_Names = iif(isempty(solution_Names) and ['Table Name'] startswith 'Device',\"Microsoft Defender\",solution_Names) \r\n| project\r\n ['Table Name'],\r\n ['Table Size'],\r\n ['IsBillable'],\r\n solution_Names,\r\n connector_ids, connector_description\r\n| order by ['Table Size'] desc\r\n", "size": 0, "showAnalytics": true, "title": "Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "endsWith", "thresholdValue": "_CL", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "300px" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "green", "text": "True" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Defender" }, "name": "query -Usage Query Basic - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "", "size": 0, "showAnalytics": true, "title": " Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "endsWith", "thresholdValue": "_CL", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "300px" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "green", "text": "True" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "solution_Names", "sortOrder": 2 } ] }, "conditionalVisibilities": [ { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "query -Usage Query Basic - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\",\"mergeType\":\"innerunique\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"query -Usage Query Basic\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table Name\"}],\"projectRename\":[{\"originalName\":\"[query -Usage Query Basic].Table Name\",\"mergedName\":\"TableName\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].Table Size\",\"mergedName\":\"Table Size\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].solution_Names\",\"mergedName\":\"solution_Names\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].connector_ids\",\"mergedName\":\"connector_ids\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].connector_description\",\"mergedName\":\"connector_description\",\"fromId\":\"unknown\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"TableInteractivePeriod\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"TableArchivePeriod\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetentionPeriod\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"e5664cd1-2696-42e2-a85b-d8634f6bd0d9\"},{\"originalName\":\"[query -Usage Query Basic].solution_support_link\",\"mergedName\":\"solution_support_link\",\"fromId\":\"unknown\"},{\"originalName\":\"[TableRetentionQuery].TableName\"},{\"originalName\":\"[TableRetentionQuery].TableType\"}]}", "size": 0, "title": " Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB. Click row for more details, count: {$rowCount}", "exportFieldName": "TableName", "exportParameterName": "exportTable", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "representation": null, "text": "Auxiliary / data lake" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "False", "representation": "green", "text": "True" }, { "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "False" }, { "operator": "Default", "thresholdValue": null, "text": "False" } ] } }, { "columnMatch": "Table Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "endsWith", "thresholdValue": "_CL", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "showPin": false, "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let getdata_=\r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\ngetdata_\r\n| where Table == '{exportTable}'\r\n| project-reorder Table, connector_title\r\n", "size": 0, "title": "you selected: {exportTable} to gain extra insights, note: only works for a Table that has a Solution_Name", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "connector_title", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Deprecated", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "solution_Folder", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "solution_support_link", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } } ], "sortBy": [ { "itemKey": "$gen_thresholds_connector_title_1", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_connector_title_1", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "exportTable", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//find where TimeGenerated {TimeRange:query} project _BilledSize, _IsBillable, Computer, DataType, TimeGenerated\r\nUsage\r\n| where StartTime {TimeRange:value}\r\n| make-series Trend=sum(Quantity)/1000 , count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} \r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n| project baseline, Trend //, count_\r\n", "size": 4, "title": "High level - Overview for {TimeRange:label}", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "baseline", "formatter": 21, "formatOptions": { "palette": "purple" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "blue" } }, { "columnMatch": "count_", "formatter": 10, "formatOptions": { "palette": "greenDarkDark" } }, { "columnMatch": "TimeGenerated", "formatter": 5 }, { "columnMatch": "anomalies", "formatter": 5 }, { "columnMatch": "score", "formatter": 5 } ], "labelSettings": [ { "columnId": "baseline", "label": "BilledSize Baseline" }, { "columnId": "Trend", "label": "BilledSize" } ] } }, "customWidth": "30", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, "name": "query - 13", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "print strcat('{GBperday}',' GB'), display = \"average per day\", range = strcat('Ingestion For: ','{TimeRange:label}')", "size": 4, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "subtitleContent": { "columnMatch": "display" }, "leftContent": { "columnMatch": "range" }, "showBorder": false } }, "customWidth": "20", "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 *\r\n| where TimeGenerated {TimeRange:query}\r\n| project _BilledSize, _IsBillable, TimeGenerated, TableName1\r\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\"second\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by TableName1, _IsBillable\r\n| project ['Table Name'] = TableName1, ['Table Size'] = Size, ['Table Entries'] = Entries,\r\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable, ['Latest Record Created'] = last_log //, ['Latest Record Recieved'] =last_ingestion\r\n | order by ['Table Size'] desc\r\n\r\n ", "size": 0, "showAnalytics": true, "title": "{Workspace:name} Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB", "timeContextFromParameter": "TimeRange", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 3 } } }, { "columnMatch": "Size per Entry", "formatter": 3, "formatOptions": { "min": 0, "palette": "orange" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Latest Record Created", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Time when record was created at data source" } }, { "columnMatch": "Latest Record Recieved", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Time when Record stored in workspace and available for queries" } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - 2" }, { "type": 1, "content": { "json": "### Columns explained\r\n- Table Name:The Log Analytics workspace Table\r\n- Table Size: The sum of data stored in the Table. \r\n- Table Entries: The count of each row in the Table. \r\n- Size per Entry: Average capacity size of each row of data.\r\n- IsBillable: Shows if the Table is Billable or Free (True/False).\r\n- Last Record Received: What was the time that the last record of data was received? \t \t ", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "find where TimeGenerated {TimeRange:query} project _BilledSize, _IsBillable, Computer, DataType, TimeGenerated\r\n| where '{Table}' == 'All Tables' or DataType == '{Table}'\r\n| make-series TableSize = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n//| mv-expand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", "size": 1, "showAnalytics": true, "title": "Table Entries, count over time: {TimeRange:label}", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| make-series TableSize = sum(Quantity) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} \r\n//| mv-expand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", "size": 1, "showAnalytics": true, "title": "Table Size, sum over time of capacity: {TimeRange:label}", "color": "blue", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize sum(Quantity) by bin(TimeGenerated, 1d), DataType\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Weekly Average Table Usage ", "color": "blue", "timeContext": { "durationMs": 604800000 }, "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "Average Events per Second (eps)", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Minimum eps", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Maximum eps", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Other", "color": "green" } ] } }, "customWidth": "100", "name": "query - 7 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize sum(Quantity) by bin(TimeGenerated, 1d), DataType\r\n\r\n\r\n", "size": 1, "showAnalytics": true, "title": "Monthly Average Table Usage : Time Brush Enabled", "color": "blue", "timeContext": { "durationMs": 2592000000 }, "timeBrushParameterName": "tbMthlyUsage", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "Average Events per Second (eps)", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Minimum eps", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Maximum eps", "formatter": 3, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true }, "sortBy": [], "chartSettings": { "createOtherGroup": 30, "seriesLabelSettings": [ { "seriesName": "Other", "color": "green" } ] } }, "customWidth": "100", "name": "query - 7 - mthly table usage " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 *\r\n| summarize count() by TableName = TableName1, _ResourceId\r\n| order by count_ desc\r\n\r\n\r\n\r\n\r\n ", "size": 1, "showAnalytics": true, "title": "Details from Monthly Average Table Usage : Time brushed to: {tbMthlyUsage:label}", "color": "blue", "timeContextFromParameter": "tbMthlyUsage", "timeBrushParameterName": "tbMthlyUsage", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Other", "color": "green" } ], "xSettings": {}, "ySettings": {} } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, "name": "query - 7 - mthly table usage - Copy" }, { "type": 1, "content": { "json": "Use the above four charts to check your Records, Size and Weekly/ Monthly averages.\r\nThe Weekly and Monthly charts are especially useful to see if one data type is growing or shrinking.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 6" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" }, "name": "group - workspaceInfo" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Basic Workspace Details", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-08-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}", "size": 0, "title": "Workspace Details", "queryType": 12, "sortBy": [] }, "customWidth": "50", "name": "query - 11 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/intelligencePacks\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-08-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"\",\"columns\":[{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"enabled\",\"columnid\":\"enabled\"},{\"path\":\"displayname\",\"columnid\":\"displayname\"}]}}]}", "size": 0, "title": "Intelligence Packs", "queryType": 12, "gridSettings": { "sortBy": [ { "itemKey": "enabled", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "enabled", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/usages\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-08-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}", "size": 0, "title": "Workspace Usages", "queryType": 12, "sortBy": [] }, "customWidth": "50", "name": "query - 11 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/availableServiceTiers\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-08-01\"}],\"batchDisabled\":false,\"transformers\":null}", "size": 0, "title": "Workspace Service Tier", "queryType": 12, "sortBy": [] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - 11 - Copy - Copy - Copy - Copy" } ] }, "conditionalVisibilities": [ { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "group - Workspace Details" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Advanced Workspace details", "expandable": true, "items": [ { "type": 1, "content": { "json": "You need to enable this for Workspace Query auditing \r\nhttps://docs.microsoft.com/azure/azure-monitor/log-query/query-audit", "style": "warning" }, "name": "text - 12" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "d23b4bfd-16c6-4aa1-a261-9d9e5a249ba9", "version": "KqlParameterItem/1.0", "name": "WorkspaceAudit", "label": "Workspace to Audit", "type": 5, "description": "Audit any Workspace", "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend _selected = iif(id == '{Workspace}', true, false)\r\n| project id, val=id, _selected", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "50", "name": "parameters - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| extend _found = iif (properties.displayName startswith \"Workspace audit\" , id ,tostring(False) )\r\n| where _found !=\"False\"\r\n| project Workbook =_found //, name = properties.displayName\r\n\r\n\r\n //| limit 1", "size": 4, "title": "Click to Open [Workspace Audit] Workbook if it exists?", "noDataMessage": "Info, no workbook was found, please enable [Workspace Audit] template, and save as \"Workspace audit\"", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Workbook", "formatter": 7, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkLabel": "Open dedicated Workbook for auditing", "linkIsContextBlade": true } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// needs https://docs.microsoft.com/azure/azure-monitor/log-query/query-audit\r\nLAQueryLogs\r\n| extend code_ = case(ResponseCode == 200,\"200 OK\", ResponseCode == 400,\"400 Bad Request\", ResponseCode == 401,\"401 Unauthorized\",ResponseCode == 503,\"503 Service Unavailable\",ResponseCode == 504,\"504 Gateway Timeout\",\r\n//else\r\nstrcat(\"Unknown or undefined code: \", ResponseCode))\r\n| summarize count() by ResponseCode, code_\r\n| order by count_ desc\r\n", "size": 1, "title": "LAQuery Diagnostics: count by Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkspaceAudit}" ], "visualization": "piechart", "chartSettings": { "yAxis": [ "count_" ] } }, "customWidth": "50", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// needs https://docs.microsoft.com/azure/azure-monitor/log-query/query-audit\r\nLAQueryLogs\r\n| summarize count() by RequestClientApp\r\n| order by count_ desc\r\n", "size": 1, "title": "LAQuery Diagnostics: count by product ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkspaceAudit}" ], "visualization": "piechart", "chartSettings": { "yAxis": [ "count_" ] } }, "customWidth": "50", "name": "query - 10 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// needs https://docs.microsoft.com/azure/azure-monitor/log-query/query-audit\r\nLAQueryLogs\r\n| summarize dcount(QueryText) by AADEmail\r\n| where isnotempty(AADEmail)\r\n| order by dcount_QueryText desc\r\n", "size": 1, "title": "LAQuery Diagnostics: count by User", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkspaceAudit}" ], "visualization": "piechart", "chartSettings": { "yAxis": [ "dcount_QueryText" ] } }, "customWidth": "50", "name": "query - 10 - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{WorkspaceAudit}" ], "parameters": [ { "id": "d1f27b79-2133-475a-88de-37bcda5be757", "version": "KqlParameterItem/1.0", "name": "filterProduct", "label": "Filter by product, order by highest count ", "type": 10, "isRequired": true, "query": "LAQueryLogs\r\n| where isnotempty(RequestClientApp)\r\n| summarize count() by RequestClientApp\r\n| order by count_ desc\r\n| extend label = strcat(RequestClientApp,\" (\",count_,\")\")\r\n//| extend a = pack_array(label, \"Show All\")\r\n| project RequestClientApp, label", "crossComponentResources": [ "{WorkspaceAudit}" ], "value": "ChangeTracking", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "LAQueryLogs\r\n| where RequestClientApp ==\"{filterProduct}\" \r\n| extend code_ = case(ResponseCode == 200,\"200 OK\", ResponseCode == 400,\"400 Bad Request\", ResponseCode == 401,\"401 Unauthorized\",ResponseCode == 503,\"503 Service Unavailable\",ResponseCode == 504,\"504 Gateway Timeout\",\r\n//else\r\nstrcat(\"Unknown or undefined code: \", ResponseCode))\r\n| project TimeGenerated, AADEmail, ResponseCode = code_, RequestClientApp, ResponseRowCount, ResponseDurationMs, StatsCPUTimeMs, StatsDataProcessedKB, StatsDataProcessedStart, StatsDataProcessedEnd, QueryText, AADClientId\r\n| order by TimeGenerated desc", "size": 1, "title": "LAQuery Diagnostics: Statistics for: {filterProduct:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkspaceAudit}" ], "gridSettings": { "formatters": [ { "columnMatch": "ResponseCode", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "400", "representation": "failed", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Unknown", "representation": "unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "ResponseRowCount", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "ResponseDurationMs", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "StatsCPUTimeMs", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "StatsDataProcessedKB", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_ResponseRowCount_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_ResponseRowCount_4", "sortOrder": 2 } ] }, "name": "query - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{WorkspaceAudit}" ], "parameters": [ { "id": "807f8cec-8875-4156-91e6-2506b97e174d", "version": "KqlParameterItem/1.0", "name": "filterAADuser", "label": "Show Queries by User", "type": 2, "query": "LAQueryLogs\r\n| summarize by AADEmail\r\n| order by AADEmail asc", "crossComponentResources": [ "{WorkspaceAudit}" ], "value": null, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "LAQueryLogs\r\n| where AADEmail == '{filterAADuser}'\r\n| project TimeGenerated, AADEmail, QueryText, ResponseDurationMs, StatsCPUTimeMs, StatsDataProcessedKB\r\n| order by TimeGenerated desc", "size": 1, "title": "LAQuery Diagnostics: Statistics for: {filterAADuser:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkspaceAudit}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 5 }, { "columnMatch": "QueryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "ResponseDurationMs", "formatter": 3, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "StatsCPUTimeMs", "formatter": 3, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "StatsDataProcessedKB", "formatter": 3, "formatOptions": { "palette": "greenRed" } } ], "filter": true }, "sortBy": [] }, "name": "query - 11 - Copy" } ] }, "conditionalVisibilities": [ { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "WorkspaceInfo" } ], "name": "group - wsAdvanced" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Microsoft Sentinel", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n// Just show Workspaces - will use this to see Creation diff between Workspace and when Sentinel is added \r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| project Workspace=id, WorkspaceName=name, properties.sku.name, properties.sku.capacityReservationLevel, W_CreatedDate=properties.createdDate, W_modifedDate=properties.modifiedDate, properties.sku.lastSkuUpdate", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "30", "representation": "yellow", "text": "Free {1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "Hide", "comparison": "isEqualTo", "value": "Hide" }, "name": "query - ARG All workspaces" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n// Just show Workspaces that have Sentinel enabled\r\n| where type == \"microsoft.operationsmanagement/solutions\"\r\n| where name has \"SecurityInsights\"\r\n| parse name with * '(' s_workspace ')'*\r\n| project s_workspace, name, properties.creationTime, properties.lastModifiedTime , ['Days Enabled'] = datetime_diff('day',now(),todatetime(properties.creationTime)), ['SKU']=properties.sku.name, CapacityReservation=properties.sku.capacityReservationLevel", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "30", "representation": "yellow", "text": "Free {1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } } ], "labelSettings": [ { "columnId": "s_workspace", "label": "Workspace Name" }, { "columnId": "name", "label": "Solution Name", "comment": "Sentinel is present" } ] } }, "conditionalVisibility": { "parameterName": "Hide", "comparison": "isEqualTo", "value": "Hide" }, "name": "query - ARG Sentinel workspaces" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"14b104f4-4935-413b-943d-166bee783118\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - ARG All workspaces\",\"rightTable\":\"query - ARG Sentinel workspaces\",\"leftColumn\":\"WorkspaceName\",\"rightColumn\":\"s_workspace\"}],\"projectRename\":[{\"originalName\":\"[query - ARG All workspaces].Workspace\",\"mergedName\":\"Workspace\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG All workspaces].WorkspaceName\",\"mergedName\":\"WorkspaceName\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG All workspaces].W_CreatedDate\",\"mergedName\":\"W_CreatedDate\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG All workspaces].W_modifedDate\",\"mergedName\":\"W_modifedDate\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG Sentinel workspaces].s_workspace\",\"mergedName\":\"Workspace Name\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG Sentinel workspaces].name\",\"mergedName\":\"Solution Name\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG Sentinel workspaces].properties_creationTime\",\"mergedName\":\"FirstCreated\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG Sentinel workspaces].properties_lastModifiedTime\",\"mergedName\":\"LastModified\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG Sentinel workspaces].Days Enabled\",\"mergedName\":\"Days Enabled\",\"fromId\":\"14b104f4-4935-413b-943d-166bee783118\"},{\"originalName\":\"[query - ARG All workspaces].properties_sku_name\",\"mergedName\":\"properties_sku_name\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG All workspaces].properties_sku_lastSkuUpdate\",\"mergedName\":\"properties_sku_lastSkuUpdate\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].id\",\"mergedName\":\"id\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].type\",\"mergedName\":\"type\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].tenantId\",\"mergedName\":\"tenantId\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].kind\",\"mergedName\":\"kind\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].location\",\"mergedName\":\"location\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].managedBy\",\"mergedName\":\"managedBy\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].sku\",\"mergedName\":\"sku\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].plan\",\"mergedName\":\"plan\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].properties\",\"mergedName\":\"properties\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].tags\",\"mergedName\":\"tags\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].identity\",\"mergedName\":\"identity\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].zones\",\"mergedName\":\"zones\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].extendedLocation\",\"mergedName\":\"extendedLocation\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].Sentinel SKU\",\"mergedName\":\"Sentinel SKU\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].SKU\",\"mergedName\":\"SKU\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG All workspaces].properties_sku_capacityReservationLevel\",\"mergedName\":\"properties_sku_capacityReservationLevel\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].properties_sku_capacityReservationLevel\",\"mergedName\":\"properties_sku_capacityReservationLevel\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - Sentinel workspaces].CapacityReservation\",\"mergedName\":\"CapacityReservation\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].SKU\",\"mergedName\":\"SKU\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ARG Sentinel workspaces].CapacityReservation\",\"mergedName\":\"CapacityReservation\",\"fromId\":\"unknown\"}]}", "size": 4, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "WorkspaceName", "formatter": 5 }, { "columnMatch": "Workspace Name", "formatter": 5 }, { "columnMatch": "Solution Name", "formatter": 5 }, { "columnMatch": "Days Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "30", "representation": "yellow", "text": "{0} (Free Trial)" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } } ], "labelSettings": [ { "columnId": "Workspace", "label": "Log Analytics Workspace Name" }, { "columnId": "W_CreatedDate", "label": "Workspace Created" }, { "columnId": "W_modifedDate", "label": "Workspace Modified" }, { "columnId": "properties_sku_name", "label": "Workspace SKU name", "comment": "Log Analyitcs licence SKU" }, { "columnId": "properties_sku_lastSkuUpdate", "label": "Workspace SKU Last Update" }, { "columnId": "SKU", "label": "Sentinel SKU name", "comment": "Sentinel setting" } ] } }, "showPin": false, "name": "query - 7" }, { "type": 1, "content": { "json": "If an Sentinel Workspace has been enabled for less than 30days is likely to be in the Free Trial period. The report above shows when a Workspace was first created and when Sentinel was associated with it.\r\nAlso on this Page\r\n- Top 10 Operations actions from the AzureActicity log for Sentinel. \r\n- Select a Table (only Sentinel ones are listed) to see more details. ", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "901f55ea-4d78-40ad-af30-b3afa4dcd6fe", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "On-boarding", "subTarget": "onboarding", "preText": "Anomaly", "style": "link" }, { "id": "461c8479-fe48-4049-aac4-53a6cdfc355d", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "SOC metrics", "subTarget": "soc", "preText": "Anomaly", "style": "link" }, { "id": "2369c5fe-8d81-4a2f-94c8-f488fd743ac5", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Identity metrics", "subTarget": "identity", "preText": "Anomaly", "style": "link" }, { "id": "b796ccd5-7050-4ade-af82-64d3501dfee7", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Anomaly", "subTarget": "anomaly", "preText": "Anomaly", "style": "link" }, { "id": "dab8b902-109a-446d-85b0-404678b5da60", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Activity", "subTarget": "activity", "style": "link" }, { "id": "eaf79655-0ce3-426b-bbea-00f4da3f74e9", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "WatchList", "subTarget": "watchlist", "style": "link" }, { "id": "ca8ed1db-d2c0-452e-ae1e-70c0372b373f", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "TI feed", "subTarget": "ti", "style": "link" }, { "id": "6227078a-e3ec-4f52-a4c3-bb54980f3b4c", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Solution mapping", "subTarget": "solutionNew", "style": "link" }, { "id": "e99f0885-1285-40ab-b032-73462e5b99fc", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Repositories", "subTarget": "repo", "style": "link" }, { "id": "3f88307b-52b5-4186-b063-1331461128a8", "cellValue": "selectedSentinelTab", "linkTarget": "parameter", "linkLabel": "Hunting ", "subTarget": "hunt", "style": "link" } ] }, "name": "links - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Solution Mapping ", "items": [ { "type": 1, "content": { "json": "This report is based on the tool created by Ofer Shezaf https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Solutions%20Analyzer\r\n\r\nHere you select one or more values to filter (common parameters), the results will show all rows.\r\n\r\nFor more on the solution: https://www.linkedin.com/posts/oshezaf_i-get-asked-all-the-time-which-tables-each-activity-7401808297906814976-9Acl?utm_source=share&utm_medium=member_desktop&rcm=ACoAAADW7PABQDOx9h1drf2J3zAjiIe3Ei4z2ss" }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c1a9b7f2-6a5d-4e2a-9b1c-0f7e8d9a0001", "version": "KqlParameterItem/1.0", "name": "p_TablePresent", "label": "Table exists in Workspace", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table: string, solution_Name: string, solution_Folder: string, solution_publisher_id: string, solution_offer_id: string, solution_first_publish_date: datetime, solution_last_publish_date: datetime, solution_version: string, solution_support_name: string, solution_support_tier: string, solution_support_link: string, solution_author_name: string, solution_categories: string, connector_id: string, connector_publisher: string, connector_title: string, connector_description: string, connector_instruction_steps: string, connector_permissions: string, connector_files: string, is_unique: bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true);\r\nlet existing_tables = Usage\r\n | where TimeGenerated > ago(30d)\r\n | summarize by DataType;\r\nlist_\r\n| join kind=leftouter (existing_tables\r\n | project TableExists = DataType)\r\n on $left.Table == $right.TableExists\r\n| extend TablePresent = case(isempty(Table), \"Table missing\", isnotempty(TableExists), 'Table exists', 'Table isnt enabled')\r\n| summarize by TablePresent\r\n| order by TablePresent asc\r\n| project value = TablePresent, label = TablePresent", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "limitSelectTo": 1, "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "d5d6722f-98fa-45d7-9818-bd2d53837a5a", "version": "KqlParameterItem/1.0", "name": "p_Table", "label": "Table", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(Table) | summarize by Table | order by Table asc | project value = Table, label = Table", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "8f4dc8a9-c9d3-4f8a-bcb2-0f02e8f0e101", "version": "KqlParameterItem/1.0", "name": "p_solution_Name", "label": "Solution Name", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(solution_Name) | summarize by solution_Name | order by solution_Name asc | project value = solution_Name, label = solution_Name", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "3aa3e5de-c6eb-4b99-b1d7-a9ae4b98d105", "version": "KqlParameterItem/1.0", "name": "p_solution_version", "label": "Solution Version", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(solution_version) | summarize by solution_version | order by solution_version asc | project value = solution_version, label = solution_version", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "4de81a53-98f4-46cb-a0ad-cfbdf9985106", "version": "KqlParameterItem/1.0", "name": "p_solution_support_name", "label": "Solution Support Name", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(solution_support_name) | summarize by solution_support_name | order by solution_support_name asc | project value = solution_support_name, label = solution_support_name", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "f3c1c7d2-d80f-4bfc-a691-c1a0c97e3108", "version": "KqlParameterItem/1.0", "name": "p_solution_author_name", "label": "Solution Author Name", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(solution_author_name) | summarize by solution_author_name | order by solution_author_name asc | project value = solution_author_name, label = solution_author_name", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "482e27b5-d14b-4c21-bdb3-3c3d81a4e110", "version": "KqlParameterItem/1.0", "name": "p_connector_id", "label": "Connector ID", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(connector_id) | summarize by connector_id | order by connector_id asc | project value = connector_id, label = connector_id", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "5f0cb0c4-7b97-48e4-9b53-e018df58b111", "version": "KqlParameterItem/1.0", "name": "p_connector_publisher", "label": "Connector Publisher", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(connector_publisher) | summarize by connector_publisher | order by connector_publisher asc | project value = connector_publisher, label = connector_publisher", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "a37dc7fc-f49a-468c-9380-b9d9ba4f3112", "version": "KqlParameterItem/1.0", "name": "p_connector_title", "label": "Connector Title", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | where isnotempty(connector_title) | summarize by connector_title | order by connector_title asc | project value = connector_title, label = connector_title", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "3f8c790e-6c2d-476f-bfc1-bf05dcb08113", "version": "KqlParameterItem/1.0", "name": "p_is_unique", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let list_ = externaldata (Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string, solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string, solution_support_name:string, solution_support_tier:string, solution_support_link:string, solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string, connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool)[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=true); list_ | summarize by is_unique | order by is_unique asc | project value = tostring(is_unique), label = tostring(is_unique)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Is Unique", "value": [ "value::all" ] } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - simplified" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let startTime = todatetime({TimeRange:start});\r\nlet endTime = todatetime({TimeRange:end});\r\nlet lookbackDays = max_of(1.0, todouble((endTime - startTime) / 1d));\r\n\r\nlet list_ = \r\nexternaldata (\r\n Table:string,\r\n solution_Name:string,\r\n solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n connector_id:string,\r\n connector_publisher:string,\r\n connector_title:string,\r\n connector_description:string,\r\n connector_instruction_steps:string,\r\n connector_permissions:string,\r\n connector_files:string,\r\n is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true)\r\n| extend Table = trim(\" \", tostring(Table));\r\n\r\nlet existing_tables =\r\nUsage\r\n| extend UsageTable = trim(\" \", tostring(DataType))\r\n| summarize TableExists = any(\"yes\") by UsageTable;\r\n\r\nlet usage_stats =\r\nUsage\r\n| where TimeGenerated between (startTime .. endTime)\r\n| extend UsageTable = trim(\" \", tostring(DataType))\r\n| summarize UsageIngestedGB = sum(Quantity) / 1024.0 by UsageTable\r\n| extend UsageAverageDailyGB = UsageIngestedGB / todouble(lookbackDays);\r\n\r\nlist_\r\n| where \"All\" in ({p_Table}) or Table in ({p_Table})\r\n| where \"All\" in ({p_solution_Name}) or solution_Name in ({p_solution_Name})\r\n| where \"All\" in ({p_solution_version}) or solution_version in ({p_solution_version})\r\n| where \"All\" in ({p_solution_support_name}) or solution_support_name in ({p_solution_support_name})\r\n| where \"All\" in ({p_solution_author_name}) or solution_author_name in ({p_solution_author_name})\r\n| where \"All\" in ({p_connector_id}) or connector_id in ({p_connector_id})\r\n| where \"All\" in ({p_connector_publisher}) or connector_publisher in ({p_connector_publisher})\r\n| where \"All\" in ({p_connector_title}) or connector_title in ({p_connector_title})\r\n| where \"All\" in ({p_is_unique}) or tostring(is_unique) in ({p_is_unique})\r\n| join kind=leftouter (\r\n existing_tables\r\n) on $left.Table == $right.UsageTable\r\n| join kind=leftouter (\r\n usage_stats\r\n) on $left.Table == $right.UsageTable\r\n| extend TablePresent = case(\r\n isempty(Table), \"Table missing\",\r\n isnotempty(TableExists), \"Table exists\",\r\n \"Table isn't enabled\"\r\n)\r\n| extend\r\n IngestedGB = round(coalesce(UsageIngestedGB, 0.0), 4),\r\n AverageDailyGB = round(coalesce(UsageAverageDailyGB, 0.0), 4)\r\n| project\r\n Table,\r\n TablePresent,\r\n AverageDailyGB,\r\n IngestedGB,\r\n solution_Name,\r\n solution_Folder,\r\n solution_publisher_id,\r\n solution_offer_id,\r\n solution_first_publish_date,\r\n solution_last_publish_date,\r\n solution_version,\r\n solution_support_name,\r\n solution_support_tier,\r\n solution_support_link,\r\n solution_author_name,\r\n solution_categories,\r\n connector_id,\r\n connector_publisher,\r\n connector_title,\r\n connector_description,\r\n connector_instruction_steps,\r\n connector_permissions,\r\n connector_files,\r\n is_unique\r\n| where \"All\" in ({p_TablePresent}) or TablePresent in ({p_TablePresent})\r\n| order by Table asc", "size": 0, "title": "Show Tables from the Sentinel Solutions Analyzer, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "solution_Name", "parameterName": "export_solution_Name", "parameterType": 1 }, { "fieldName": "Table", "parameterName": "export_Table", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TablePresent", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Table missing", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Table isn't enabled", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "AverageDailyGB", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "IngestedGB", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "connector_permissions", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "connector_files", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ], "rowLimit": 5000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Table" ], "expandTopLevel": true, "finalBy": "Table" }, "sortBy": [ { "itemKey": "$gen_number_IngestedGB_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_number_IngestedGB_4", "sortOrder": 2 } ] }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let content_tables = \r\nexternaldata (\r\n Table:string,\r\n solution_Name:string,\r\n solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n content_kind:string,\r\n content_id:string,\r\n content_name:string,\r\n content_description:string,\r\n content_path:string\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/content_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n\r\n// Total rows for the solution version before later filters\r\nlet solution_totals =\r\ncontent_tables\r\n| where solution_Name == \"{export_solution_Name}\"\r\n| summarize TotalCount = count() by solution_version;\r\n\r\n// Current filtered rows\r\nlet filtered_rows =\r\ncontent_tables\r\n| where solution_Name == \"{export_solution_Name}\"\r\n| where solution_version == \"{export_Table}\";\r\n\r\nfiltered_rows\r\n| summarize FoundCount = count() by solution_publisher_id, solution_version, solution_Folder, solution_offer_id\r\n| join kind=leftouter solution_totals on solution_version\r\n| extend NotFoundCount = TotalCount - FoundCount\r\n| extend FoundSummary = strcat(FoundCount, \" of \", TotalCount)\r\n| project\r\n solution_publisher_id,\r\n solution_version,\r\n solution_Folder,\r\n FoundCount,\r\n NotFoundCount,\r\n //TotalCount,\r\n FoundSummary, \r\n solution_offer_id", "size": 0, "title": "Details by Content kind:", "timeContextFromParameter": "TimeRange", "exportFieldName": "solution_offer_id", "exportParameterName": "export_solution_offer_id", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "solution_Folder", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "whiteBlack" } } ] }, "sortBy": [] }, "customWidth": "60", "conditionalVisibility": { "parameterName": "export_solution_Name", "comparison": "isNotEqualTo" }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let content_items = \r\nexternaldata (\r\n solution_Name:string,\r\n solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n content_kind:string,\r\n content_id:string,\r\n content_name:string,\r\n content_description:string,\r\n content_path:string,\r\n content_file:string,\r\n content_version:string,\r\n content_last_modified:datetime\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/content_items.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\ncontent_items\r\n| where isnotempty('{export_solution_offer_id}')\r\n| where solution_Name == '{export_solution_offer_id}'", "size": 0, "title": "Details by Content kind: {export_solution_offer_id}", "timeContextFromParameter": "TimeRange", "exportFieldName": "solution_offer_id", "exportParameterName": "export_solution_offer_id", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "solution_Folder", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "whiteBlack" } } ] }, "sortBy": [] }, "customWidth": "60", "conditionalVisibility": { "parameterName": "export_solution_offer_id", "comparison": "isNotEqualTo" }, "name": "query - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let content_tables = \r\nexternaldata (\r\n Table:string,\r\n solution_Name:string,\r\n solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n content_kind:string,\r\n content_id:string,\r\n content_name:string,\r\n content_description:string,\r\n content_path:string\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/content_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\ncontent_tables \r\n| summarize count() by solution_publisher_id\r\n| order by count_ desc", "size": 0, "title": "Overiew by Content kind:", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "whiteBlack" } } ] } }, "customWidth": "40", "name": "query - 3 - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "solutionNew" }, "name": "group - solutionMapping (new)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Hunting", "items": [ { "type": 1, "content": { "json": "# πŸ›‘οΈ Microsoft Defender Hunting & Security Posture\r\n\r\nThis page provides **MDE and MDI hunting queries** to highlight suspicious activity, identity weaknesses, legacy authentication, reconnaissance and security-control changes.\r\n\r\n" }, "name": "text - 29" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "more info", "expandable": true, "items": [ { "type": 1, "content": { "json": "## πŸ“Š Required Data Tables\r\n\r\nQueries use one or more of the following tables. Availability depends on the Defender products, sensors and data connectors deployed in the workspace.\r\n\r\n| Table | Source | Used For |\r\n|---|---|---|\r\n| `DeviceProcessEvents` | MDE | Malware, offensive tooling and suspicious process activity |\r\n| `DeviceRegistryEvents` | MDE | Defender exclusions and registry security changes |\r\n| `DeviceEvents` | MDE | Endpoint security and behavioural telemetry |\r\n| `IdentityLogonEvents` | MDI | Authentication, NTLM, Kerberos, spray and lateral movement |\r\n| `IdentityQueryEvents` | MDI | LDAP reconnaissance and directory enumeration |\r\n| `IdentityAccountInfo` | MDI | Identity and account posture |\r\n| `SecurityEvent` | Sentinel / Windows Security | AD changes, Kerberos 4769 and Windows security auditing |\r\n| `WindowsEvent` | Sentinel / Windows Events | Alternative Windows event collection where configured |\r\n\r\n> ℹ️ **Not all tables are required for every query.** An empty result may mean no matching activity was found, or that the required telemetry is not available in the workspace.\r\n\r\n## 🚦 Risk & Status\r\n\r\nπŸ”΄ **High / Investigate** β€” Prioritise for investigation \r\n🟠 **Medium / Review** β€” Validate and investigate where appropriate \r\n🟒 **Low / Monitor** β€” Lower priority or expected activity\r\n\r\n> ⚠️ **Hunting results are investigative signals, not confirmation of malicious activity.** Always validate findings against the environment, known administrative activity and wider Defender telemetry." }, "name": "text - 0" } ] }, "name": "group - summary" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDE - KNOWN MALWARE / OFFENSIVE TOOL HUNT\r\n// ============================================================\r\n// Hunts process telemetry for known malware and offensive tool names.\r\n// Risk considers both indicator confidence and where the term matched.\r\n// NOTE: Name-based matching is an investigative signal only.\r\n// Malware can be renamed and legitimate activity may contain matching terms.\r\nlet Lookback=30d;\r\nlet Ransomware=dynamic([\"wannacry\",\"notpetya\",\"petya\",\"ryuk\",\"lockbit\",\"clop\",\"akira\",\"revil\",\"maze\",\"conti\",\"blackbasta\",\"hive\",\"royal\",\"ragnarlocker\",\"darkside\",\"gandcrab\"]);\r\nlet Loaders=dynamic([\"emotet\",\"trickbot\",\"dridex\",\"qakbot\",\"qbot\",\"zeus\",\"icedid\",\"iceid\",\"ursnif\",\"gozi\",\"tinba\",\"kronos\",\"valak\",\"socgholish\",\"pikabot\",\"bumblebee\",\"smokeloader\",\"systembc\",\"bazarloader\"]);\r\nlet StealersRATs=dynamic([\"agenttesla\",\"lokibot\",\"azorult\",\"redline\",\"raccoon\",\"formbook\",\"hawkeye\",\"netwire\",\"remcos\",\"njrat\",\"darkcomet\",\"nanocore\",\"quasar\",\"lumma\",\"purelogsstealer\",\"ghostpulse\",\"ducktail\"]);\r\nlet OffensiveTools=dynamic([\"mimikatz\",\"cobaltstrike\",\"metasploit\",\"sliver\",\"covenant\"]);\r\nlet BotnetDestructive=dynamic([\"mirai\",\"gafgyt\",\"hajime\",\"bashlite\",\"echobot\",\"stuxnet\",\"duqu\",\"flame\",\"shamoon\",\"whispergate\",\"conficker\",\"mydoom\",\"sasser\",\"blaster\",\"stormworm\",\"nimda\",\"sqlslammer\"]);\r\nlet OtherMalware=dynamic([\"darkhotel\",\"zacinlo\",\"fireball\",\"triada\",\"olympicvision\",\"pony\",\"godzillaloader\"]);\r\nlet LowerConfidenceTerms=dynamic([\"maze\",\"hive\",\"royal\",\"pony\",\"flame\",\"sliver\",\"covenant\",\"quasar\",\"redline\",\"raccoon\",\"fireball\"]);\r\nlet SuspiciousTerms=array_concat(Ransomware,Loaders,StealersRATs,OffensiveTools,BotnetDestructive,OtherMalware);\r\nDeviceProcessEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where FileName has_any(SuspiciousTerms) or ProcessCommandLine has_any(SuspiciousTerms) or FolderPath has_any(SuspiciousTerms)\r\n| extend SearchText=strcat(FileName,\" \",ProcessCommandLine,\" \",FolderPath)\r\n| extend Type=case(SearchText has_any(Ransomware),\"Ransomware\",SearchText has_any(Loaders),\"Loader / Banking Malware\",SearchText has_any(StealersRATs),\"Stealer / RAT\",SearchText has_any(OffensiveTools),\"Offensive / Post-Exploitation\",SearchText has_any(BotnetDestructive),\"Botnet / Destructive Malware\",SearchText has_any(OtherMalware),\"Other Malware\",\"Unknown\")\r\n| extend MatchLocation=case(FileName has_any(SuspiciousTerms),\"File Name\",ProcessCommandLine has_any(SuspiciousTerms),\"Command Line\",FolderPath has_any(SuspiciousTerms),\"Folder Path\",\"Unknown\")\r\n| extend LowerConfidence=SearchText has_any(LowerConfidenceTerms)\r\n| extend Risk=case(MatchLocation==\"File Name\" and LowerConfidence==false,\"πŸ”΄ High\",MatchLocation==\"File Name\" and LowerConfidence==true,\"🟠 Medium\",MatchLocation==\"Command Line\" and LowerConfidence==false,\"πŸ”΄ High\",MatchLocation==\"Command Line\" and LowerConfidence==true,\"🟠 Medium\",MatchLocation==\"Folder Path\" and LowerConfidence==false,\"🟠 Medium\",MatchLocation==\"Folder Path\" and LowerConfidence==true,\"🟒 Low\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| summarize FirstSeen=min(Timestamp),LastSeen=max(Timestamp),Events=count(),Users=dcount(InitiatingProcessAccountUpn),ExampleUser=any(InitiatingProcessAccountUpn),ExampleCommandLine=any(ProcessCommandLine),ExampleFolderPath=any(FolderPath),ExampleSHA1=any(SHA1),ExampleInitiatingProcess=any(InitiatingProcessFileName),ExampleInitiatingCommandLine=any(InitiatingProcessCommandLine) by Risk,Status,Type,MatchLocation,DeviceName,FileName\r\n| project Risk,Status,Type,MatchLocation,DeviceName,FileName,FirstSeen,LastSeen,Events,Users,ExampleUser,ExampleCommandLine,ExampleFolderPath,ExampleSHA1,ExampleInitiatingProcess,ExampleInitiatingCommandLine\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,LastSeen desc", "size": 0, "title": "Known Malware & Offensive Tool Hunt, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "36ch" } }, { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "36ch" } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk", "Status", "Type" ], "expandTopLevel": true, "finalBy": "Type" } } }, "name": "query - 0 - Copy" }, { "type": 1, "content": { "json": "Identifies process activity containing known malware, ransomware, RAT, stealer, and offensive tooling names across filenames, command lines, and paths." }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - WEAK AUTHENTICATION PROTOCOL USAGE\r\n// ============================================================\r\n// Reviews Active Directory authentication protocols.\r\n// NTLM usage is highlighted for review; Kerberos is retained\r\n// as the preferred/baseline authentication protocol.\r\nlet Lookback = 30d;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where Application == \"Active Directory\"\r\n| where Protocol in (\"Ntlm\", \"Kerberos\")\r\n| extend Risk = case(Protocol == \"Ntlm\", \"🟠 Medium\", Protocol == \"Kerberos\", \"🟒 Low\", \"βšͺ Unknown\"), Status = case(Protocol == \"Ntlm\", \"🟠 Review\", Protocol == \"Kerberos\", \"🟒 Expected\", \"βšͺ Unknown\")\r\n| summarize Events=count(), Users=dcount(AccountUpn), Devices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by Protocol, Risk, Status\r\n| project Risk, Status, Protocol, Events, Users, Devices, FirstSeen, LastSeen\r\n| order by Events desc", "size": 0, "title": "Weak Authentication Protocol, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Identifies Active Directory authentication using NTLM and provides visibility into potentially weaker or legacy authentication activity." }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - NTLM AUTHENTICATION - USER & DEVICE BREAKDOWN\r\n// ============================================================\r\n// Identifies users and devices still authenticating with NTLM.\r\n// Risk prioritises repeated authentication failures and unusual spread.\r\n// NOTE: NTLM usage alone does not indicate compromise.\r\nlet Lookback = 30d;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where Application == \"Active Directory\"\r\n| where Protocol == \"Ntlm\"\r\n| extend User = iff(isnotempty(AccountUpn), AccountUpn, AccountName)\r\n| summarize Events=count(), FailedEvents=countif(ActionType =~ \"LogonFailed\"), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), TargetDevices=dcount(DestinationDeviceName), SourceIPs=dcount(IPAddress), ExampleTargetDevice=any(DestinationDeviceName), ExampleIPAddress=any(IPAddress), ExampleLogonType=any(LogonType) by User, DeviceName\r\n| extend FailureRate=round(100.0 * todouble(FailedEvents) / Events, 1)\r\n| extend Risk=case(FailedEvents >= 100 and FailureRate >= 50, \"πŸ”΄ High\", FailedEvents >= 20 and FailureRate >= 20, \"🟠 Medium\", TargetDevices >= 10 or SourceIPs >= 5, \"🟠 Medium\", FailedEvents > 0, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, User, DeviceName, Events, FailedEvents, FailureRate, TargetDevices, SourceIPs, ExampleTargetDevice, ExampleIPAddress, ExampleLogonType, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, FailureRate desc, FailedEvents desc", "size": 0, "title": "NTLM Authentication – User & Device Breakdown, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4" }, { "type": 1, "content": { "json": "Identifies which users and devices are still using NTLM authentication, helping pinpoint legacy dependencies and prioritise remediation." }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - SUSPICIOUS GEOLOCATION / IP AUTHENTICATION PIVOT\r\n// ============================================================\r\n// Identifies accounts authenticating from multiple IP addresses\r\n// and geographic locations for further investigation.\r\n// NOTE: VPNs, proxies, mobile networks and corporate egress\r\n// infrastructure can legitimately create geographic diversity.\r\nlet Lookback = 30d;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where isnotempty(IPAddress)\r\n| extend User=iff(isnotempty(AccountUpn), AccountUpn, AccountName)\r\n| extend LocationData=parse_json(Location)\r\n| extend Country=tostring(LocationData.CountryName), State=tostring(LocationData.State), City=tostring(LocationData.City)\r\n| summarize Events=count(), FailedEvents=countif(ActionType =~ \"LogonFailed\"), UniqueIPs=dcount(IPAddress), Countries=dcountif(Country, isnotempty(Country)), Cities=dcountif(City, isnotempty(City)), IPAddresses=make_set(IPAddress, 20), CountryList=make_set(Country, 10), CityList=make_set(City, 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by User\r\n| extend FailureRate=round(100.0 * todouble(FailedEvents) / Events, 1)\r\n| where UniqueIPs >= 3 or Countries >= 2 or FailedEvents >= 20\r\n| extend Risk=case(Countries >= 4, \"πŸ”΄ High\", Countries >= 2 and FailureRate >= 20 and FailedEvents >= 20, \"πŸ”΄ High\", UniqueIPs >= 20 and FailureRate >= 20, \"πŸ”΄ High\", Countries >= 2, \"🟠 Medium\", UniqueIPs >= 10 or FailedEvents >= 20, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, User, Events, FailedEvents, FailureRate, UniqueIPs, Countries, Cities, CountryList, CityList, IPAddresses, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, Countries desc, UniqueIPs desc", "size": 0, "title": "Suspicious Geolocation & IP Authentication Pivot, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy" }, { "type": 1, "content": { "json": "Identifies accounts authenticating across multiple IP addresses and geographic locations, highlighting unusual authentication spread for investigation." }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - LDAP RECONNAISSANCE / DIRECTORY ENUMERATION\r\n// ============================================================\r\n// Identifies accounts and devices performing high-volume or\r\n// diverse LDAP queries against Active Directory.\r\n// NOTE: LDAP activity is common for legitimate applications,\r\n// management tools, identity platforms and administrative tasks.\r\nlet Lookback = 30d;\r\nIdentityQueryEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where isnotempty(Query)\r\n| extend User=iff(isnotempty(AccountUpn), AccountUpn, AccountName)\r\n| summarize Events=count(), UniqueQueries=dcount(Query), ExampleQueries=make_set(Query, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by User, DeviceName\r\n| where Events >= 50 or UniqueQueries >= 10\r\n| extend Risk=case(Events >= 1000 and UniqueQueries >= 50, \"πŸ”΄ High\", UniqueQueries >= 100, \"πŸ”΄ High\", Events >= 250 or UniqueQueries >= 25, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, User, DeviceName, Events, UniqueQueries, ExampleQueries, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, UniqueQueries desc, Events desc", "size": 0, "title": "LDAP Reconnaissance & Directory Enumeration, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies accounts and devices performing high-volume or diverse LDAP queries that may indicate Active Directory discovery, reconnaissance, or enumeration activity." }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - KERBEROASTING / SUSPICIOUS SERVICE TICKET REQUESTS\r\n// ============================================================\r\n// Identifies unusual volumes of Kerberos ticket requests that\r\n// may indicate Kerberoasting or automated service discovery.\r\n// NOTE: High Kerberos activity can be legitimate for service\r\n// accounts, applications and administrative infrastructure.\r\nlet Lookback = 30d;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where Protocol =~ \"Kerberos\"\r\n| where ActionType =~ \"TicketRequested\"\r\n| extend User=iff(isnotempty(AccountUpn), AccountUpn, AccountName)\r\n| summarize TicketRequests=count(), TargetDevices=dcount(DestinationDeviceName), SourceDevices=dcount(DeviceName), SourceIPs=dcount(IPAddress), ExampleTargetDevices=make_set(DestinationDeviceName, 10), ExampleSourceIPs=make_set(IPAddress, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by User\r\n| where TicketRequests >= 20\r\n| extend Risk=case(TicketRequests >= 500 and TargetDevices >= 20, \"πŸ”΄ High\", TicketRequests >= 200 and TargetDevices >= 10, \"πŸ”΄ High\", TicketRequests >= 100 or TargetDevices >= 5, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, User, TicketRequests, TargetDevices, SourceDevices, SourceIPs, ExampleTargetDevices, ExampleSourceIPs, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, TicketRequests desc", "size": 0, "title": "Kerberoasting – Suspicious Service Ticket Requests, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies unusual Kerberos service ticket request activity that may indicate Kerberoasting or automated service-account discovery." }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - KERBEROASTING / SERVICE TICKET ENUMERATION\r\n// ============================================================\r\n// Detects concentrated Kerberos ticket requests across multiple\r\n// targets that may indicate Kerberoasting or SPN enumeration.\r\n// NOTE: Legitimate applications and administrative systems can\r\n// generate similar activity. Results require investigation.\r\nlet Lookback = 30d;\r\nlet TimeWindow = 15m;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where Protocol =~ \"Kerberos\"\r\n| where ActionType =~ \"TicketRequested\"\r\n| extend User=iff(isnotempty(AccountUpn), AccountUpn, AccountName)\r\n| extend SourceDevice=DeviceName, TargetDevice=DestinationDeviceName\r\n| summarize TicketRequests=count(), TargetDevices=dcount(TargetDevice), SourceIPs=dcount(IPAddress), ExampleTargets=make_set(TargetDevice, 10), ExampleIPs=make_set(IPAddress, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by User, SourceDevice, bin(Timestamp, TimeWindow)\r\n| where TicketRequests >= 10 or TargetDevices >= 5\r\n| extend Risk=case(TargetDevices >= 20 and TicketRequests >= 50, \"πŸ”΄ High\", TargetDevices >= 10 and TicketRequests >= 25, \"πŸ”΄ High\", TargetDevices >= 5 or TicketRequests >= 20, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, User, SourceDevice, WindowStart=Timestamp, TicketRequests, TargetDevices, SourceIPs, ExampleTargets, ExampleIPs, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, TargetDevices desc, TicketRequests desc", "size": 0, "title": "Kerberoasting – Service Ticket Enumeration, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Detects concentrated Kerberos service-ticket activity across multiple targets that may indicate Kerberoasting, SPN enumeration, or automated credential attacks." }, "name": "text - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDE - KERBEROASTING / RC4 SERVICE TICKET HUNT\r\n// ============================================================\r\n// Hunts Windows Security Event 4769 for RC4-encrypted Kerberos\r\n// service tickets that may indicate Kerberoasting activity.\r\n// NOTE: RC4 tickets are not automatically malicious. Legacy\r\n// applications and service accounts may legitimately use RC4.\r\nlet Lookback = 30d;\r\nDeviceEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where ActionType == \"KerberosServiceTicketRequested\"\r\n| extend AF=parse_json(AdditionalFields)\r\n| extend TicketEncryptionType=tostring(AF.TicketEncryptionType), ServiceName=tostring(AF.ServiceName), TargetUser=tostring(AF.TargetUserName), ClientAddress=tostring(AF.IpAddress)\r\n| where TicketEncryptionType in (\"0x17\", \"23\", \"RC4-HMAC\")\r\n| extend RequestingUser=iff(isnotempty(InitiatingProcessAccountUpn), InitiatingProcessAccountUpn, InitiatingProcessAccountName)\r\n| summarize TicketRequests=count(), Services=dcount(ServiceName), TargetAccounts=dcount(TargetUser), ServiceNames=make_set(ServiceName, 20), TargetAccountNames=make_set(TargetUser, 20), SourceIPs=make_set(ClientAddress, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by RequestingUser, DeviceName\r\n| extend Risk=case(Services >= 10 and TicketRequests >= 20, \"πŸ”΄ High\", Services >= 5 or TicketRequests >= 10, \"🟠 Medium\", \"🟒 Low\")\r\n| extend Status=case(Risk == \"πŸ”΄ High\", \"πŸ”΄ Investigate\", Risk == \"🟠 Medium\", \"🟠 Review\", \"🟒 Monitor\")\r\n| project Risk, Status, RequestingUser, DeviceName, TicketRequests, Services, TargetAccounts, ServiceNames, TargetAccountNames, SourceIPs, FirstSeen, LastSeen\r\n| order by case(Risk == \"πŸ”΄ High\", 1, Risk == \"🟠 Medium\", 2, 3) asc, Services desc, TicketRequests desc", "size": 0, "title": "Kerberoasting (Defender) – RC4 Service Ticket Hunt, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "customWidth": "50", "name": "query - 4 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// KERBEROASTING - RC4 SERVICE TICKET HUNT\r\n// ============================================================\r\n// Searches available Windows security telemetry for Event 4769\r\n// using RC4 (0x17), a useful Kerberoasting investigation signal.\r\n// NOTE: RC4 does not automatically indicate malicious activity.\r\nlet Lookback=30d;\r\nlet SecurityEvent4769=\r\nSecurityEvent\r\n| where TimeGenerated >= ago(Lookback)\r\n| where EventID == 4769\r\n| extend EventTime=TimeGenerated, SourceTable=\"SecurityEvent\", User=tostring(column_ifexists(\"TargetUserName\",\"\")), Service=tostring(column_ifexists(\"ServiceName\",\"\")), EncryptionType=tostring(column_ifexists(\"TicketEncryptionType\",\"\")), SourceIP=tostring(column_ifexists(\"IpAddress\",\"\")), Host=tostring(Computer)\r\n| project EventTime, SourceTable, User, Service, EncryptionType, SourceIP, Host;\r\nlet WindowsEvent4769=\r\nWindowsEvent\r\n| where TimeGenerated >= ago(Lookback)\r\n| where EventID == 4769\r\n| extend ED=parse_json(tostring(EventData))\r\n| extend EventTime=TimeGenerated, SourceTable=\"WindowsEvent\", User=tostring(ED.TargetUserName), Service=tostring(ED.ServiceName), EncryptionType=tostring(ED.TicketEncryptionType), SourceIP=tostring(ED.IpAddress), Host=tostring(Computer)\r\n| project EventTime, SourceTable, User, Service, EncryptionType, SourceIP, Host;\r\nunion isfuzzy=true SecurityEvent4769, WindowsEvent4769\r\n| where EncryptionType in~ (\"0x17\",\"23\",\"RC4\",\"RC4-HMAC\",\"RC4-HMAC-NT\")\r\n| where isempty(Service) or Service !endswith \"$\"\r\n| summarize TicketRequests=count(), Services=dcount(Service), SourceIPs=dcount(SourceIP), ServiceNames=make_set(Service,20), IPAddresses=make_set(SourceIP,10), DataSources=make_set(SourceTable,5), FirstSeen=min(EventTime), LastSeen=max(EventTime) by User, Host\r\n| extend Risk=case(TicketRequests>=20 and Services>=10,\"πŸ”΄ High\",TicketRequests>=10 or Services>=5,\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk, Status, User, Host, TicketRequests, Services, SourceIPs, ServiceNames, IPAddresses, DataSources, FirstSeen, LastSeen\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc, Services desc, TicketRequests desc", "size": 0, "title": "Kerberoasting (Sentinel) – RC4 Service Ticket Hunt, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "customWidth": "50", "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies RC4-encrypted Kerberos service ticket requests (Event 4769), prioritising accounts requesting multiple service tickets that may indicate Kerberoasting activity." }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - PASSWORD SPRAY / BRUTE FORCE DETECTION\r\n// ============================================================\r\n// Detects concentrated failed logons from common source IPs.\r\n// Differentiates password spraying, brute force and suspicious\r\n// multi-account authentication failures.\r\nlet Lookback=30d;\r\nlet TimeWindow=15m;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where ActionType =~ \"LogonFailed\"\r\n| where isnotempty(IPAddress)\r\n| extend User=iff(isnotempty(AccountUpn),AccountUpn,AccountName)\r\n| summarize FailedLogons=count(),TargetAccounts=dcount(User),SourceDevices=dcountif(DeviceName,isnotempty(DeviceName)),AccountNames=make_set(User,20),SourceDeviceNames=make_set_if(DeviceName,isnotempty(DeviceName),10),FirstSeen=min(Timestamp),LastSeen=max(Timestamp) by IPAddress,bin(Timestamp,TimeWindow)\r\n| where FailedLogons >= 10\r\n| extend FailuresPerAccount=round(todouble(FailedLogons)/TargetAccounts,1)\r\n| extend AttackPattern=case(TargetAccounts>=10 and FailuresPerAccount<=5,\"Password Spray\",TargetAccounts<=3 and FailuresPerAccount>=10,\"Brute Force\",TargetAccounts>=4,\"Multi-Account Failures\",\"Repeated Failures\")\r\n| extend Risk=case(AttackPattern==\"Password Spray\" and FailedLogons>=30,\"πŸ”΄ High\",AttackPattern==\"Brute Force\" and FailedLogons>=30,\"πŸ”΄ High\",TargetAccounts>=20 or FailedLogons>=100,\"πŸ”΄ High\",AttackPattern in (\"Password Spray\",\"Brute Force\",\"Multi-Account Failures\"),\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk,Status,AttackPattern,IPAddress,FailedLogons,TargetAccounts,FailuresPerAccount,AccountNames,WindowStart=Timestamp,FirstSeen,LastSeen\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,FailedLogons desc", "size": 0, "title": "Password Spray & Brute Force Detection, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies excessive failed authentication attempts and multi-account password spraying from common source IP addresses." }, "name": "text - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// IDENTITY HYGIENE - STALE PASSWORDS\r\n// ============================================================\r\n// Identifies accounts with passwords that have not been changed\r\n// for extended periods.\r\n// NOTE: Service accounts and managed identities may have approved\r\n// exceptions and should be validated before remediation.\r\nlet StaleThreshold=180d;\r\nIdentityAccountInfo\r\n| where isnotempty(LastPasswordChangeTime)\r\n| summarize arg_max(Timestamp,*) by AccountUpn\r\n| extend PasswordAgeDays=datetime_diff(\"day\",now(),LastPasswordChangeTime)\r\n| where PasswordAgeDays >= 90\r\n| extend Risk=case(PasswordAgeDays>=365,\"πŸ”΄ High\",PasswordAgeDays>=180,\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk,Status,AccountUpn,AccountStatus,PasswordAgeDays,LastPasswordChangeTime,AuthenticationMethod,SourceProvider,Timestamp\r\n| order by PasswordAgeDays desc", "size": 0, "title": "Identity Hygiene – Stale Passwords, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies accounts with old or potentially stale passwords, prioritising identities whose credentials have not been changed for extended periods." }, "name": "text - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// AD - IDENTITY HYGIENE / WEAK ACCOUNT CONTROLS\r\n// ============================================================\r\n// Detects AD user-account changes where UAC indicates Password\r\n// Not Required or Password Never Expires.\r\n// PASSWD_NOTREQD = 0x20 / DONT_EXPIRE_PASSWD = 0x10000.\r\nlet Lookback=30d;\r\nSecurityEvent\r\n| where TimeGenerated >= ago(Lookback)\r\n| where EventID == 4738\r\n| where isnotempty(NewUacValue) and NewUacValue != \"-\"\r\n| extend UAC=toint(NewUacValue)\r\n| where isnotnull(UAC)\r\n| extend PasswordNotRequired=binary_and(UAC,32)==32,PasswordNeverExpires=binary_and(UAC,65536)==65536\r\n| where PasswordNotRequired or PasswordNeverExpires\r\n| extend User=iff(isnotempty(TargetUserName),strcat(TargetDomainName,\"\\\\\",TargetUserName),TargetUserName)\r\n| extend Finding=case(PasswordNotRequired and PasswordNeverExpires,\"Password Not Required + Never Expires\",PasswordNotRequired,\"Password Not Required\",PasswordNeverExpires,\"Password Never Expires\",\"Unknown\")\r\n| extend Risk=case(PasswordNotRequired and PasswordNeverExpires,\"πŸ”΄ High\",PasswordNotRequired,\"πŸ”΄ High\",PasswordNeverExpires,\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| summarize arg_max(TimeGenerated,*) by TargetSid\r\n| project Risk,Status,Finding,User,PasswordNotRequired,PasswordNeverExpires,ChangedBy=SubjectUserName,DomainController=Computer,NewUacValue,LastObserved=TimeGenerated\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,LastObserved desc", "size": 0, "title": "Weak AD Account Control Changes, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies Active Directory accounts observed with Password Not Required or Password Never Expires settings, highlighting weak identity configurations for review." }, "name": "text - 22" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDI - POTENTIAL LATERAL MOVEMENT / MULTI-DEVICE AUTHENTICATION\r\n// ============================================================\r\n// Detects accounts authenticating across multiple devices within\r\n// a short period, potentially indicating lateral movement.\r\n// NOTE: Administrators, service accounts and management tooling\r\n// may legitimately authenticate across many systems.\r\nlet Lookback=30d;\r\nlet TimeWindow=30m;\r\nIdentityLogonEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where ActionType =~ \"LogonSuccess\"\r\n| extend User=iff(isnotempty(AccountUpn),AccountUpn,AccountName)\r\n| extend TargetDevice=iff(isnotempty(DestinationDeviceName),DestinationDeviceName,DeviceName)\r\n| where isnotempty(User) and isnotempty(TargetDevice)\r\n| summarize Logons=count(),TargetDevices=dcount(TargetDevice),SourceIPs=dcount(IPAddress),DeviceNames=make_set(TargetDevice,20),IPAddresses=make_set_if(IPAddress,isnotempty(IPAddress),10),FirstSeen=min(Timestamp),LastSeen=max(Timestamp) by User,bin(Timestamp,TimeWindow)\r\n| where TargetDevices >= 3\r\n| extend Risk=case(TargetDevices>=15,\"πŸ”΄ High\",TargetDevices>=10 and SourceIPs>=2,\"πŸ”΄ High\",TargetDevices>=5,\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk,Status,User,TargetDevices,Logons,SourceIPs,DeviceNames,IPAddresses,WindowStart=Timestamp,FirstSeen,LastSeen\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,TargetDevices desc,Logons desc", "size": 0, "title": "Potential Lateral Movement – Multi-Device Authentication, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies accounts authenticating across multiple devices within a short period, highlighting unusual authentication spread that may indicate lateral movement." }, "name": "text - 24" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDE - MICROSOFT DEFENDER ANTIVIRUS EXCLUSIONS\r\n// ============================================================\r\n// Identifies Defender exclusion registry activity and shows\r\n// exclusions observed across endpoints during the lookback period.\r\n// NOTE: Many exclusions are legitimate. Unexpected or overly broad\r\n// exclusions should be reviewed as they may reduce AV protection.\r\nlet Lookback=30d;\r\nDeviceRegistryEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where RegistryKey contains \"exclusion\"\r\n| where isnotempty(PreviousRegistryValueName)\r\n| extend Exclusion=PreviousRegistryValueName\r\n| extend ExclusionType=case(RegistryKey contains \"Paths\",\"Path\",RegistryKey contains \"Extensions\",\"Extension\",RegistryKey contains \"Processes\",\"Process\",RegistryKey contains \"IpAddresses\",\"IP Address\",\"Other\")\r\n| extend Key=extract(@\"[^\\\\]+\\\\[^\\\\]+$\",0,RegistryKey)\r\n| summarize Devices=dcount(DeviceName),Events=count(),DeviceNames=make_set(DeviceName,20),ExampleValue=any(RegistryValueData),ExampleAction=any(ActionType),FirstSeen=min(Timestamp),LastSeen=max(Timestamp) by Exclusion,ExclusionType,Key\r\n| extend Risk=case(Exclusion in (\"*\",\"C:\\\\\",\"C:\\\\Windows\",\"C:\\\\Program Files\",\"C:\\\\Users\"),\"πŸ”΄ High\",ExclusionType==\"Extension\" and Exclusion in (\".exe\",\".dll\",\".ps1\",\".bat\",\".cmd\",\".js\",\".vbs\"),\"πŸ”΄ High\",Devices>=20,\"🟠 Medium\",Devices>=5,\"🟠 Medium\",\"🟒 Low\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk,Status,ExclusionType,Exclusion,Devices,Events,DeviceNames,ExampleAction,ExampleValue,Key,FirstSeen,LastSeen\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,Devices desc,LastSeen desc", "size": 0, "title": "Microsoft Defender Antivirus Exclusions, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies Defender Antivirus exclusion configurations observed across endpoints, highlighting widespread or potentially risky exclusions for security review." }, "name": "text - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ============================================================\r\n// MDE - MICROSOFT DEFENDER ANTIVIRUS EXCLUSION CHANGES\r\n// ============================================================\r\n// Detects changes to Microsoft Defender Antivirus exclusions.\r\n// Includes initiating process and account context to help identify\r\n// potentially unauthorised security-control modifications.\r\n// NOTE: Legitimate management tooling may routinely modify exclusions.\r\nlet Lookback=30d;\r\nDeviceRegistryEvents\r\n| where Timestamp >= ago(Lookback)\r\n| where RegistryKey contains @\"Windows Defender\\Exclusions\" or RegistryKey contains @\"Microsoft Defender\\Exclusions\"\r\n| extend ExclusionType=case(RegistryKey contains @\"\\Paths\",\"Path\",RegistryKey contains @\"\\Extensions\",\"Extension\",RegistryKey contains @\"\\Processes\",\"Process\",RegistryKey contains @\"\\IpAddresses\",\"IP Address\",\"Other\")\r\n| extend Exclusion=case(isnotempty(RegistryValueName),RegistryValueName,isnotempty(PreviousRegistryValueName),PreviousRegistryValueName,\"Unknown\")\r\n| extend ChangeType=case(ActionType in~ (\"RegistryValueDeleted\",\"RegistryKeyDeleted\"),\"Removed\",ActionType in~ (\"RegistryValueSet\",\"RegistryKeyCreated\"),\"Added / Modified\",\"Changed\")\r\n| extend ChangedBy=iff(isnotempty(InitiatingProcessAccountUpn),InitiatingProcessAccountUpn,strcat(InitiatingProcessAccountDomain,\"\\\\\",InitiatingProcessAccountName))\r\n| extend InitiatingProcess=InitiatingProcessFileName\r\n| extend Risk=case(InitiatingProcess in~ (\"powershell.exe\",\"pwsh.exe\",\"cmd.exe\",\"wscript.exe\",\"cscript.exe\",\"mshta.exe\",\"reg.exe\"),\"πŸ”΄ High\",ChangeType==\"Added / Modified\" and Exclusion in (\"*\",@\"C:\\\",@\"C:\\Windows\",@\"C:\\Users\",@\"C:\\Program Files\"),\"πŸ”΄ High\",ChangeType==\"Added / Modified\",\"🟠 Medium\",ChangeType==\"Removed\",\"🟒 Low\",\"🟠 Medium\")\r\n| extend Status=case(Risk==\"πŸ”΄ High\",\"πŸ”΄ Investigate\",Risk==\"🟠 Medium\",\"🟠 Review\",\"🟒 Monitor\")\r\n| project Risk,Status,ChangeType,Timestamp,DeviceName,ExclusionType,Exclusion,RegistryKey,RegistryValueName,RegistryValueData,PreviousRegistryValueName,PreviousRegistryValueData,ChangedBy,InitiatingProcess,InitiatingProcessCommandLine,InitiatingProcessFolderPath,InitiatingProcessSHA1\r\n| order by case(Risk==\"πŸ”΄ High\",1,Risk==\"🟠 Medium\",2,3) asc,Timestamp desc", "size": 0, "title": "Microsoft Defender Antivirus Exclusion Changes, count: {$rowCount} Fixed to 30days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Risk" ], "expandTopLevel": true } } }, "name": "query - 4 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "Identifies Defender Antivirus exclusions being added, modified or removed, including the responsible process and account to help detect unauthorised security-control changes." }, "name": "text - 28" }, { "type": 1, "content": { "json": "# πŸ“– Hunting Query Guidance\r\n\r\n## About these queries\r\n\r\nThe queries on this page provide reusable hunting and security-posture views across **Microsoft Defender for Endpoint (MDE)**, **Microsoft Defender for Identity (MDI)** and, where available, Microsoft Sentinel security telemetry.\r\n\r\nThey are intended to help identify activity such as:\r\n\r\n- Malware and offensive security tooling\r\n- Weak or legacy authentication\r\n- NTLM dependencies\r\n- Suspicious authentication patterns\r\n- Password spraying and brute-force attempts\r\n- Kerberoasting indicators\r\n- LDAP reconnaissance and directory enumeration\r\n- Potential lateral movement\r\n- Identity hygiene weaknesses\r\n- Microsoft Defender Antivirus exclusions and configuration changes\r\n\r\nThese queries should be treated as **investigative starting points rather than detections of confirmed compromise**.\r\n\r\n## 🚦 Risk ratings\r\n\r\nResults use a consistent risk model to make workbook output easier to prioritise:\r\n\r\n**πŸ”΄ High** \r\nActivity has characteristics that warrant prompt investigation. Examples include concentrated authentication attacks, suspicious security-control changes, unusually broad enumeration or strong indicators of offensive tooling.\r\n\r\n**🟠 Medium** \r\nActivity warrants review but may have a legitimate explanation. Common examples include legacy authentication, administrative activity, service accounts and widespread management operations.\r\n\r\n**🟒 Low** \r\nLower-priority activity where the query has not identified additional suspicious characteristics. Low risk does **not** necessarily mean the underlying configuration or behaviour is recommended.\r\n\r\nRisk ratings are based only on the telemetry available to the individual query and should not be interpreted as Microsoft Defender alert severity.\r\n\r\n## πŸ”Ž Status values\r\n\r\n**πŸ”΄ Investigate** β€” Prioritise the result for analyst investigation.\r\n\r\n**🟠 Review** β€” Validate the activity against expected behaviour and customer configuration.\r\n\r\n**🟒 Monitor** β€” Lower-priority observation that may still be useful for security posture or baseline analysis.\r\n\r\n## ⏱️ Lookback periods and thresholds\r\n\r\nMost queries use a configurable lookback period, commonly:\r\n\r\n`let Lookback=30d;`\r\n\r\nBehavioural queries may additionally use short aggregation windows such as:\r\n\r\n`let TimeWindow=15m;`\r\n\r\nor:\r\n\r\n`let TimeWindow=30m;`\r\n\r\nShort windows are particularly important for detecting behaviours such as password spraying, brute force, Kerberos ticket enumeration and lateral movement.\r\n\r\nThresholds are intentionally designed as practical hunting starting points. They may need adjustment for individual environments depending on:\r\n\r\n- Number of users and endpoints\r\n- Service-account activity\r\n- Administrative infrastructure\r\n- VPN and proxy architecture\r\n- Identity-management systems\r\n- Legacy applications\r\n- Normal authentication volumes\r\n- Security testing and red-team activity\r\n\r\n## ⚠️ False positives\r\n\r\nMany legitimate activities can resemble attacker behaviour.\r\n\r\nCommon examples include:\r\n\r\n- Vulnerability scanners\r\n- Endpoint-management platforms\r\n- Backup systems\r\n- Identity-management products\r\n- Service accounts\r\n- Domain administrators\r\n- Software deployment systems\r\n- VPNs and corporate proxies\r\n- Penetration testing and red-team activity\r\n\r\nA query result should therefore be correlated with other Defender telemetry before being classified as malicious.\r\n\r\n## 🧭 Investigation approach\r\n\r\nWhen reviewing a result, consider:\r\n\r\n1. **Who?** β€” Is the account expected to perform this activity?\r\n2. **Where?** β€” Is the source IP, device or location recognised?\r\n3. **What?** β€” What process, command line, service or resource was involved?\r\n4. **When?** β€” Is the timing normal for this identity or system?\r\n5. **How widespread?** β€” Is this isolated or occurring across multiple accounts/devices?\r\n6. **What changed?** β€” Is this new behaviour compared with the normal environment?\r\n7. **What else happened?** β€” Are there related Defender alerts, process executions, network connections or identity events?\r\n\r\n## 🧩 Data availability\r\n\r\nNot every query will return results in every workspace.\r\n\r\nAvailable telemetry depends on:\r\n\r\n- Microsoft Defender products deployed\r\n- Defender for Identity sensor coverage\r\n- Endpoint onboarding\r\n- Windows auditing configuration\r\n- Microsoft Sentinel connectors\r\n- Security-event collection settings\r\n- Data retention\r\n- Licensing\r\n\r\nAn empty result can mean **no matching activity was observed**, but it can also mean the required telemetry is not available.\r\n\r\n## πŸ› οΈ Query maintenance\r\n\r\nThese hunts are designed to use a consistent structure and output wherever practical.\r\n\r\nIndicator-heavy queries should progressively move reusable lists β€” such as malware names, offensive tools, approved exclusions and known infrastructure β€” into **centrally maintained data sources** rather than duplicating large hardcoded lists throughout individual KQL queries.\r\n\r\nThresholds and classifications should also be periodically reviewed against real customer telemetry to ensure they remain useful across environments of different sizes.\r\n\r\n---\r\n\r\n### πŸ›‘οΈ Analyst reminder\r\n\r\n**A hunting result is a reason to investigate β€” not a verdict.**\r\n\r\nUse the wider Defender incident, device, identity and timeline context before determining whether activity is malicious, expected or requires remediation." }, "name": "text - 30" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "hunt" }, "name": "group - Hunting" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Identity Metrics", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "c68338c9-1222-4b9b-91f9-9ab5a55a9b11", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ“Š Signin Logs |", "subTarget": "signin", "style": "link" }, { "id": "8d134849-e2c3-43ea-8864-17c2a0f8c3fa", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| βš™οΈ Users |", "subTarget": "users", "style": "link" }, { "id": "2ba2a4ad-b396-4596-ace0-c275ff1a9270", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| 🏁 MFA | ", "subTarget": "mfa", "style": "link" }, { "id": "8df5c887-980e-4b7d-8392-8ce188bd01b7", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ’³ IdentityInfo |", "subTarget": "identity", "style": "link" }, { "id": "98969e94-1654-4a7c-9292-a91a648cfc82", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ”’ Password reset |", "subTarget": "sspr", "style": "link" } ] }, "name": "links - 19" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7a15390a-34b9-43b6-93d4-4a128b9d78a4", "version": "KqlParameterItem/1.0", "name": "CountriesOfInterest", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SigninLogs\r\n| where isnotempty(LocationDetails['countryOrRegion']) \r\n| distinct Location\r\n| order by Location asc\r\n", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "70", "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Signin", "items": [ { "type": 1, "content": { "json": "----\n## Signin Logs\n\nWith the SigninLogs we can give a security analyst insight into the different login statuses and locations
\n\nThese graphs give a quick representation of the Signin activity of the company's users.
\nA security team can easy view the Signin locations and most used applications" }, "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\n| extend ResultText = case(isnotempty(ResultDescription), ResultDescription, ResultType == 0 and isempty(ResultDescription), \"successful login\", \"unknown\") // Create readable result text to include succesfull logins\n| summarize dcount(CorrelationId) by ResultText // Signin results by unique CorrelationId\n| render piechart", "size": 0, "title": "Login events by result", "timeContextFromParameter": "TimeRange", "exportFieldName": "ResultText", "exportParameterName": "Selected_ResultText", "exportDefaultValue": "", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "group": "ResultText", "createOtherGroup": null, "seriesLabelSettings": [ { "seriesName": "successful login", "color": "green" } ], "ySettings": { "unit": 17, "min": null, "max": null } } }, "customWidth": "33", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\n| extend ResultText = case(isnotempty(ResultDescription), ResultDescription, ResultType == 0 and isempty(ResultDescription), \"successful login\", \"unknown\")\n| summarize dcount(CorrelationId) by ResultText, bin(TimeGenerated,4h) // summarize the total Signin events per Description per hour (by unique CorrelationId's)", "size": 0, "title": "Count of login types per 4 hours", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ResultText", "formatter": 1 }, "leftContent": { "columnMatch": "dcount_CorrelationId", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType == 0// Where location details are available and login is successful\n| extend city = tostring(LocationDetails['city'])\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\n| summarize count() by city, Location // Summarize by city name\n| join (\nSigninLogs\n| extend city = tostring(LocationDetails['city'])\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by city \n) on city\n| project Location, city, [\"Total events\"] = count_, TrendLine = TrendList\n| top 10 by [\"Total events\"] desc", "size": 0, "title": "successful login locations", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total events", "formatter": 4, "formatOptions": { "palette": "blue", "showIcon": true } }, { "columnMatch": "TrendLine", "formatter": 9, "formatOptions": { "palette": "greenRed", "showIcon": true } }, { "columnMatch": "Events", "formatter": 4, "formatOptions": { "palette": "blue", "showIcon": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "id", "formatter": 5, "formatOptions": { "showIcon": true } } ], "hierarchySettings": { "idColumn": "city", "parentColumn": "Location", "treeType": 0, "expanderColumn": "city", "expandTopLevel": false }, "sortBy": [ { "itemKey": "$gen_bar_Total events_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Total events_2", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "city", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Events", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "LocationDetails", "formatter": 1, "formatOptions": { "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "count_", "sourceIdField": "Location", "targetIdField": "city", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "GeoSelection", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "defaultSize": 0, "labelSettings": "locationInfo", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redGreen" } } }, "customWidth": "33", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType == 0// Where location details are available and login is successful\n| summarize count() by Location, bin(TimeGenerated,1d) // Summarize by city name\n", "size": 0, "title": "Successful login Countries, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "Total events", "formatter": 4, "formatOptions": { "palette": "blue", "showIcon": true } }, { "columnMatch": "TrendLine", "formatter": 9, "formatOptions": { "palette": "greenRed", "showIcon": true } }, { "columnMatch": "Events", "formatter": 4, "formatOptions": { "palette": "blue", "showIcon": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "showIcon": true } }, { "columnMatch": "id", "formatter": 5, "formatOptions": { "showIcon": true } } ], "hierarchySettings": { "idColumn": "city", "parentColumn": "Location", "treeType": 0, "expanderColumn": "city", "expandTopLevel": false } }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "city", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Events", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "LocationDetails", "formatter": 1, "formatOptions": { "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "count_", "sourceIdField": "Location", "targetIdField": "city", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "GeoSelection", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "defaultSize": 0, "labelSettings": "locationInfo", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redGreen" } } }, "name": "query -logon by Country" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType == 0// Where location details are available and login is successful\r\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\r\n| summarize count() by Location \r\n| order by count_ desc", "size": 0, "title": "Successful Login Map", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "Location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType != 0// Where location details are available and login is successful\r\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\r\n| summarize count() by Location\r\n| order by count_ desc", "size": 0, "title": "Anything apart from successfulLogin - Map", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "Location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 18 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend customerWorkspaceID = trim(' ', tostring(properties.customerId))\r\n| project id, customerWorkspaceID, name=tolower(name), subscriptionId, tenantId\r\n|join \r\n(\r\n\tresources\r\n\t// Just show Workspaces that have Sentinel enabled\r\n\t| where type =~ \"microsoft.operationsmanagement/solutions\"\r\n\t| where name has \"SecurityInsights\"\r\n\t| parse name with * '(' s_workspace ')'*\r\n\t| project name=tolower(s_workspace), subscriptionId, location, properties, resourceGroup\r\n) on name", "size": 0, "title": "ARG - to hide", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ] }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - arg Workpace Lookup" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType != 0// Where location details are available and login is successful\r\n| extend ResultText = case(isnotempty(ResultDescription), ResultDescription, ResultType != 0 and isempty(ResultDescription), \"successful login\", \"unknown\") // Create readable result text to include succesfull logins\r\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\r\n| summarize distinctUserCount=dcount(UserPrincipalName), make_set(UserPrincipalName), count() by ResultType, ResultText, WorkspaceID = TenantId\r\n| order by count_ desc", "size": 0, "title": "ResultType analysis, count: {$rowCount}", "timeContext": { "durationMs": 86400000 }, "exportFieldName": "WorkspaceID", "exportParameterName": "exportWorkspaceID", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "Location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "75", "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - ResultTypes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"fa50d480-d420-46f4-b04b-9a2707e45400\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - arg Workpace Lookup\",\"rightTable\":\"query - ResultTypes\",\"leftColumn\":\"customerWorkspaceID\",\"rightColumn\":\"WorkspaceID\"}],\"projectRename\":[{\"originalName\":\"[query - arg Workpace Lookup].id\",\"mergedName\":\"id\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - arg Workpace Lookup].name\",\"mergedName\":\"name\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - arg Workpace Lookup].location\",\"mergedName\":\"location\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - arg Workpace Lookup].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - ResultTypes].ResultType\",\"mergedName\":\"ResultType\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - ResultTypes].ResultText\",\"mergedName\":\"ResultText\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - ResultTypes].WorkspaceID\",\"mergedName\":\"WorkspaceID\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - ResultTypes].count_\",\"mergedName\":\"count_\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e45400\"},{\"originalName\":\"[query - ResultTypes].set_UserPrincipalName\",\"mergedName\":\"set_UserPrincipalName\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ResultTypes].dcount_UserPrincipalName\",\"mergedName\":\"dcount_UserPrincipalName\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - ResultTypes].distinctUserCount\",\"mergedName\":\"distinctUserCount\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - arg Workpace Lookup].customerWorkspaceID\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId\"},{\"originalName\":\"[query - arg Workpace Lookup].tenantId\"},{\"originalName\":\"[query - arg Workpace Lookup].name1\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId1\"},{\"originalName\":\"[query - arg Workpace Lookup].properties\"}]}", "size": 0, "title": "ResultType analysis, count: {$rowCount}", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "name", "formatter": 5 }, { "columnMatch": "location", "formatter": 5 }, { "columnMatch": "resourceGroup", "formatter": 5 }, { "columnMatch": "WorkspaceID", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "name" ] } } }, "showPin": false, "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\r\n| where isnotempty(IPAddress)\r\n| summarize count() by TenantId, IPAddress\r\n| order by count_ desc\r\n| top 100 by count_\r\n\r\n", "size": 0, "title": "IP Address by Country - select a row for more details", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "WorkspaceID", "parameterName": "exportWorkspaceId", "parameterType": 1 }, { "fieldName": "IPAddress", "parameterName": "ipAddress", "parameterType": 1 }, { "fieldName": "ResourceGroup", "parameterName": "resourceGroup", "parameterType": 1 }, { "fieldName": "SubscriptionID", "parameterName": "SubscriptionID", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "WorkspaceID", "formatter": 5, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "ResourceUri", "formatter": 1 } ], "filter": true, "sortBy": [ { "itemKey": "TenantId", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TenantId", "sortOrder": 2 } ] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - kql to find IP" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\",\"mergeType\":\"inner\",\"leftTable\":\"query - arg Workpace Lookup\",\"rightTable\":\"query - kql to find IP\",\"leftColumn\":\"customerWorkspaceID\",\"rightColumn\":\"TenantId\"}],\"projectRename\":[{\"originalName\":\"[query - kql to find IP].IPAddress\",\"mergedName\":\"IPAddress\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - kql to find IP].count_\",\"mergedName\":\"count_\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].customerWorkspaceID\",\"mergedName\":\"customerWorkspaceID\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].id\",\"mergedName\":\"id\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].name\",\"mergedName\":\"name\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].tenantId\",\"mergedName\":\"tenantId\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].location\",\"mergedName\":\"location\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].properties\",\"mergedName\":\"properties\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - arg Workpace Lookup].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - kql to find IP].TenantId\",\"mergedName\":\"TenantId\",\"fromId\":\"fa50d480-d420-46f4-b04b-9a2707e453d3\"},{\"originalName\":\"[query - kql to find IP].set_IPAddress\",\"mergedName\":\"set_IPAddress\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - kql to find IP].dcount_IPAddress\",\"mergedName\":\"dcount_IPAddress\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - arg Workpace Lookup].name1\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId1\"}]}", "size": 0, "title": "Top 100 IP Address by Country - select a row for more details", "exportedParameters": [ { "fieldName": "IPAddress", "parameterName": "ipAddress", "parameterType": 1 }, { "fieldName": "subscriptionId", "parameterName": "SubscriptionID", "parameterType": 1 }, { "fieldName": "resourceGroup", "parameterName": "resourceGroup", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "name" ] }, "sortBy": [ { "itemKey": "resourceGroup", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "resourceGroup", "sortOrder": 2 } ] }, "customWidth": "50", "showPin": false, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where Location in ({CountriesOfInterest}) or \"{CountriesOfInterest:label}\" == \"All\"\r\n| where isnotempty(IPAddress)\r\n| summarize count() by IPAddress, WorkspaceID = TenantId, Location\r\n| where isnotempty(IPAddress)\r\n", "size": 0, "title": "IP Address Country map", "timeContextFromParameter": "TimeRange", "exportFieldName": "WorkspaceID", "exportParameterName": "exportWorkspaceId", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "formatters": [ { "columnMatch": "WorkspaceID", "formatter": 7, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_count__2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_count__2", "sortOrder": 2 } ], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - IP addr details map " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{SubscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.SecurityInsights/enrichment/ip/geodata/?ipaddress={ipAddress}&api-version=2021-09-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$\",\"columns\":[]}}]}", "size": 4, "title": "Lookup IP Address: {ipAddress} {SubscriptionID} {resourceGroup}", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "country", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } } ] } }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend customerWorkspaceID = trim(' ', tostring(properties.customerId))\r\n| project id, customerWorkspaceID, name=tolower(name), subscriptionId, tenantId\r\n|join \r\n(\r\n\tresources\r\n\t// Just show Workspaces that have Sentinel enabled\r\n\t| where type =~ \"microsoft.operationsmanagement/solutions\"\r\n\t| where name has \"SecurityInsights\"\r\n\t| parse name with * '(' s_workspace ')'*\r\n\t| project name=tolower(s_workspace), subscriptionId, location, properties, resourceGroup\r\n) on name\r\n| where customerWorkspaceID in ('{exportWorkspaceId}')\r\n| project name, Open=tolower(id), tenantId, customerWorkspaceID, subscriptionId, location, properties, resourceGroup", "size": 0, "title": "Lookup WorkspaceID: {exportWorkspaceId}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ] }, "conditionalVisibility": { "parameterName": "exportWorkspaceId", "comparison": "isNotEqualTo" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where ResultType == 0 and AppDisplayName != \"\"\r\n| summarize count() by AppDisplayName\r\n| join (\r\nSigninLogs\r\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, 4h) by AppDisplayName \r\n) on AppDisplayName\r\n| top 10 by count_ desc", "size": 4, "title": "successful logins by application", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "AppDisplayName", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "TrendList", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "AppDisplayName", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 14" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "signin" }, "name": "group -signin" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Users", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b06284e5-440a-440b-8add-3922c3d57201", "version": "KqlParameterItem/1.0", "name": "lastLogon", "label": "Days Since Last Logon", "type": 2, "description": "Number of days used for User calculations, limited to the selected time range.", "isRequired": true, "query": "let days = datetime_diff('day', {TimeRange:end}, {TimeRange:start});\r\nrange value from 1 to days step 1\r\n| project value, display=value, selected=(value == 7)", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where ResultType == \"0\"\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName=tolower(UserPrincipalName)\r\n| project TimeGenerated, UserPrincipalName, UserType, lastLogon_=datetime_diff(\"day\", now(),TimeGenerated)\r\n| where lastLogon_ >= {lastLogon:value}\r\n", "size": 0, "title": "Days since Last Logon: {lastLogon:value}, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| summarize UniqueUsers=dcount(AccountUPN), UserList=make_set(AccountUPN) by Department\r\n//| make-series dcount(AccountUPN), max(AccountUPN) on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Department\r\n| where isnotempty(Department)\r\n| extend UserList = array_sort_asc(UserList)\r\n| order by UniqueUsers desc\r\n\r\n\r\n", "size": 0, "title": "Users by Department. count: {$rowCount}", "timeContext": { "durationMs": 2592000000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "UniqueUsers", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "25ch" } }, { "columnMatch": "dcount_AccountUPN", "formatter": 10, "formatOptions": { "palette": "blue" } } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| mv-expand GroupMembership \r\n| distinct tostring(GroupMembership), AccountUPN\r\n| summarize CountofUsersinGroup=dcount(AccountUPN),UsersInGroup=make_set(AccountUPN) by tostring(GroupMembership)\r\n| extend UsersInGroup = array_sort_asc(UsersInGroup) // sort list \r\n| order by CountofUsersinGroup desc\r\n\r\n\r\n", "size": 0, "title": "Users by Groups count: {$rowCount}", "timeContext": { "durationMs": 2592000000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "CountofUsersinGroup", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "25ch" } }, { "columnMatch": "UsersInGroup", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50ch" } }, { "columnMatch": "dcount_AccountUPN", "formatter": 10, "formatOptions": { "palette": "blue" } } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 13 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where TimeGenerated > ago(90d)\r\n| where ResultType == 0\r\n| extend emailDomain = tostring(split(UserPrincipalName,'@')[1])\r\n| summarize count_=dcount(UserPrincipalName) by emailDomain, UserType, ResourceTenantId, HomeTenantId, TenantId\r\n| order by count_ desc\r\n| project emailDomain, UserType, count_\r\n\r\n\r\n", "size": 0, "title": "Users by emailDomain, count: {$rowCount}", "timeContext": { "durationMs": 2592000000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "CountofUsersinGroup", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "25ch" } }, { "columnMatch": "UsersInGroup", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50ch" } }, { "columnMatch": "dcount_AccountUPN", "formatter": 10, "formatOptions": { "palette": "blue" } } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 13 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend customerWorkspaceID = trim(' ', tostring(properties.customerId))\r\n| project id, customerWorkspaceID, name=tolower(name), subscriptionId, tenantId\r\n|join \r\n(\r\n\tresources\r\n\t// Just show Workspaces that have Sentinel enabled\r\n\t| where type =~ \"microsoft.operationsmanagement/solutions\"\r\n\t| where name has \"SecurityInsights\"\r\n\t| parse name with * '(' s_workspace ')'*\r\n\t| project name=tolower(s_workspace), subscriptionId, location, properties, resourceGroup\r\n) on name", "size": 0, "title": "ARG - to hide", "exportedParameters": [ { "fieldName": "tenantId", "parameterName": "exporttenantId", "parameterType": 1 }, { "fieldName": "subscriptionId", "parameterName": "exportSubscriptionId", "parameterType": 1 }, { "fieldName": "resourceGroup", "parameterName": "exportResourceGroup", "parameterType": 1 }, { "fieldName": "name", "parameterName": "exportName", "parameterType": 1 } ], "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Open", "formatter": 7, "formatOptions": { "linkTarget": "Resource", "linkLabel": "Workspace context blade", "linkIsContextBlade": true } }, { "columnMatch": "id", "formatter": 7, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkLabel": "Click to Open [Security operations efficiency] workbook", "linkIsContextBlade": false } }, { "columnMatch": "note", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100ch" } } ], "sortBy": [ { "itemKey": "tenantId", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "tenantId", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - arg Workpace Lookup" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let timerange=180d;\r\nlet timeframe=30d;\r\nAuditLogs\r\n| where TimeGenerated between (ago(timerange) .. ago(timeframe)) \r\n| where OperationName == \"Invite external user\"\r\n| extend GuestUPN = tolower(tostring(TargetResources[0].userPrincipalName))\r\n| summarize arg_max(TimeGenerated, *) by GuestUPN\r\n| project TimeGenerated, GuestUPN, TenantId\r\n| join kind=leftanti (\r\n AuditLogs\r\n | where TimeGenerated > ago (timerange)\r\n | where OperationName == \"Redeem external user invite\"\r\n | where CorrelationId <> \"00000000-0000-0000-0000-000000000000\"\r\n | extend d = tolower(tostring(TargetResources[0].displayName))\r\n | parse d with * \"upn: \" GuestUPN \",\" *\r\n | project TimeGenerated, GuestUPN)\r\n on GuestUPN\r\n| project TimeGenerated, GuestUPN, ['Days Since Invite Sent']=datetime_diff(\"day\", now(), TimeGenerated), WorkspaceID=TenantId\r\n| order by ['Days Since Invite Sent'] desc\r\n", "size": 4, "title": "Un-redeemed Guest invites older than 30days and less than 180 days", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ], "sortBy": [ { "itemKey": "$gen_bar_Days Since Invite Sent_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Days Since Invite Sent_2", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - redemtion" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e8c9636f-37e2-443d-9a12-8a7b8039a177\",\"mergeType\":\"inner\",\"leftTable\":\"query - arg Workpace Lookup\",\"rightTable\":\"query - redemtion\",\"leftColumn\":\"customerWorkspaceID\",\"rightColumn\":\"WorkspaceID\"}],\"projectRename\":[{\"originalName\":\"[query - arg Workpace Lookup].id\",\"mergedName\":\"id\",\"fromId\":\"e8c9636f-37e2-443d-9a12-8a7b8039a177\"},{\"originalName\":\"[query - redemtion].TimeGenerated\",\"mergedName\":\"TimeGenerated\",\"fromId\":\"e8c9636f-37e2-443d-9a12-8a7b8039a177\"},{\"originalName\":\"[query - redemtion].GuestUPN\",\"mergedName\":\"GuestUPN\",\"fromId\":\"e8c9636f-37e2-443d-9a12-8a7b8039a177\"},{\"originalName\":\"[query - redemtion].Days Since Invite Sent\",\"mergedName\":\"Days Since Invite Sent\",\"fromId\":\"e8c9636f-37e2-443d-9a12-8a7b8039a177\"},{\"originalName\":\"[query - arg Workpace Lookup].customerWorkspaceID\"},{\"originalName\":\"[query - arg Workpace Lookup].name\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId\"},{\"originalName\":\"[query - arg Workpace Lookup].tenantId\"},{\"originalName\":\"[query - arg Workpace Lookup].name1\"},{\"originalName\":\"[query - arg Workpace Lookup].subscriptionId1\"},{\"originalName\":\"[query - arg Workpace Lookup].location\"},{\"originalName\":\"[query - arg Workpace Lookup].properties\"},{\"originalName\":\"[query - arg Workpace Lookup].resourceGroup\"},{\"originalName\":\"[query - redemtion].WorkspaceID\"}]}", "size": 0, "title": "Un-redeemed Guest invites older than 30days and less than 180 days", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "id" ], "expandTopLevel": true } } }, "showPin": false, "name": "query - old guest invites" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AADServicePrincipalSignInLogs\r\n| where TimeGenerated > ago(365d)\r\n| where ResultType == \"0\"\r\n| summarize arg_max(TimeGenerated, *) by AppId\r\n| project TimeGenerated, ServicePrincipalName, ['Days Since Last Logon']=datetime_diff(\"day\", now(),TimeGenerated), WorkspaceID=TenantId\r\n| where ['Days Since Last Logon'] >= 45 | sort by ['Days Since Last Logon'] desc ", "size": 0, "title": "Service Principals", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - sp" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AADServicePrincipalSignInLogs\r\n| where ResultType != \"0\"\r\n| extend ErrorDescription = case (\r\n ResultType == \"7000215\", strcat(\"Invalid client secret is provided\"),\r\n ResultType == \"7000222\", strcat(\"The provided client secret keys are expired\"),\r\n ResultType == \"700027\", strcat(\"Client assertion failed signature validation\"),\r\n ResultType == \"700024\", strcat(\"Client assertion is not within its valid time range\"),\r\n ResultType == \"70021\", strcat(\"No matching federated identity record found for presented assertion\"),\r\n ResultType == \"500011\", strcat(\"The resource principal named [name] was not found in the tenant named [tenant]\"),\r\n ResultType == \"700082\", strcat(\"The refresh token has expired due to inactivity\"),\r\n ResultType == \"90025\", strcat(\"Request processing has exceeded gateway allowance\"),\r\n ResultType == \"500341\", strcat(\"The user account [identifier] has been deleted from the [tenant] directory\"),\r\n ResultType == \"100007\", strcat(\"AAD Regional ONLY supports auth either for MSIs OR for requests from MSAL using SN+I for 1P apps or 3P apps in Microsoft infrastructure tenants\"),\r\n ResultType == \"1100000\", strcat(\"Non-retryable error has occurred\"),\r\n ResultType == \"90033\", strcat(\"A transient error has occurred. Please try again\"),\r\n ResultType == \"53003\", strcat(\"Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.\"),\r\n // else\r\n \"Unknown\"\r\n )\r\n| project TimeGenerated, ServicePrincipalName, ServicePrincipalId, ErrorDescription, ResultType, IPAddress, WorkspaceID=TenantId", "size": 0, "title": "Service Principals - details", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - sp - description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where TimeGenerated > ago (365d)\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by AppId\r\n| project\r\n AppDisplayName,\r\n ['Last Logon Time']=TimeGenerated,\r\n ['Days Since Last Logon']=datetime_diff(\"day\", now(), TimeGenerated), WorkspaceID=TenantId\r\n| where ['Days Since Last Logon'] > 30 | sort by ['Days Since Last Logon'] desc ", "size": 0, "title": "No App sign in", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "name": "query - No sign in to Apps" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where TimeGenerated > ago(30d)\r\n| where ResultType == 0\r\n| summarize ['Total Signins']=count(), ['Distinct User Signins']=dcount(UserPrincipalName) by AppDisplayName, WorkspaceID=TenantId | sort by ['Distinct User Signins'] desc ", "size": 0, "title": "App sign in details - 30days", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Distinct User Signins", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - App signin 30days" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where TimeGenerated > ago(30d)\r\n| where ResultType == 0\r\n| summarize ['Distinct Member Signins']=dcountif(UserPrincipalName, UserType == \"Member\"),\r\n ['Distinct Guest Signins']=dcountif(UserPrincipalName, UserType == \"Guest\"), \r\n ['Distinct Guest List']=make_set_if(UserPrincipalName, UserType == \"Guest\") by AppDisplayName, WorkspaceID=TenantId | sort by ['Distinct Guest Signins'] ", "size": 0, "title": "App sign in details - 30days", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Distinct Guest Signins", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - App signin 30days - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where TimeGenerated > ago (365d)\r\n| project TimeGenerated, OperationName, Result, TargetResources, InitiatedBy, TenantId\r\n| where OperationName == \"Add member to role completed (PIM activation)\"\r\n| where Result == \"success\"\r\n| extend ['Last Role Activated'] = tostring(TargetResources[0].displayName)\r\n| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| summarize arg_max(TimeGenerated, *) by Actor\r\n| project Actor, ['Last Role Activated'], ['Last Activation Time']=TimeGenerated, ['Days Since Last Activation']=datetime_diff(\"day\", now(), TimeGenerated), WorkspaceID=TenantId\r\n| where ['Days Since Last Activation'] >= 30\r\n| sort by ['Days Since Last Activation'] desc", "size": 0, "title": "PIM not used since", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Distinct Guest Signins", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ], "filter": true, "sortBy": [ { "itemKey": "Days Since Last Activation", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Days Since Last Activation", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - PIM" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let timerange=30d;\r\nAuditLogs\r\n// extend LocalTime to your time zone\r\n| extend LocalTime=TimeGenerated + 5h\r\n| where LocalTime > ago(timerange)\r\n// Change hours of the day to suit your company, i.e this would find activations between 6pm and 6am\r\n| where hourofday(LocalTime) !between (6 .. 18)\r\n| where OperationName == \"Add member to role completed (PIM activation)\"\r\n| extend RoleName = tostring(TargetResources[0].displayName)\r\n| project LocalTime, OperationName, Identity, RoleName, ActivationReason=ResultReason, WorkspaceID=TenantId", "size": 0, "title": "PIM outside of core hours (show for 6pm to 6am), count: {$rowCount} ", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RoleName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Admin", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Distinct Guest Signins", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "Days Since Invite Sent", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "35ch" } }, { "columnMatch": "lastLogon", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_RoleName_3", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_RoleName_3", "sortOrder": 1 } ] }, "name": "query - PIM - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Find Azure AD Service Principals that have not successfully signed on for the last 30 days\r\nAADServicePrincipalSignInLogs\r\n| where TimeGenerated > ago(180d)\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by AppId, WorkspaceID=TenantId\r\n| project\r\n ['Last Successful Logon']=TimeGenerated,\r\n ServicePrincipalName,\r\n ServicePrincipalId,\r\n AppId, WorkspaceID\r\n| join kind = leftanti (\r\n AADServicePrincipalSignInLogs\r\n | where TimeGenerated > ago(30d)\r\n | where ResultType == 0\r\n | summarize arg_max(TimeGenerated, *) by AppId, WorkspaceID=TenantId\r\n )\r\n on AppId\r\n| extend ['Days Since Last Logon']=datetime_diff(\"day\", now(), ['Last Successful Logon'])\r\n| project-reorder ['Days Since Last Logon'], ['Last Successful Logon'], ServicePrincipalName, AppId, ServicePrincipalId\r\n| sort by ['Last Successful Logon'] desc ", "size": 0, "title": "Azure AD Service Principals that have not successfully signed on for the last 30 days, count: {$rowCount}", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Days Since Last Logon", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "35ch" } } ], "sortBy": [ { "itemKey": "$gen_bar_Days Since Last Logon_0", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Days Since Last Logon_0", "sortOrder": 2 } ] }, "name": "query - 8" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "users" }, "name": "group - users" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "group: MFA", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where TimeGenerated > ago (90d)\r\n| where ResultType == \"500121\"\r\n| mv-expand todynamic(AuthenticationDetails)\r\n| project AuthenticationDetails, ResultType\r\n| extend ['MFA Failure Type'] = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)\r\n| where ['MFA Failure Type'] startswith \"MFA denied\"\r\n| summarize Count=count()by ['MFA Failure Type']\r\n| sort by Count", "size": 1, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Simple query to count users being spammed with denies or not responding in one hour time windows\r\nSigninLogs\r\n| project\r\n TimeGenerated,\r\n AuthenticationRequirement,\r\n AuthenticationDetails,\r\n UserPrincipalName,\r\n CorrelationId\r\n| where AuthenticationRequirement == \"multiFactorAuthentication\"\r\n| extend AuthResult = tostring(parse_json(AuthenticationDetails)[1].authenticationStepResultDetail)\r\n| where AuthResult in (\"MFA denied; user declined the authentication\",\"MFA denied; user did not respond to mobile app notification\")\r\n| summarize ['Result Types']=make_list(AuthResult), ['Result Count']=count() by UserPrincipalName, bin(TimeGenerated, 60m)\r\n//Find hits with greater than 3 failures in an hour\r\n| where ['Result Count'] > 3", "size": 0, "title": "Query to count users being spammed with denies or not responding in one hour time windows, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Microsoft Sentinel query\r\nSigninLogs\r\n| where TimeGenerated > ago(30d)\r\n| where ResultType == 0\r\n| summarize\r\n ['Total Signin Count']=count(),\r\n ['Total MFA Count']=countif(AuthenticationRequirement == \"multiFactorAuthentication\"),\r\n ['Total non MFA Count']=countif(AuthenticationRequirement == \"singleFactorAuthentication\")\r\n by AppDisplayName\r\n| project\r\n AppDisplayName,\r\n ['Total Signin Count'],\r\n ['Total MFA Count'],\r\n ['Total non MFA Count'],\r\n MFAPercentage=(todouble(['Total MFA Count']) * 100 / todouble(['Total Signin Count']))\r\n| sort by MFAPercentage asc ", "size": 0, "title": "Percentage of authentications to each application that are covered by MFA, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "MFAPercentage", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "filter": true } }, "customWidth": "50", "name": "query - 1 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Microsoft Sentinel query\r\nlet privusers=\r\n IdentityInfo\r\n | where TimeGenerated > ago(21d)\r\n | summarize arg_max(TimeGenerated, *) by AccountUPN\r\n | where isnotempty(AssignedRoles)\r\n//Look for users who hold a privileged role or who have admin in their title, you may need to update to your naming standards\r\n | where AssignedRoles != \"[]\" or AccountUPN contains \"admin\"\r\n | distinct AccountUPN;\r\nSigninLogs\r\n| where TimeGenerated > ago(30d)\r\n| where ResultType == 0\r\n| where UserPrincipalName in~ (privusers)\r\n| summarize\r\n ['Total Signin Count']=count(),\r\n ['Total MFA Count']=countif(AuthenticationRequirement == \"multiFactorAuthentication\"),\r\n ['Total non MFA Count']=countif(AuthenticationRequirement == \"singleFactorAuthentication\")\r\n by UserPrincipalName\r\n| project \r\n UserPrincipalName,\r\n ['Total Signin Count'],\r\n ['Total MFA Count'],\r\n ['Total non MFA Count'],\r\n MFAPercentage=(todouble(['Total MFA Count']) * 100 / todouble(['Total Signin Count']))\r\n| sort by MFAPercentage asc ", "size": 0, "title": "MFA percentage for any users with an Azure AD role or β€˜admin’ in their username, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "MFAPercentage", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "filter": true } }, "customWidth": "50", "name": "query - 1 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Detect when a user denies MFA several times within a single sign in attempt and then completes MFA.\r\n//This could be a sign of someone trying to spam your users with MFA prompts until they accept.\r\n\r\n//Data connector required for this query - Azure Active Directory - Signin Logs\r\n\r\n//Select your threshold of how many times a user denies MFA before accepting\r\nlet threshold=2;\r\nSigninLogs\r\n| project\r\n TimeGenerated,\r\n AuthenticationRequirement,\r\n AuthenticationDetails,\r\n UserPrincipalName,\r\n CorrelationId\r\n//Include only authentications that require MFA\r\n| where AuthenticationRequirement == \"multiFactorAuthentication\"\r\n//Extend authentication result description\r\n| extend AuthResult = tostring(parse_json(AuthenticationDetails)[1].authenticationStepResultDetail)\r\n//Find results that include both denined and completed MFA\r\n| where AuthResult in (\"MFA completed in Azure AD\", \"MFA denied; user declined the authentication\",\"MFA denied; user did not respond to mobile app notification\")\r\n//Create a list of completed and denied MFA challenges per correlation id\r\n| summarize ['Result Types']=make_list(AuthResult) by CorrelationId, UserPrincipalName\r\n//Ensure the list includes both completed and denied MFA challenges\r\n| where ['Result Types'] has (\"MFA completed in Azure AD\") and ['Result Types'] has_any (\"MFA denied; user declined the authentication\", \"MFA denied; user did not respond to mobile app notification\")\r\n| mv-expand ['Result Types'] to typeof(string)\r\n//Expand and count all the denied challenges and then return CorrelationId's where the MFA denied count is greater or equal to your threshold\r\n| where ['Result Types'] has_any (\"MFA denied; user declined the authentication\",\"MFA denied; user did not respond to mobile app notification\")\r\n| summarize ['Denied MFA Count']=count()by ['Result Types'], CorrelationId, UserPrincipalName\r\n| where ['Denied MFA Count'] >= threshold", "size": 0, "title": "Detect when a user denies MFA several times within a single sign in attempt and then completes MFA, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 1 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Detects when a user registers MFA details on their account and then completes self service password reset with a short timeframe\r\n\r\n//Data connector required for this query - Azure Active Directory - Signin Logs\r\n//Data connector required for this query - Azure Active Directory - Audit Logs\r\n\r\nlet timeframe=4h;\r\nAuditLogs\r\n//| where TimeGenerated > ago(1d)\r\n| where OperationName in (\"User changed default security info\", \"User registered all required security info\", \"User registered security info\")\r\n| extend User = tostring(TargetResources[0].userPrincipalName)\r\n| project SecurityInfoTime=TimeGenerated, User, OperationName\r\n| join kind=inner (\r\n AuditLogs\r\n //| where TimeGenerated > ago(1d)\r\n | where OperationName in (\"Reset password (self-service)\", \"Change password (self-service)\")\r\n | where Result == \"success\"\r\n | extend User = tostring(TargetResources[0].userPrincipalName)\r\n | project PasswordResetTime=TimeGenerated, OperationName, User)\r\n on User\r\n| where (PasswordResetTime - SecurityInfoTime) between (0min .. timeframe)\r\n| project-away User1", "size": 0, "title": "Detects when a user registers MFA details on their account and then completes self service password reset with a short timeframe, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 1 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Detect when MFA details for a user are changed, deleted or registered from an IP address that user has never signed in successfully from\r\n\r\n//Data connector required for this query - Azure Active Directory - Signin Logs\r\n//Data connector required for this query - Azure Active Directory - Audit Logs\r\n\r\n//Cache all successful sign in data for users using materialize operator\r\nlet signindata=materialize (\r\n SigninLogs\r\n | where TimeGenerated > ago(180d)\r\n | where ResultType == 0\r\n | distinct UserPrincipalName, UserId, IPAddress);\r\n//Search for audit events showing MFA registrations, deletions or changes in the last day\r\nAuditLogs\r\n| where TimeGenerated > ago(10d)\r\n| where OperationName in (\"User registered security info\", \"User deleted security info\", \"User registered all required security info\")\r\n| where Result == \"success\"\r\n| extend IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n| extend UserPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| extend UserId = tostring(TargetResources[0].id)\r\n| project UserPrincipalName, UserId, IPAddress, OperationName\r\n//Join those events back to our summarized sign in data looking for users who register MFA from an IP they have never signed in from\r\n| where isnotempty(IPAddress)\r\n| join kind=leftanti (signindata) on IPAddress, UserId\r\n| distinct UserPrincipalName, IPAddress, OperationName", "size": 0, "title": "Detect when MFA details for a user are changed, deleted or registered from an IP address that user has never signed in successfully from, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 1 - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "mfa" }, "name": "group - MFA" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Identity Info", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Who are all my guest accounts in the tenant?\r\nIdentityInfo\r\n| summarize arg_max(TimeGenerated, *) by AccountObjectId\r\n| where UserType == \"Guest\"\r\n| extend org_ = split(AccountUPN,\"@\")[1]\r\n| project-reorder AccountUPN\r\n| order by TimeGenerated desc", "size": 0, "title": "Count of guest accounts in the tenant: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "org_" ], "expandTopLevel": true } } }, "name": "query - Guest accounts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Who are all my guest accounts in the tenant?\r\nIdentityInfo\r\n| where UserType == \"Guest\"\r\n//| summarize dcount(AccountObjectId) by AccountUPN, bin(TimeGenerated,{TimeRange:grain})\r\n| make-series dcount(AccountObjectId) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUPN\r\n\r\n", "size": 0, "title": "Count of guest accounts in the tenant: {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query - Guest accounts - over time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n//Which of my users are only AAD users (i.e. not synced from my on prem AD)?\r\n\r\nIdentityInfo\r\n| summarize arg_max(TimeGenerated, *) by AccountObjectId\r\n| where isempty(OnPremisesDistinguishedName)", "size": 0, "title": "Which of my users are only AAD users (i.e. not synced from my on prem AD): {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query - AAD users" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n//Which of my users are not AAD users (i.e. not synced from my on prem AD)?\r\n\r\nIdentityInfo\r\n| summarize arg_max(TimeGenerated, *) by AccountObjectId\r\n| where isnotempty(OnPremisesDistinguishedName)", "size": 0, "title": "Which of my users are not AAD users (i.e. synced from my on prem AD): {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query - AAD users - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Which users have assigned \"privileged\" Azure Active Directory roles?\r\nlet PrivielgedRoles = dynamic([\"Global Administrator\",\"Security Administrator\"]);\r\nIdentityInfo\r\n| summarize arg_max(TimeGenerated, *) by AccountObjectId\r\n| mv-expand AssignedRoles\r\n| where AssignedRoles in~ (PrivielgedRoles)\r\n| summarize AssignedRoles=make_set(AssignedRoles) by AccountObjectId, AccountSID, AccountUPN, AccountDisplayName, JobTitle, Department", "size": 0, "title": "Which users have assigned \"privileged\" Azure Active Directory roles?: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query - priv AAD roles" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "identity" }, "name": "group - Identity Info" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Self Service Password reset", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where LoggedByService == \"Self-service Password Management\"\r\n| extend User = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| extend ['User IP Address'] = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n| sort by TimeGenerated asc \r\n| summarize ['SSPR Actions']=make_list(ResultReason) by CorrelationId, User, ['User IP Address']\r\n| where ['SSPR Actions'] has \"User's account has insufficient authentication methods defined. Add authentication info to resolve this\"\r\n| sort by User desc ", "size": 0, "title": "Users who are trying to use the self-service password reset functionality but failing. Count: {$rowCount}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where LoggedByService == \"Self-service Password Management\"\r\n| extend User = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| extend ['User IP Address'] = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n| sort by TimeGenerated asc \r\n| summarize ['SSPR Actions']=make_list_if(ResultReason, ResultReason has \"User submitted a new password\") by CorrelationId, User, ['User IP Address']\r\n| where array_length(['SSPR Actions']) >= 3\r\n| sort by User desc ", "size": 0, "title": "Users who are getting stuck during the password reset flow, 3 or more errors. Count: {$rowCount}", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "query - stuck" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "sspr" }, "name": "group - sspr" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "identity" }, "name": "group - Identity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SOC Metrics", "items": [ { "type": 1, "content": { "json": "### Define your SLA's or 1=High, 8=Medium, 24=Low will be used \r\n\r\n## - change HELP toggle to YES for more detail on SLA and Median, Average and P90 (tail-risk)\r\n", "style": "info" }, "name": "text - 15" }, { "type": 1, "content": { "json": "\r\n| Metric | Tells You |\r\n| ----------- | --------------------- |\r\n| **Median** | Typical performance |\r\n| **Average** | Total workload impact |\r\n| **P90** | Long-tail risk |\r\n\r\nFor example: \r\n- Median = 45 minutes (looks great) \r\n- P90 = 900 minutes (problem! β€œHow bad things get when they go wrong.”) \r\n- Average = 200 minutes (tail influencing cost, a.k.a tail-risk) \r\n-\r\nMedian reflects reality, average reflects mathematical distortion. \r\nMost incidents close quickly, however a small number take a very long time (waiting on customer, forensic work, third parties, etc... which is refelcted in the Average, put simply: Average gets Distorted by Outliers)\r\n\r\nExample\r\n\r\nImagine 100 incidents:\r\n\r\n- 85 resolved in under 60 minutes\r\n- 10 resolved in 2–4 hours\r\n- 5 took 20+ hours\r\n\r\nMedian might be:\r\n- 45 minutes (looks healthy) \r\n\r\nBut P90 might be:\r\n- 12 hours \r\n\r\nThat means:\r\n- 10% of incidents take 12+ hours\r\n\r\nThat’s your tail risk.\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 15 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1ee145ba-6384-48b5-b501-0d977832c21a", "version": "KqlParameterItem/1.0", "name": "slaHigh", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "1", "label": "SLA for HIGH in hours" }, { "version": "KqlParameterItem/1.0", "name": "slaMedium", "label": "SLA for MEDIUM in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "8", "id": "3b148959-329b-4d65-bbe2-aa6ac48d3f48" }, { "version": "KqlParameterItem/1.0", "name": "slaLow", "label": "SLA for Low in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "24", "id": "d59c2800-d4df-4695-a5ac-a3ea00232a59" }, { "version": "KqlParameterItem/1.0", "name": "slaInfo", "label": "SLA for Informational in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "10000", "id": "b96aee49-14e6-4e52-bb27-1aaa0264df73" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// 1) Build per-incident dataset (latest record)\r\n// ---------------------------------------------\r\nlet Incidents =\r\n SecurityIncident\r\n | where isnotempty(IncidentNumber)\r\n | where isnotempty(CreatedTime)\r\n | summarize arg_max(LastModifiedTime, *) by IncidentNumber\r\n | extend\r\n // MTTT / MTTH: Created -> FirstModified\r\n TTT_hours = iff(isnotnull(CreatedTime) and isnotnull(FirstModifiedTime),\r\n datetime_diff(\"minute\", FirstModifiedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTC: Created -> Closed\r\n TTC_hours = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n datetime_diff(\"minute\", ClosedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTD: FirstActivity -> Created\r\n TTD_hours = iff(isnotnull(FirstActivityTime) and isnotnull(CreatedTime),\r\n datetime_diff(\"minute\", CreatedTime, FirstActivityTime) / 60.0,\r\n real(null));\r\n\r\n// ---------------------------------------------\r\n// 2) Aggregate metrics\r\n// ---------------------------------------------\r\nIncidents\r\n| summarize\r\n TotalIncidents = dcount(IncidentNumber),\r\n\r\n HighCount = countif(Severity == \"High\"),\r\n MediumCount = countif(Severity == \"Medium\"),\r\n LowCount = countif(Severity == \"Low\"),\r\n Informational = countif(Severity == \"Informational\"),\r\n\r\n MTTT_P50_hours = percentile(TTT_hours, 50),\r\n MTTC_P50_hours = percentile(TTC_hours, 50),\r\n MTTD_P50_hours = percentile(TTD_hours, 50),\r\n MTTC_P90_hours = percentile(TTC_hours, 90)\r\n\r\n// ---------------------------------------------\r\n// 3) Rename columns with emoji labels + round\r\n// ---------------------------------------------\r\n| project\r\n TotalIncidents,\r\n\r\n [\"High πŸ”΄\"] = HighCount,\r\n [\"Medium 🟑\"] = MediumCount,\r\n [\"Low 🟒\"] = LowCount,\r\n Informational,\r\n\r\n ['MTTT/H (hours)'] = round(MTTT_P50_hours, 2),\r\n ['MTTC (hours)'] = round(MTTC_P50_hours, 2),\r\n ['MTTD (hours)'] = round(MTTD_P50_hours, 2),\r\n ['MTTC, worst 10% (hours)'] = round(MTTC_P90_hours, 2)", "size": 0, "title": "SOC Incident Performance Overview", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "IncidentCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "30ch" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "rowLimit": 5000, "filter": true } }, "customWidth": "75", "name": "query - 39 - Copy - Copy" }, { "type": 1, "content": { "json": "## Incident Metrics\r\n\r\n### Counts by Severity\r\n- High \r\n- Medium \r\n- Low \r\n- Informational \r\n\r\n### Time-Based Metrics\r\n\r\nP50 (median) – typical performance, for Operational SOC reporting\r\n\r\nP90 – worst-case operational performance / long tail outliers (worst 10%), SLA breach tracking\r\n\r\n| Metric | Definition | Time Calculation |\r\n|--------|------------|-----------------|\r\n| MTTT / MTTH | Mean Time to Triage / Handle | Created β†’ FirstModified |\r\n| MTTC | Mean Time to Close | Created β†’ Closed |\r\n| MTTD | Mean Time to Detect | FirstActivity β†’ Created |\r\n\r\n" }, "customWidth": "25", "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// 0) Workbook parameters\r\n// ---------------------------------------------\r\nlet StartTime = todatetime({TimeRange:start});\r\nlet EndTime = todatetime({TimeRange:end});\r\n\r\n// SLA parameters entered in HOURS; convert to MINUTES with defaults\r\nlet SLA_High_Min = iff(isempty(trim(\" \", \"{slaHigh}\")), 60.0, toreal(\"{slaHigh}\") * 60.0);\r\nlet SLA_Medium_Min = iff(isempty(trim(\" \", \"{slaMedium}\")), 480.0, toreal(\"{slaMedium}\") * 60.0);\r\nlet SLA_Low_Min = iff(isempty(trim(\" \", \"{slaLow}\")), 1440.0, toreal(\"{slaLow}\") * 60.0);\r\nlet SLA_Info_Min = iff(isempty(trim(\" \", \"{slaInfo}\")), real(null), toreal(\"{slaInfo}\") * 60.0);\r\n\r\n// ---------------------------------------------\r\n// 1) Build per-incident dataset (latest record)\r\n// ---------------------------------------------\r\nlet Incidents =\r\n SecurityIncident\r\n | where isnotempty(IncidentNumber)\r\n | where TimeGenerated between (StartTime .. EndTime)\r\n | summarize arg_max(LastModifiedTime, *) by IncidentNumber\r\n | extend\r\n // MTTT / MTTH: Created -> FirstModified\r\n TTT_hours = iff(isnotnull(CreatedTime) and isnotnull(FirstModifiedTime),\r\n datetime_diff(\"minute\", FirstModifiedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTC: Created -> Closed\r\n TTC_hours = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n datetime_diff(\"minute\", ClosedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTD: FirstActivity -> Created\r\n TTD_hours = iff(isnotnull(FirstActivityTime) and isnotnull(CreatedTime),\r\n datetime_diff(\"minute\", CreatedTime, FirstActivityTime) / 60.0,\r\n real(null)),\r\n\r\n // Internal: MTTC in minutes (for SLA comparison)\r\n TTC_Minutes = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n todouble(datetime_diff(\"minute\", ClosedTime, CreatedTime)),\r\n real(null)),\r\n\r\n // Internal: SLA target (minutes) per severity\r\n SLA_Target_Minutes = case(\r\n Severity == \"High\", SLA_High_Min,\r\n Severity == \"Medium\", SLA_Medium_Min,\r\n Severity == \"Low\", SLA_Low_Min,\r\n Severity == \"Informational\", SLA_Info_Min,\r\n real(null)\r\n )\r\n | extend\r\n // Only evaluate SLA for closed incidents with a configured SLA target\r\n HasSLA = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes), 1, 0),\r\n SLA_Within = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes) and TTC_Minutes <= SLA_Target_Minutes, 1, 0),\r\n SLA_Breached = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes) and TTC_Minutes > SLA_Target_Minutes, 1, 0);\r\n\r\n// ---------------------------------------------\r\n// 2) Break down metrics by Severity\r\n// ---------------------------------------------\r\nIncidents\r\n| summarize\r\n TotalIncidents = dcount(IncidentNumber),\r\n MTTT_P50_hours = percentile(TTT_hours, 50),\r\n MTTC_P50_hours = percentile(TTC_hours, 50),\r\n MTTD_P50_hours = percentile(TTD_hours, 50),\r\n MTTC_P90_hours = percentile(TTC_hours, 90),\r\n\r\n // SLA rollups per severity\r\n SLA_Target_Minutes = any(SLA_Target_Minutes),\r\n ['Within SLA'] = sum(SLA_Within),\r\n ['SLA breach'] = sum(SLA_Breached),\r\n SLA_Evaluated = sum(HasSLA)\r\n by Severity\r\n| extend\r\n ['SLA attainment %'] =\r\n iff(SLA_Evaluated == 0, real(null), round(100.0 * todouble(['Within SLA']) / todouble(SLA_Evaluated), 2))\r\n\r\n// ---------------------------------------------\r\n// 3) Add severity ranking + emoji labels\r\n// ---------------------------------------------\r\n| extend\r\n SeverityRank = case(\r\n Severity == \"High\", 1,\r\n Severity == \"Medium\", 2,\r\n Severity == \"Low\", 3,\r\n Severity == \"Informational\", 4,\r\n 99\r\n ),\r\n SeverityLabel = case(\r\n Severity == \"High\", \"High πŸ”΄\",\r\n Severity == \"Medium\", \"Medium 🟑\",\r\n Severity == \"Low\", \"Low 🟒\",\r\n Severity == \"Informational\", \"Informational\",\r\n Severity\r\n )\r\n\r\n// ---------------------------------------------\r\n// 4) Sort using numeric rank\r\n// ---------------------------------------------\r\n| sort by SeverityRank asc\r\n\r\n// ---------------------------------------------\r\n// 5) Final projection (keep existing column names)\r\n// ---------------------------------------------\r\n| project\r\n Severity = SeverityLabel,\r\n TotalIncidents,\r\n ['MTTT/H (hours)'] = round(MTTT_P50_hours, 2),\r\n ['MTTC (hours)'] = round(MTTC_P50_hours, 2),\r\n ['MTTD (hours)'] = round(MTTD_P50_hours, 2),\r\n ['MTTC, worst 10% (hours)'] = round(MTTC_P90_hours, 2),\r\n// SLA\r\n \r\n ['Within SLA'],\r\n ['SLA breach'],\r\n ['SLA attainment %'],\r\n ['SLA value (hours)'] = iff(isnull(SLA_Target_Minutes), real(null), round(SLA_Target_Minutes / 60.0, 2))\r\n", "size": 0, "title": "SOC Incident Performance by Severity with adjustable SLA", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TotalIncidents", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "MTTC, worst 10% (hours)", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "SLA breach", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "SLA attainment %", "formatter": 8, "formatOptions": { "palette": "blackWhite" } } ] } }, "name": "query - 9 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b1c89364-7960-487a-a708-eed1ee9a1ddb", "version": "KqlParameterItem/1.0", "name": "selectSLA", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"MTTCworst\", \"label\": \"MTTC, worst 10% (hours)\" },\r\n { \"value\": \"withinSLA\", \"label\": \"Within SLA\", \"selected\": true },\r\n { \"value\": \"SLAbreach\", \"label\": \"SLA breach\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "value": "MTTCworst" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "parameters - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// 0) Workbook parameters\r\n// ---------------------------------------------\r\nlet StartTime = todatetime({TimeRange:start});\r\nlet EndTime = todatetime({TimeRange:end});\r\nlet SelectSLA = \"{selectSLA}\";\r\n\r\n// SLA parameters entered in HOURS; convert to MINUTES with defaults\r\nlet SLA_High_Min = iff(isempty(trim(\" \", \"{slaHigh}\")), 60.0, toreal(\"{slaHigh}\") * 60.0);\r\nlet SLA_Medium_Min = iff(isempty(trim(\" \", \"{slaMedium}\")), 480.0, toreal(\"{slaMedium}\") * 60.0);\r\nlet SLA_Low_Min = iff(isempty(trim(\" \", \"{slaLow}\")), 1440.0, toreal(\"{slaLow}\") * 60.0);\r\nlet SLA_Info_Min = iff(isempty(trim(\" \", \"{slaInfo}\")), real(null), toreal(\"{slaInfo}\") * 60.0);\r\n\r\n// ---------------------------------------------\r\n// 1) Build per-incident dataset (latest record)\r\n// ---------------------------------------------\r\nlet Incidents =\r\n SecurityIncident\r\n | where isnotempty(IncidentNumber)\r\n | where TimeGenerated between (StartTime .. EndTime)\r\n | summarize arg_max(LastModifiedTime, *) by IncidentNumber\r\n | extend\r\n // MTTT / MTTH: Created -> FirstModified\r\n TTT_hours = iff(isnotnull(CreatedTime) and isnotnull(FirstModifiedTime),\r\n datetime_diff(\"minute\", FirstModifiedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTC: Created -> Closed\r\n TTC_hours = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n datetime_diff(\"minute\", ClosedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n\r\n // MTTD: FirstActivity -> Created\r\n TTD_hours = iff(isnotnull(FirstActivityTime) and isnotnull(CreatedTime),\r\n datetime_diff(\"minute\", CreatedTime, FirstActivityTime) / 60.0,\r\n real(null)),\r\n\r\n // Internal: MTTC in minutes (for SLA comparison)\r\n TTC_Minutes = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n todouble(datetime_diff(\"minute\", ClosedTime, CreatedTime)),\r\n real(null)),\r\n\r\n // Internal: SLA target (minutes) per severity\r\n SLA_Target_Minutes = case(\r\n Severity == \"High\", SLA_High_Min,\r\n Severity == \"Medium\", SLA_Medium_Min,\r\n Severity == \"Low\", SLA_Low_Min,\r\n Severity == \"Informational\", SLA_Info_Min,\r\n real(null)\r\n )\r\n | extend\r\n HasSLA = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes), 1, 0),\r\n SLA_Within = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes) and TTC_Minutes <= SLA_Target_Minutes, 1, 0),\r\n SLA_Breached = iff(isnotnull(TTC_Minutes) and isnotnull(SLA_Target_Minutes) and TTC_Minutes > SLA_Target_Minutes, 1, 0);\r\n\r\n// ---------------------------------------------\r\n// 2) Calculate worst 10% MTTC threshold\r\n// ---------------------------------------------\r\nlet MTTCWorstThreshold =\r\n toscalar(\r\n Incidents\r\n | where isnotnull(TTC_hours)\r\n | summarize percentile(TTC_hours, 90)\r\n );\r\n\r\n// ---------------------------------------------\r\n// 3) Return incident list based on selectSLA\r\n// ---------------------------------------------\r\nIncidents\r\n| where\r\n case(\r\n SelectSLA == \"MTTCworst\", isnotnull(TTC_hours) and TTC_hours >= MTTCWorstThreshold,\r\n SelectSLA == \"withinSLA\", SLA_Within == 1,\r\n SelectSLA == \"SLAbreach\", SLA_Breached == 1,\r\n true\r\n )\r\n| extend\r\n SeverityRank = case(\r\n Severity == \"High\", 1,\r\n Severity == \"Medium\", 2,\r\n Severity == \"Low\", 3,\r\n Severity == \"Informational\", 4,\r\n 99\r\n ),\r\n SeverityLabel = case(\r\n Severity == \"High\", \"High πŸ”΄\",\r\n Severity == \"Medium\", \"Medium 🟑\",\r\n Severity == \"Low\", \"Low 🟒\",\r\n Severity == \"Informational\", \"Informational\",\r\n Severity\r\n )\r\n| sort by SeverityRank asc, TTC_hours desc\r\n| project\r\n IncidentNumber,\r\n Title,\r\n Severity = SeverityLabel,\r\n Status,\r\n Owner,\r\n CreatedTime,\r\n ClosedTime,\r\n ['MTTT/H (hours)'] = round(TTT_hours, 2),\r\n ['MTTC (hours)'] = round(TTC_hours, 2),\r\n ['MTTD (hours)'] = round(TTD_hours, 2),\r\n //['MTTC, worst 10% threshold (hours)'] = round(MTTCWorstThreshold, 2),\r\n ['Within SLA'] = iff(SLA_Within == 1, \"Yes\", \"No\"),\r\n ['SLA breach'] = iff(SLA_Breached == 1, \"Yes\", \"No\"),\r\n ['SLA value (hours)'] = iff(isnull(SLA_Target_Minutes), real(null), round(SLA_Target_Minutes / 60.0, 2))", "size": 0, "title": "Filtering on {selectSLA}, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "MTTC, worst 10% threshold (hours)", "formatter": 5 } ] } }, "customWidth": "70", "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// Counts by Severity over time (CreatedTime)\r\n// ---------------------------------------------\r\n\r\nlet BinSize = 1d;\r\n\r\nSecurityIncident\r\n//| summarize arg_max(LastModifiedTime, *) by IncidentNumber\r\n| summarize\r\n //TotalIncidents = dcount(IncidentNumber),\r\n [\"High πŸ”΄\"] = countif(Severity == \"High\"),\r\n [\"Medium 🟑\"] = countif(Severity == \"Medium\"),\r\n [\"Low 🟒\"] = countif(Severity == \"Low\"),\r\n Informational = countif(Severity == \"Informational\")\r\n by TimeBucket = bin(TimeGenerated, BinSize)\r\n| sort by TimeBucket asc\r\n", "size": 0, "title": "Counts by severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "categoricalbar", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High πŸ”΄", "color": "redBright" }, { "seriesName": "Medium 🟑", "color": "yellow" }, { "seriesName": "Low 🟒", "color": "green" }, { "seriesName": "Informational", "color": "gray" } ] } }, "customWidth": "50", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// Median MTTx (P50) + MTTC P90 over time\r\n// ---------------------------------------------\r\nlet Lookback = 30d;\r\nlet BinSize = 1d;\r\n\r\nSecurityIncident\r\n//| where CreatedTime >= ago(Lookback)\r\n| summarize arg_max(LastModifiedTime, *) by IncidentNumber\r\n| extend\r\n // MTTT / MTTH: Created -> FirstModified\r\n TTT_hours = iff(isnotnull(CreatedTime) and isnotnull(FirstModifiedTime),\r\n datetime_diff(\"minute\", FirstModifiedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n // MTTC: Created -> Closed\r\n TTC_hours = iff(isnotnull(CreatedTime) and isnotnull(ClosedTime),\r\n datetime_diff(\"minute\", ClosedTime, CreatedTime) / 60.0,\r\n real(null)),\r\n // MTTD: FirstActivity -> Created\r\n TTD_hours = iff(isnotnull(FirstActivityTime) and isnotnull(CreatedTime),\r\n datetime_diff(\"minute\", CreatedTime, FirstActivityTime) / 60.0,\r\n real(null))\r\n| summarize\r\n [\"MTTT/H (hours)\"] = round(percentile(TTT_hours, 50), 2),\r\n [\"MTTC (hours)\"] = round(percentile(TTC_hours, 50), 2),\r\n [\"MTTD (hours)\"] = round(percentile(TTD_hours, 50), 2),\r\n [\"MTTC, worst 10% (hours)\"] = round(percentile(TTC_hours, 90), 2)\r\n by TimeBucket = bin(TimeGenerated, BinSize)\r\n| sort by TimeBucket asc\r\n| render timechart", "size": 0, "title": "MTTT / MTTC / MTTD", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MTTC, worst 10% (hours)", "color": "redBright" }, { "seriesName": "MTTT/H (hours)", "color": "green" }, { "seriesName": "MTTC (hours)", "color": "blue" }, { "seriesName": "MTTD (hours)", "color": "purpleDark" } ] } }, "customWidth": "50", "name": "query - 10 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cb08a5d5-2a8e-4978-b6e4-8687bb603b06", "version": "KqlParameterItem/1.0", "name": "GroupBy", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n { \"value\": \"ProductName\", \"label\": \"Product Name\", \"selected\": true },\r\n { \"value\": \"Tactics\", \"label\": \"MITRE Tactics\" },\r\n { \"value\": \"Tags\", \"label\": \"Tags\" },\r\n { \"value\": \"Owner\", \"label\": \"Owner\" }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// ---------------------------------------------\r\n// Counts by Severity over time (TimeGenerated)\r\n// Grouping controlled by workbook parameter {GroupBy}\r\n// Options: ProductName, Tactics, Tags, Owner\r\n// ---------------------------------------------\r\nlet BinSize = 1d;\r\nlet StartTime = todatetime({TimeRange:start});\r\nlet EndTime = todatetime({TimeRange:end});\r\nlet GroupBy = tostring(\"{GroupBy}\");\r\n\r\nSecurityIncident\r\n| where TimeGenerated between (StartTime .. EndTime)\r\n\r\n// ---- Your field extraction rules ----\r\n| extend\r\n Product = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| extend\r\n Owner = todynamic(Owner.assignedTo)\r\n| extend\r\n Tactics = todynamic(AdditionalData.tactics)\r\n| extend\r\n Tags = extract_all('labelName\":\"(.*?)\"', tostring(Labels))\r\n\r\n// ---- Choose which list to expand (only for Tags/Tactics) ----\r\n| extend\r\n ExpandArr = case(\r\n GroupBy == \"Tactics\", Tactics,\r\n GroupBy == \"Tags\", Tags,\r\n dynamic([\"__NOEXPAND__\"])\r\n )\r\n| mv-expand ExpandArr to typeof(string)\r\n\r\n// ---- Build the grouping key based on the parameter ----\r\n| extend\r\n GroupKey = case(\r\n GroupBy == \"ProductName\", Product,\r\n GroupBy == \"Owner\", tostring(Owner),\r\n GroupBy in (\"Tactics\",\"Tags\"), ExpandArr,\r\n \"Unspecified\"\r\n )\r\n| extend\r\n GroupKey = iff(isempty(trim(\" \", GroupKey)) or GroupKey == \"__NOEXPAND__\", \"Unspecified\", GroupKey)\r\n\r\n// ---- Summarize by time + selected grouping ----\r\n| summarize\r\n [\"High πŸ”΄\"] = countif(Severity == \"High\"),\r\n [\"Medium 🟑\"] = countif(Severity == \"Medium\"),\r\n [\"Low 🟒\"] = countif(Severity == \"Low\"),\r\n Informational = countif(Severity == \"Informational\"),\r\n [\"Count of Incidents\"] = count(),\r\n IncidentNumbers = array_sort_asc( make_set(IncidentNumber) )\r\n by TimeBucket = bin(TimeGenerated, BinSize), GroupKey\r\n\r\n| sort by TimeBucket asc", "size": 0, "title": "Incident by [{GroupBy}] for {TimeRange:label}, count: {$rowCount}. Filtering Allowed", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Count of Incidents", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "IncidentCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "30ch" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "rowLimit": 5000, "filter": true, "sortBy": [ { "itemKey": "GroupKey", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "GroupKey", "sortOrder": 2 } ] }, "customWidth": "60", "name": "query - 39 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize IncidentCount=dcount(IncidentNumber), arg_max(LastActivityTime,LastActivityTime, CreatedTime, Title) by Title\r\n//| top 200 by IncidentNumber desc\r\n| project-away Title1, LastActivityTime1\r\n| order by IncidentCount desc\r\n\r\n\r\n\r\n", "size": 0, "title": "Incident check for {TimeRange:label}, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "IncidentCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "30ch" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "rowLimit": 5000, "filter": true, "labelSettings": [ { "columnId": "IncidentCount", "label": " Incident Count" } ] } }, "customWidth": "40", "name": "query - 39 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// Forecast daily distinct incident volume\r\n// - Look back 90 days (history window)\r\n// - Forecast next 90 days\r\n//\r\nlet LookbackDays = 90d;\r\nlet Step = 1d;\r\nlet ForecastDays = 90; // number of steps forward (must match Step)\r\nlet EndDate = now();\r\nlet StartDate = EndDate - LookbackDays; // explicit history window\r\nlet ProjectTo = EndDate + LookbackDays; // forecast horizon (90d forward)\r\n\r\nSecurityIncident\r\n// Use the same time column consistently (TimeGenerated is OK for volume; CreatedTime is also common)\r\n| make-series IncidentCount = dcount(IncidentNumber) default=0\r\n on TimeGenerated\r\n from StartDate to ProjectTo step Step\r\n// Forecast: returns a dynamic object; keep the original series too\r\n| extend Forecast = series_decompose_forecast(IncidentCount, ForecastDays)\r\n\r\n", "size": 0, "aggregation": 5, "showAnnotations": true, "title": "Daily Incident count, last 90days and 90day forecast", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "filter": true } }, "name": "query - incident and forecast" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "soc" }, "name": "group -SOC Metrics" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "On boarding progress and recommendations ", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Please set your Importance values, click here - if you need to change the defaults", "expandable": true, "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "33a010c2-a9fd-448f-b738-3c614b1a820f", "version": "KqlParameterItem/1.0", "name": "EntraAAD", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "1" }, { "id": "95ba19ad-080b-4470-9e89-61ab0fc98835", "version": "KqlParameterItem/1.0", "name": "CSL", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "2" }, { "id": "a206afe1-d76d-423d-87da-8c56b0788331", "version": "KqlParameterItem/1.0", "name": "Infra", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "2" }, { "id": "140a5639-e0bb-4e01-806c-ea4f72462e03", "version": "KqlParameterItem/1.0", "name": "MDO", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "3" }, { "id": "108d010d-0a17-4eca-93dd-a9731eedf2fc", "version": "KqlParameterItem/1.0", "name": "MDI", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "3" }, { "id": "ac413413-003f-466b-bfb7-be5ade0b6e53", "version": "KqlParameterItem/1.0", "name": "MDE", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "3" }, { "id": "147a07f7-9bdd-45f1-96f4-8ccbbdf90557", "version": "KqlParameterItem/1.0", "name": "Other", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "4" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "75", "name": "parameters - 7" }, { "type": 1, "content": { "json": "### Set priorities of these sections \r\nIf no value is provided, the default priority will be used. This allows you to tweak the defaults provided for your environment.\r\n\r\n| Code | Inmportance |\r\n|-------------|----------|\r\n| EntraAAD | 1 |\r\n| Infra | 2 |\r\n| CSL | 2 |\r\n| MDE | 3 |\r\n| MDO | 3 |\r\n| MDI | 3 |\r\n| Other | 4 |" }, "customWidth": "25", "name": "text - 8" } ], "exportParameters": true }, "name": "group - set Importance group" }, { "type": 1, "content": { "json": "Enabling both free and key paid data sources in Microsoft Sentinel ensures comprehensive security visibility while maintaining cost efficiency.\r\nFree data sources (e.g., OfficeActivity, Azure AD/Entra ID Audit Logs, Defender alerts) provide valuable security telemetry at no additional ingestion cost, delivering immediate visibility into user activity, administrative actions, and security alerts. Leveraging these sources maximizes security coverage and improves detection capabilities without increasing operational spend.\r\nKey paid data sources (such as firewall logs, endpoint telemetry, network security devices, and application logs) add deeper technical visibility into network traffic, endpoint behaviour, and system-level activity, enabling detection of more advanced threats, lateral movement, and data exfiltration.\r\nBy combining both types of data sources, organisations can:\r\nImprove threat detection and investigation capabilities\r\nCorrelate activity across identity, endpoint, cloud, and network layers\r\nMaximise value from existing Microsoft security tooling\r\nMaintain cost control by prioritising high-value telemetry\r\nThis balanced approach allows security teams to achieve strong detection coverage and operational insight while optimising Sentinel ingestion costs." }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\r\n\r\n// =====================\r\n// Office workloads (single scan)\r\n// =====================\r\nlet Office =\r\n OfficeActivity\r\n | where TimeGenerated >= ago(lookback)\r\n | where OfficeWorkload in (\"SharePoint\", \"Exchange\", \"MicrosoftTeams\", \"OneDrive\")\r\n | extend Table = case(\r\n OfficeWorkload == \"MicrosoftTeams\", \"Teams\",\r\n OfficeWorkload\r\n )\r\n | summarize Count=count(), GB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) by Table;\r\n\r\nlet OfficeAll =\r\n datatable(Table:string)\r\n [\r\n \"SharePoint\",\r\n \"Exchange\",\r\n \"Teams\",\r\n \"OneDrive\"\r\n ]\r\n | join kind=leftouter Office on Table\r\n | extend Count = coalesce(Count, 0)\r\n | extend GB = coalesce(GB, 0.0)\r\n | extend Enabled = Count > 0\r\n | extend Section = \"Office\"\r\n | project Section, Table, Enabled, Count, GB;\r\n\r\n\r\n// =====================\r\n// Azure Activity (single scan)\r\n// =====================\r\nlet AzureAll =\r\n AzureActivity\r\n | where TimeGenerated >= ago(lookback)\r\n | summarize Count=count(), GB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2)\r\n | extend Table=\"AzureActivity\"\r\n | extend Enabled = Count > 0\r\n | extend Section = \"Azure\"\r\n | project Section, Table, Enabled, Count, GB;\r\n\r\n\r\n// =====================\r\n// Defender Alerts (single scan)\r\n// =====================\r\nlet Alerts =\r\n SecurityAlert\r\n | where TimeGenerated >= ago(lookback)\r\n | extend Table = case(\r\n ProviderName has \"Azure Security Center\", \"Defender for Cloud Alerts\",\r\n ProviderName has \"MCAS\", \"Defender for Cloud Apps Alerts\",\r\n ProviderName has \"MDATP\", \"Defender for Endpoint Alerts\",\r\n ProviderName has \"OATP\", \"Defender for Office Alerts\",\r\n ProviderName has \"Azure Advanced Threat Protection\", \"Defender for Identity Alerts\",\r\n \"\"\r\n )\r\n | where Table != \"\"\r\n | summarize Count=count(), GB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) by Table;\r\n\r\nlet AlertsAll =\r\n datatable(Table:string)\r\n [\r\n \"Defender for Cloud Alerts\",\r\n \"Defender for Cloud Apps Alerts\",\r\n \"Defender for Endpoint Alerts\",\r\n \"Defender for Office Alerts\",\r\n \"Defender for Identity Alerts\"\r\n ]\r\n | join kind=leftouter Alerts on Table\r\n | extend Count = coalesce(Count, 0)\r\n | extend GB = coalesce(GB, 0.0)\r\n | extend Enabled = Count > 0\r\n | extend Section = \"Defender\"\r\n | project Section, Table, Enabled, Count, GB;\r\n\r\n\r\n// =====================\r\n// Final: Section Health Summary\r\n// =====================\r\nOfficeAll\r\n| union AzureAll, AlertsAll\r\n| summarize\r\n EnabledTables = sum(toint(Enabled)),\r\n TotalTables = count(),\r\n ['Ingested (GB)'] = round(sum(GB), 2),\r\n EnabledList = make_set_if(Table, Enabled == true),\r\n MissingList = make_set_if(Table, Enabled == false)\r\n by Section\r\n| extend\r\n Status = strcat(EnabledTables, \" / \", TotalTables),\r\n PercentEnabled = round(100.0 * EnabledTables / TotalTables, 1),\r\n EnabledList = strcat_array(EnabledList, \", \"),\r\n MissingList = strcat_array(MissingList, \", \")\r\n| order by Section asc\r\n//| project-away EnabledList, MissingList", "size": 0, "title": "Free Tier Connector progression", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "PercentEnabled", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "sortBy": [ { "itemKey": "Ingested (GB)", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Ingested (GB)", "sortOrder": 2 } ] }, "customWidth": "60", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\r\n\r\n// Workbook parameters (defaults if empty) - TEXT parameters\r\nlet EntraAAD_P = iff(isempty(trim(\" \", \"{EntraAAD}\")), 1, toint(\"{EntraAAD}\"));\r\nlet Infra_P = iff(isempty(trim(\" \", \"{Infra}\")), 2, toint(\"{Infra}\"));\r\nlet CSL_P = iff(isempty(trim(\" \", \"{CSL}\")), 2, toint(\"{CSL}\"));\r\nlet MDE_P = iff(isempty(trim(\" \", \"{MDE}\")), 3, toint(\"{MDE}\"));\r\nlet MDO_P = iff(isempty(trim(\" \", \"{MDO}\")), 3, toint(\"{MDO}\"));\r\nlet MDI_P = iff(isempty(trim(\" \", \"{MDI}\")), 3, toint(\"{MDI}\"));\r\nlet Other_P = iff(isempty(trim(\" \", \"{Other}\")), 4, toint(\"{Other}\"));\r\n\r\n// Section importance controls (defaults + overrides)\r\nlet SectionWeights =\r\n union\r\n (print Section=\"Entra/AAD\", Importance=EntraAAD_P),\r\n (print Section=\"Infra\", Importance=Infra_P),\r\n (print Section=\"CSL\", Importance=CSL_P),\r\n (print Section=\"MDE\", Importance=MDE_P),\r\n (print Section=\"MDO\", Importance=MDO_P),\r\n (print Section=\"MDI\", Importance=MDI_P),\r\n (print Section=\"Other\", Importance=Other_P);\r\n\r\n// =====================\r\n// Entra / AAD (each table scanned once)\r\n// =====================\r\nlet AADEnabled =\r\n union\r\n (SigninLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"SigninLogs\"),\r\n (AuditLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"AuditLogs\"),\r\n (AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"AADNonInteractive\"),\r\n (AADServicePrincipalSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Service Principal Sign-in\"),\r\n (AADServicePrincipalRiskEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Service Principal Risk Events\"),\r\n (AADProvisioningLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Provisioning logs\"),\r\n (AADManagedIdentitySignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Managed Identity logs\"),\r\n (ADFSSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"ADFS Sign-ins\"),\r\n (AADUserRiskEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"User Risk Events\"),\r\n (AADRiskyUsers | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Risky User Events\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet AADAll =\r\n datatable(Table:string)\r\n [\r\n \"SigninLogs\",\r\n \"AuditLogs\",\r\n \"AADNonInteractive\",\r\n \"Service Principal Sign-in\",\r\n \"Service Principal Risk Events\",\r\n \"Provisioning logs\",\r\n \"Managed Identity logs\",\r\n \"ADFS Sign-ins\",\r\n \"User Risk Events\",\r\n \"Risky User Events\"\r\n ]\r\n | join kind=leftouter AADEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"Entra/AAD\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// Infra (each table scanned once)\r\n// =====================\r\nlet InfraEnabled =\r\n union\r\n (SecurityEvent | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Windows Security Events\"),\r\n (WindowsEvent | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Windows Events\"),\r\n (Syslog | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"Syslog\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet InfraAll =\r\n datatable(Table:string)\r\n [\r\n \"Windows Security Events\",\r\n \"Windows Events\",\r\n \"Syslog\"\r\n ]\r\n | join kind=leftouter InfraEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"Infra\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// CSL vendors (single scan of CommonSecurityLog)\r\n// =====================\r\nlet CSLVendorsEnabled =\r\n CommonSecurityLog\r\n | where TimeGenerated >= ago(lookback)\r\n | extend Table = case(\r\n DeviceVendor has \"Cisco\", \"Cisco\",\r\n DeviceVendor has \"Check Point\", \"Check Point\",\r\n DeviceVendor has \"Palo Alto\", \"Palo Alto\",\r\n DeviceVendor has \"F5\", \"F5\",\r\n DeviceVendor has \"Fortinet\", \"Fortinet\",\r\n DeviceVendor has \"Barracuda\", \"Barracuda\",\r\n DeviceVendor has \"ExtraHop\", \"ExtraHop\",\r\n DeviceVendor has \"OneIdentity\", \"OneIdentity\",\r\n DeviceVendor has \"Zscaler\", \"Zscaler\",\r\n DeviceVendor has \"ForgeRock\", \"ForgeRock\",\r\n DeviceVendor has \"CyberArk\", \"CyberArk\",\r\n DeviceVendor has \"Illusive\", \"Illusive\",\r\n DeviceVendor has \"Vectra Networks\", \"Vectra Networks\",\r\n DeviceVendor has \"Citrix\", \"Citrix\",\r\n \"\"\r\n )\r\n | where Table != \"\"\r\n | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) by Table;\r\n\r\nlet CSLAll =\r\n datatable(Table:string)\r\n [\r\n \"Cisco\",\r\n \"Check Point\",\r\n \"Palo Alto\",\r\n \"F5\",\r\n \"Fortinet\",\r\n \"Barracuda\",\r\n \"ExtraHop\",\r\n \"OneIdentity\",\r\n \"Zscaler\",\r\n \"ForgeRock\",\r\n \"CyberArk\",\r\n \"Illusive\",\r\n \"Vectra Networks\",\r\n \"Citrix\"\r\n ]\r\n | join kind=leftouter CSLVendorsEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"CSL\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// MDE (each table scanned once)\r\n// =====================\r\nlet MDEEnabled =\r\n union\r\n (DeviceInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Info\"),\r\n (DeviceNetworkInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Network Info\"),\r\n (DeviceProcessEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Process Events\"),\r\n (DeviceNetworkEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Network Events\"),\r\n (DeviceFileEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device File Events\"),\r\n (DeviceRegistryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Registry Events\"),\r\n (DeviceLogonEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Logon Events\"),\r\n (DeviceImageLoadEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Image Load Events\"),\r\n (DeviceEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device Events\"),\r\n (DeviceFileCertificateInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDE Device File Certificate Info\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet MDEAll =\r\n datatable(Table:string)\r\n [\r\n \"MDE Device Info\",\r\n \"MDE Device Network Info\",\r\n \"MDE Device Process Events\",\r\n \"MDE Device Network Events\",\r\n \"MDE Device File Events\",\r\n \"MDE Device Registry Events\",\r\n \"MDE Device Logon Events\",\r\n \"MDE Device Image Load Events\",\r\n \"MDE Device Events\",\r\n \"MDE Device File Certificate Info\"\r\n ]\r\n | join kind=leftouter MDEEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"MDE\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// MDO (each table scanned once)\r\n// =====================\r\nlet MDOEnabled =\r\n union\r\n (EmailEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDO Email Events\"),\r\n (EmailUrlInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDO Email URL Info\"),\r\n (EmailAttachmentInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDO Email Attachment Info\"),\r\n (EmailPostDeliveryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDO Email Post-Delivery Events\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet MDOAll =\r\n datatable(Table:string)\r\n [\r\n \"MDO Email Events\",\r\n \"MDO Email URL Info\",\r\n \"MDO Email Attachment Info\",\r\n \"MDO Email Post-Delivery Events\"\r\n ]\r\n | join kind=leftouter MDOEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"MDO\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// MDI (own section; each table scanned once)\r\n// =====================\r\nlet MDIEnabled =\r\n union\r\n (IdentityLogonEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDI Logon Events\"),\r\n (IdentityQueryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDI Query Events\"),\r\n (IdentityDirectoryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDI Directory Events\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet MDIAll =\r\n datatable(Table:string)\r\n [\r\n \"MDI Logon Events\",\r\n \"MDI Query Events\",\r\n \"MDI Directory Events\"\r\n ]\r\n | join kind=leftouter MDIEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"MDI\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// Other (MDCA / TI; each table scanned once)\r\n// =====================\r\nlet OtherEnabled =\r\n union\r\n (CloudAppEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"MDCA Cloud App Events\"),\r\n (ThreatIntelligenceIndicator | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 4) | extend Table=\"ThreatIntelligenceIndicator\")\r\n | project Table, c, IngestedGB;\r\n\r\nlet OtherAll =\r\n datatable(Table:string)\r\n [\r\n \"MDCA Cloud App Events\",\r\n \"ThreatIntelligenceIndicator\"\r\n ]\r\n | join kind=leftouter OtherEnabled on Table\r\n | extend Enabled = coalesce(c, 0) > 0\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend Section = \"Other\"\r\n | project Section, Table, Enabled, IngestedGB;\r\n\r\n// =====================\r\n// Final: Total Possible vs Enabled per Section (Workbook Tiles-ready)\r\n// =====================\r\nlet AllSections =\r\n AADAll\r\n | union InfraAll, CSLAll, MDEAll, MDOAll, MDIAll, OtherAll\r\n | join kind=leftouter SectionWeights on Section;\r\n\r\nAllSections\r\n| summarize\r\n EnabledTables = sum(toint(Enabled)),\r\n TotalTables = count(),\r\n IngestedGB = round(sum(IngestedGB), 2)\r\n by Section, Importance\r\n| extend\r\n Status = strcat(EnabledTables, \" / \", TotalTables),\r\n PercentEnabled = round(100.0 * EnabledTables / TotalTables, 1)\r\n| order by Importance asc, Section asc", "size": 0, "title": "Commonly Used Paid Tier Connector progression", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Importance", "formatter": 8, "formatOptions": { "palette": "blackWhite" } }, { "columnMatch": "PercentEnabled", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "sortBy": [ { "itemKey": "$gen_heatmap_Importance_1", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_Importance_1", "sortOrder": 1 } ] }, "customWidth": "40", "name": "query - 4" }, { "type": 1, "content": { "json": "> πŸ“– [Microsoft Sentinel free data sources](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#free-data-sources)" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let expectedTables = datatable(Category:string, Table:string)\r\n[\r\n \"1. E5 Security Benefit\", \"AADManagedIdentitySignInLogs\",\r\n \"1. E5 Security Benefit\", \"AADNonInteractiveUserSignInLogs\",\r\n \"1. E5 Security Benefit\", \"AADProvisioningLogs\",\r\n \"1. E5 Security Benefit\", \"AADRiskyUsers\",\r\n \"1. E5 Security Benefit\", \"AADServicePrincipalRiskEvents\",\r\n \"1. E5 Security Benefit\", \"AADServicePrincipalSignInLogs\",\r\n \"1. E5 Security Benefit\", \"AADUserRiskEvents\",\r\n \"1. E5 Security Benefit\", \"ADFSSignInLogs\",\r\n \"1. E5 Security Benefit\", \"AuditLogs\",\r\n \"1. E5 Security Benefit\", \"SigninLogs\",\r\n \"1. E5 Security Benefit\", \"DeviceEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceFileCertificateInfo\",\r\n \"1. E5 Security Benefit\", \"DeviceFileEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceImageLoadEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceInfo\",\r\n \"1. E5 Security Benefit\", \"DeviceLogonEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceNetworkEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceNetworkInfo\",\r\n \"1. E5 Security Benefit\", \"DeviceProcessEvents\",\r\n \"1. E5 Security Benefit\", \"DeviceRegistryEvents\",\r\n \"1. E5 Security Benefit\", \"IdentityDirectoryEvents\",\r\n \"1. E5 Security Benefit\", \"IdentityLogonEvents\",\r\n \"1. E5 Security Benefit\", \"IdentityQueryEvents\",\r\n \"1. E5 Security Benefit\", \"EmailAttachmentInfo\",\r\n \"1. E5 Security Benefit\", \"EmailEvents\",\r\n \"1. E5 Security Benefit\", \"EmailPostDeliveryEvents\",\r\n \"1. E5 Security Benefit\", \"EmailUrlInfo\",\r\n \"1. E5 Security Benefit\", \"CloudAppEvents\",\r\n \"1. E5 Security Benefit\", \"AlertInfo\",\r\n \"1. E5 Security Benefit\", \"AlertEvidence\",\r\n \"2. Defender for Servers P2\", \"SecurityAlert\",\r\n \"2. Defender for Servers P2\", \"SecurityBaseline\",\r\n \"2. Defender for Servers P2\", \"SecurityBaselineSummary\",\r\n \"2. Defender for Servers P2\", \"SecurityDetection\",\r\n \"2. Defender for Servers P2\", \"SecurityEvent\",\r\n \"2. Defender for Servers P2\", \"WindowsFirewall\",\r\n \"2. Defender for Servers P2\", \"ProtectionStatus\",\r\n \"2. Defender for Servers P2\", \"Update\",\r\n \"2. Defender for Servers P2\", \"UpdateSummary\",\r\n \"2. Defender for Servers P2\", \"MDCFileIntegrityMonitoringEvents\",\r\n \"2. Defender for Servers P2\", \"WindowsEvent\"\r\n];\r\n\r\nlet usageSummary =\r\n Usage\r\n | where TimeGenerated {TimeRange}\r\n | summarize IngestedGB = sum(Quantity) / 1000 by Table = DataType;\r\n\r\nlet Days = 30.0;\r\n\r\nexpectedTables\r\n| join kind=leftouter usageSummary on Table\r\n| extend IngestedGB = round(coalesce(IngestedGB, 0.0), 2)\r\n| extend IsEnabled = iff(IngestedGB > 0, true, false)\r\n| summarize\r\n TotalTables = count(),\r\n EnabledTables = countif(IsEnabled == true),\r\n TotalIngestedGB = round(sum(IngestedGB), 2),\r\n EnabledList = make_list_if(Table, IsEnabled == true),\r\n DisabledList = make_list_if(Table, IsEnabled == false)\r\n by Category\r\n| extend ['Average Daily (GB)'] = round(TotalIngestedGB / Days, 2)\r\n| extend PercentEnabled = iff(TotalTables > 0, round(todouble(EnabledTables) / todouble(TotalTables) * 100, 1), 0.0)\r\n| extend Status = strcat(EnabledTables, \" / \", TotalTables)\r\n| project Category, EnabledTables, TotalTables, Status, PercentEnabled, ['Ingested (GB)'] = TotalIngestedGB, ['Average Daily (GB)'] , EnabledList, DisabledList\r\n| order by Category asc", "size": 1, "title": "Microsoft Security Data Coverage Report", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Importance", "formatter": 8, "formatOptions": { "palette": "blackWhite" } }, { "columnMatch": "PercentEnabled", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "70", "name": "query - 4 - Copy" }, { "type": 1, "content": { "json": "---\r\n## Category Overview\r\n\r\nThe table below summarizes the connector status per cost category. e.g.\r\n\r\n> **E5 Security Benefit allowance:** 100 licenses Γ— 5 MB/user/day = **100 Γ— 5 MB/day** free ingestion\r\n>\r\n> **Defender for Servers P2 allowance:** 50 VMs Γ— 500 MB/VM/day = **50 Γ— 500 MB/day** free ingestion" }, "customWidth": "30", "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\r\n\r\n// Office workloads (single scan of OfficeActivity)\r\n// Table = actual table name (OfficeActivity)\r\n// description = workload label (SharePoint/Exchange/Teams/OneDrive)\r\nlet Office =\r\n OfficeActivity\r\n | where TimeGenerated >= ago(lookback)\r\n | where OfficeWorkload in (\"SharePoint\", \"Exchange\", \"MicrosoftTeams\", \"OneDrive\")\r\n | summarize Count=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) by OfficeWorkload\r\n | extend Table = \"OfficeActivity\"\r\n | extend description = case(\r\n OfficeWorkload == \"MicrosoftTeams\", \"Teams\",\r\n OfficeWorkload\r\n )\r\n | project Table, description, Count, IngestedGB;\r\n\r\nlet OfficeAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"OfficeActivity\", \"SharePoint\",\r\n \"OfficeActivity\", \"Exchange\",\r\n \"OfficeActivity\", \"Teams\",\r\n \"OfficeActivity\", \"OneDrive\"\r\n ]\r\n | join kind=leftouter Office on Table, description\r\n | extend Count = coalesce(Count, 0)\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend isEnabled = iff(Count > 0, \"True\", \"False\")\r\n | project Table, description, isEnabled, Count, IngestedGB, AvgDailyGB;\r\n\r\n// AzureActivity (single row)\r\nlet Azure =\r\n AzureActivity\r\n | where TimeGenerated >= ago(lookback)\r\n | summarize Count=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Table=\"AzureActivity\", description=\"AzureActivity\"\r\n | extend isEnabled=iff(Count>0,\"True\",\"False\")\r\n | project Table, description, isEnabled, Count, IngestedGB, AvgDailyGB;\r\n\r\n// Defender alerts (single scan of SecurityAlert)\r\n// Table = actual table name (SecurityAlert)\r\n// description = alert family label\r\nlet Alerts =\r\n SecurityAlert\r\n | where TimeGenerated >= ago(lookback)\r\n | extend Table = \"SecurityAlert\"\r\n | extend description = case(\r\n ProviderName has \"Azure Security Center\", \"Defender for Cloud Alerts\",\r\n ProviderName has \"MCAS\", \"Defender for Cloud Apps Alerts\",\r\n ProviderName has \"MDATP\", \"Defender for Endpoint Alerts\",\r\n ProviderName has \"OATP\", \"Defender for Office Alerts\",\r\n ProviderName has \"Azure Advanced Threat Protection\", \"Defender for Identity Alerts\",\r\n \"\"\r\n )\r\n | where description != \"\"\r\n | summarize Count=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) by Table, description\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend isEnabled=iff(Count>0,\"True\",\"False\")\r\n | project Table, description, isEnabled, Count, IngestedGB, AvgDailyGB;\r\n\r\nlet AlertsAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"SecurityAlert\", \"Defender for Cloud Alerts\",\r\n \"SecurityAlert\", \"Defender for Cloud Apps Alerts\",\r\n \"SecurityAlert\", \"Defender for Endpoint Alerts\",\r\n \"SecurityAlert\", \"Defender for Office Alerts\",\r\n \"SecurityAlert\", \"Defender for Identity Alerts\"\r\n ]\r\n | join kind=leftouter Alerts on Table, description\r\n | extend Count = coalesce(Count, 0)\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend isEnabled = iff(Count > 0, \"True\", \"False\")\r\n | project Table, description, isEnabled, Count, IngestedGB, AvgDailyGB;\r\n\r\nOfficeAll\r\n| union Azure, AlertsAll\r\n| order by Table asc, description asc\r\n| project Table, description, isEnabled, ['Ingested GB'] = IngestedGB, ['Average Daily (GB)'] = AvgDailyGB", "size": 0, "title": "Free Tier Connector Status, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 1" }, { "type": 1, "content": { "json": "These are free data sources and therefore always onboarded\r\n\r\n### Data sources for these tables\r\n\r\n| Table / Output Label | Underlying Table | Notes / Mapping Logic | Benefits / Why Enabled |\r\n|---|---|---|---|\r\n| SharePoint | OfficeActivity | `OfficeWorkload == \"SharePoint\"` | Provides visibility into SharePoint file access, sharing, downloads, and deletions to help detect suspicious behaviour and potential data exfiltration. |\r\n| Exchange | OfficeActivity | `OfficeWorkload == \"Exchange\"` | Enables monitoring of mailbox activity including rule creation, forwarding, and administrative actions commonly associated with account compromise. |\r\n| Teams | OfficeActivity | `OfficeWorkload == \"MicrosoftTeams\"` | Tracks collaboration activity such as file sharing and messaging actions to support investigation of insider threats or data leakage. |\r\n| OneDrive | OfficeActivity | `OfficeWorkload == \"OneDrive\"` | Provides insight into personal file storage activity including uploads, downloads, and external sharing to detect abnormal data movement. |\r\n| AzureActivity | AzureActivity | N/A | Captures Azure control-plane activity including resource creation, configuration changes, and administrative operations for security monitoring and auditing. |\r\n| Defender for Cloud Alerts | SecurityAlert | `ProviderName has \"Azure Security Center\"` | Surfaces security posture and threat alerts related to Azure resources, vulnerabilities, and suspicious cloud activity. |\r\n| Defender for Cloud Apps Alerts | SecurityAlert | `ProviderName has \"MCAS\"` | Provides alerts related to risky cloud app behaviour, anomalous user activity, and potential data exfiltration. |\r\n| Defender for Endpoint Alerts | SecurityAlert | `ProviderName has \"MDATP\"` | Delivers endpoint threat detections including malware, suspicious processes, and attacker techniques observed on devices. |\r\n| Defender for Office Alerts | SecurityAlert | `ProviderName has \"OATP\"` | Provides detections for phishing, malicious attachments, and email-based threats targeting Microsoft 365 users. |\r\n| Defender for Identity Alerts | SecurityAlert | `ProviderName has \"Azure Advanced Threat Protection\"` | Detects identity-based attacks such as credential theft, lateral movement, and privilege escalation in hybrid environments. |" }, "customWidth": "50", "name": "text - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\r\n\r\n// Workbook parameters (defaults if empty) - TEXT parameters\r\nlet EntraAAD_P = iff(isempty(trim(\" \", \"{EntraAAD}\")), 1, toint(\"{EntraAAD}\"));\r\nlet Infra_P = iff(isempty(trim(\" \", \"{Infra}\")), 2, toint(\"{Infra}\"));\r\nlet CSL_P = iff(isempty(trim(\" \", \"{CSL}\")), 2, toint(\"{CSL}\"));\r\nlet MDE_P = iff(isempty(trim(\" \", \"{MDE}\")), 3, toint(\"{MDE}\"));\r\nlet MDO_P = iff(isempty(trim(\" \", \"{MDO}\")), 3, toint(\"{MDO}\"));\r\nlet MDI_P = iff(isempty(trim(\" \", \"{MDI}\")), 3, toint(\"{MDI}\"));\r\nlet Other_P = iff(isempty(trim(\" \", \"{Other}\")), 4, toint(\"{Other}\"));\r\n\r\n// Section importance controls (defaults + overrides)\r\nlet SectionWeights =\r\n union\r\n (print Section=\"Entra/AAD\", Importance=EntraAAD_P),\r\n (print Section=\"Infra\", Importance=Infra_P),\r\n (print Section=\"CSL\", Importance=CSL_P),\r\n (print Section=\"MDE\", Importance=MDE_P),\r\n (print Section=\"MDO\", Importance=MDO_P),\r\n (print Section=\"MDI\", Importance=MDI_P),\r\n (print Section=\"Other\", Importance=Other_P);\r\n\r\n// Sentinel connector / solution mapping (from GitHub CSV)\r\nlet SentinelConnectorMapRaw =\r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n\r\n// Keep a single best row per Table\r\nlet SentinelConnectorMap =\r\n SentinelConnectorMapRaw\r\n | where isnotempty(Table)\r\n | summarize arg_max(\r\n is_unique,\r\n solution_last_publish_date,\r\n solution_Name,\r\n connector_title,\r\n connector_publisher,\r\n solution_publisher_id\r\n ) by Table\r\n | extend Publisher = tostring(coalesce(connector_publisher, solution_publisher_id))\r\n | project\r\n Table,\r\n SentinelConnector = tostring(connector_title),\r\n SolutionName = tostring(solution_Name),\r\n Publisher,\r\n solution_publisher_id = tostring(solution_publisher_id),\r\n ConnectorType = iff(tolower(Publisher) has \"microsoft\", \"Microsoft\", \"Third-Party\");\r\n\r\n// E5 / benefit mapping\r\nlet E5Map = datatable(Table:string, E5:string)\r\n[\r\n // Entra / AAD\r\n \"AADManagedIdentitySignInLogs\", \"Yes\",\r\n \"AADNonInteractiveUserSignInLogs\", \"Yes\",\r\n \"AADProvisioningLogs\", \"Yes\",\r\n \"AADRiskyUsers\", \"Yes\",\r\n \"AADServicePrincipalRiskEvents\", \"Yes\",\r\n \"AADServicePrincipalSignInLogs\", \"Yes\",\r\n \"AADUserRiskEvents\", \"Yes\",\r\n \"ADFSSignInLogs\", \"Yes\",\r\n \"AuditLogs\", \"Yes\",\r\n \"SigninLogs\", \"Yes\",\r\n\r\n // MDE\r\n \"DeviceEvents\", \"Yes\",\r\n \"DeviceFileCertificateInfo\", \"Yes\",\r\n \"DeviceFileEvents\", \"Yes\",\r\n \"DeviceImageLoadEvents\", \"Yes\",\r\n \"DeviceInfo\", \"Yes\",\r\n \"DeviceLogonEvents\", \"Yes\",\r\n \"DeviceNetworkEvents\", \"Yes\",\r\n \"DeviceNetworkInfo\", \"Yes\",\r\n \"DeviceProcessEvents\", \"Yes\",\r\n \"DeviceRegistryEvents\", \"Yes\",\r\n\r\n // MDI\r\n \"IdentityDirectoryEvents\", \"Yes\",\r\n \"IdentityLogonEvents\", \"Yes\",\r\n \"IdentityQueryEvents\", \"Yes\",\r\n\r\n // MDO\r\n \"EmailAttachmentInfo\", \"Yes\",\r\n \"EmailEvents\", \"Yes\",\r\n \"EmailPostDeliveryEvents\", \"Yes\",\r\n \"EmailUrlInfo\", \"Yes\",\r\n\r\n // MDCA\r\n \"CloudAppEvents\", \"Yes\",\r\n\r\n // Alerts / incidents if added later\r\n \"AlertInfo\", \"Yes\",\r\n \"AlertEvidence\", \"Yes\",\r\n \"SecurityAlert\", \"Partial\",\r\n \"SecurityIncident\", \"Partial\",\r\n\r\n // Other commonly referenced tables\r\n \"AzureActivity\", \"Yes\",\r\n \"OfficeActivity\", \"Yes\",\r\n \"CommonSecurityLog\", \"No\",\r\n \"SecurityEvent\", \"No\",\r\n \"Syslog\", \"No\",\r\n \"WindowsEvent\", \"No\",\r\n \"ThreatIntelligenceIndicator\", \"No\"\r\n];\r\n\r\n// ---------- Entra / AAD logs ----------\r\nlet AADEnabled =\r\n union\r\n (SigninLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"SigninLogs\", description=\"SigninLogs\"),\r\n (AuditLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AuditLogs\", description=\"AuditLogs\"),\r\n (AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADNonInteractiveUserSignInLogs\", description=\"AAD Non-Interactive Sign-ins\"),\r\n (AADServicePrincipalSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADServicePrincipalSignInLogs\", description=\"Service Principal Sign-ins\"),\r\n (AADServicePrincipalRiskEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADServicePrincipalRiskEvents\", description=\"Service Principal Risk Events\"),\r\n (AADProvisioningLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADProvisioningLogs\", description=\"Provisioning logs\"),\r\n (AADManagedIdentitySignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADManagedIdentitySignInLogs\", description=\"Managed Identity logs\"),\r\n (ADFSSignInLogs | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"ADFSSignInLogs\", description=\"ADFS Sign-ins\"),\r\n (AADUserRiskEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADUserRiskEvents\", description=\"User Risk Events\"),\r\n (AADRiskyUsers | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"AADRiskyUsers\", description=\"Risky Users\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet AADAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"SigninLogs\", \"SigninLogs\",\r\n \"AuditLogs\", \"AuditLogs\",\r\n \"AADNonInteractiveUserSignInLogs\", \"AAD Non-Interactive Sign-ins\",\r\n \"AADServicePrincipalSignInLogs\", \"Service Principal Sign-ins\",\r\n \"AADServicePrincipalRiskEvents\", \"Service Principal Risk Events\",\r\n \"AADProvisioningLogs\", \"Provisioning logs\",\r\n \"AADManagedIdentitySignInLogs\", \"Managed Identity logs\",\r\n \"ADFSSignInLogs\", \"ADFS Sign-ins\",\r\n \"AADUserRiskEvents\", \"User Risk Events\",\r\n \"AADRiskyUsers\", \"Risky Users\"\r\n ]\r\n | join kind=leftouter AADEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"Entra/AAD\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- Windows / Syslog tables ----------\r\nlet InfraEnabled =\r\n union\r\n (SecurityEvent | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"SecurityEvent\", description=\"Windows Security Events\"),\r\n (WindowsEvent | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"WindowsEvent\", description=\"Windows Events\"),\r\n (Syslog | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"Syslog\", description=\"Syslog\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet InfraAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"SecurityEvent\", \"Windows Security Events\",\r\n \"WindowsEvent\", \"Windows Events\",\r\n \"Syslog\", \"Syslog\"\r\n ]\r\n | join kind=leftouter InfraEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"Infra\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- CommonSecurityLog vendors ----------\r\nlet CSLVendorsEnabled =\r\n CommonSecurityLog\r\n | where TimeGenerated >= ago(lookback)\r\n | extend description = case(\r\n DeviceVendor has \"Cisco\", \"Cisco\",\r\n DeviceVendor has \"Check Point\", \"Check Point\",\r\n DeviceVendor has \"Palo Alto\", \"Palo Alto\",\r\n DeviceVendor has \"F5\", \"F5\",\r\n DeviceVendor has \"Fortinet\", \"Fortinet\",\r\n DeviceVendor has \"Barracuda\", \"Barracuda\",\r\n DeviceVendor has \"ExtraHop\", \"ExtraHop\",\r\n DeviceVendor has \"OneIdentity\", \"OneIdentity\",\r\n DeviceVendor has \"Zscaler\", \"Zscaler\",\r\n DeviceVendor has \"ForgeRock\", \"ForgeRock\",\r\n DeviceVendor has \"CyberArk\", \"CyberArk\",\r\n DeviceVendor has \"Illusive\", \"Illusive\",\r\n DeviceVendor has \"Vectra Networks\", \"Vectra Networks\",\r\n DeviceVendor has \"Citrix\", \"Citrix\",\r\n \"\"\r\n )\r\n | where description != \"\"\r\n | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) by Table=\"CommonSecurityLog\", description;\r\n\r\nlet CSLAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"CommonSecurityLog\", \"Cisco\",\r\n \"CommonSecurityLog\", \"Check Point\",\r\n \"CommonSecurityLog\", \"Palo Alto\",\r\n \"CommonSecurityLog\", \"F5\",\r\n \"CommonSecurityLog\", \"Fortinet\",\r\n \"CommonSecurityLog\", \"Barracuda\",\r\n \"CommonSecurityLog\", \"ExtraHop\",\r\n \"CommonSecurityLog\", \"OneIdentity\",\r\n \"CommonSecurityLog\", \"Zscaler\",\r\n \"CommonSecurityLog\", \"ForgeRock\",\r\n \"CommonSecurityLog\", \"CyberArk\",\r\n \"CommonSecurityLog\", \"Illusive\",\r\n \"CommonSecurityLog\", \"Vectra Networks\",\r\n \"CommonSecurityLog\", \"Citrix\"\r\n ]\r\n | join kind=leftouter CSLVendorsEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"CSL\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- MDE tables ----------\r\nlet MDEEnabled =\r\n union\r\n (DeviceInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceInfo\", description=\"MDE Device Info\"),\r\n (DeviceNetworkInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceNetworkInfo\", description=\"MDE Device Network Info\"),\r\n (DeviceProcessEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceProcessEvents\", description=\"MDE Device Process Events\"),\r\n (DeviceNetworkEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceNetworkEvents\", description=\"MDE Device Network Events\"),\r\n (DeviceFileEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceFileEvents\", description=\"MDE Device File Events\"),\r\n (DeviceRegistryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceRegistryEvents\", description=\"MDE Device Registry Events\"),\r\n (DeviceLogonEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceLogonEvents\", description=\"MDE Device Logon Events\"),\r\n (DeviceImageLoadEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceImageLoadEvents\", description=\"MDE Device Image Load Events\"),\r\n (DeviceEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceEvents\", description=\"MDE Device Events\"),\r\n (DeviceFileCertificateInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"DeviceFileCertificateInfo\", description=\"MDE Device File Certificate Info\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet MDEAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"DeviceInfo\", \"MDE Device Info\",\r\n \"DeviceNetworkInfo\", \"MDE Device Network Info\",\r\n \"DeviceProcessEvents\", \"MDE Device Process Events\",\r\n \"DeviceNetworkEvents\", \"MDE Device Network Events\",\r\n \"DeviceFileEvents\", \"MDE Device File Events\",\r\n \"DeviceRegistryEvents\", \"MDE Device Registry Events\",\r\n \"DeviceLogonEvents\", \"MDE Device Logon Events\",\r\n \"DeviceImageLoadEvents\", \"MDE Device Image Load Events\",\r\n \"DeviceEvents\", \"MDE Device Events\",\r\n \"DeviceFileCertificateInfo\", \"MDE Device File Certificate Info\"\r\n ]\r\n | join kind=leftouter MDEEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"MDE\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- MDO tables ----------\r\nlet MDOEnabled =\r\n union\r\n (EmailEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"EmailEvents\", description=\"MDO Email Events\"),\r\n (EmailUrlInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"EmailUrlInfo\", description=\"MDO Email URL Info\"),\r\n (EmailAttachmentInfo | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"EmailAttachmentInfo\", description=\"MDO Email Attachment Info\"),\r\n (EmailPostDeliveryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"EmailPostDeliveryEvents\", description=\"MDO Email Post-Delivery Events\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet MDOAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"EmailEvents\", \"MDO Email Events\",\r\n \"EmailUrlInfo\", \"MDO Email URL Info\",\r\n \"EmailAttachmentInfo\", \"MDO Email Attachment Info\",\r\n \"EmailPostDeliveryEvents\", \"MDO Email Post-Delivery Events\"\r\n ]\r\n | join kind=leftouter MDOEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"MDO\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- MDI (own section) ----------\r\nlet MDIEnabled =\r\n union\r\n (IdentityLogonEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"IdentityLogonEvents\", description=\"MDI Logon Events\"),\r\n (IdentityQueryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"IdentityQueryEvents\", description=\"MDI Query Events\"),\r\n (IdentityDirectoryEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"IdentityDirectoryEvents\", description=\"MDI Directory Events\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet MDIAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"IdentityLogonEvents\", \"MDI Logon Events\",\r\n \"IdentityQueryEvents\", \"MDI Query Events\",\r\n \"IdentityDirectoryEvents\", \"MDI Directory Events\"\r\n ]\r\n | join kind=leftouter MDIEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"MDI\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- Other (MDCA / TI) ----------\r\nlet OtherEnabled =\r\n union\r\n (CloudAppEvents | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"CloudAppEvents\", description=\"MDCA Cloud App Events\"),\r\n (ThreatIntelligenceIndicator | where TimeGenerated >= ago(lookback) | summarize c=count(), IngestedGB=round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2) | extend Table=\"ThreatIntelligenceIndicator\", description=\"ThreatIntelligenceIndicator\")\r\n | project Table, description, c, IngestedGB;\r\n\r\nlet OtherAll =\r\n datatable(Table:string, description:string)\r\n [\r\n \"CloudAppEvents\", \"MDCA Cloud App Events\",\r\n \"ThreatIntelligenceIndicator\", \"ThreatIntelligenceIndicator\"\r\n ]\r\n | join kind=leftouter OtherEnabled on Table, description\r\n | extend isEnabled = iff(coalesce(c,0) > 0, \"True\", \"False\")\r\n | extend IngestedGB = coalesce(IngestedGB, 0.0)\r\n | extend AvgDailyGB = round(IngestedGB / 30.0, 2)\r\n | extend Section = \"Other\"\r\n | project Section, Table, description, isEnabled, IngestedGB, AvgDailyGB;\r\n\r\n// ---------- Final ----------\r\nAADAll\r\n| union InfraAll, CSLAll, MDEAll, MDOAll, MDIAll, OtherAll\r\n| join kind=leftouter SectionWeights on Section\r\n| join kind=leftouter SentinelConnectorMap on Table\r\n| join kind=leftouter E5Map on Table\r\n| extend\r\n SentinelConnector = coalesce(SentinelConnector, \"\"),\r\n SolutionName = coalesce(SolutionName, \"\"),\r\n Publisher = coalesce(Publisher, \"\"),\r\n solution_publisher_id = coalesce(solution_publisher_id, \"\"),\r\n ConnectorType = coalesce(ConnectorType, \"\"),\r\n E5 = coalesce(E5, \"No\")\r\n| project\r\n Importance,\r\n Section,\r\n Table,\r\n description,\r\n ['Included in E5 benefit']=E5,\r\n isEnabled,\r\n ['Ingested GB'] = IngestedGB,\r\n ['Average Daily (GB)'] = AvgDailyGB,\r\n SentinelConnector,\r\n SolutionName,\r\n Publisher,\r\n solution_publisher_id\r\n| order by Importance asc, Section asc, Table asc, description asc", "size": 0, "title": "Commonly Used Paid Tier Connector Status {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Importance", "formatter": 8, "formatOptions": { "palette": "blackWhite" } }, { "columnMatch": "Included in E5 benefit", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "text": "{0}{1}" }, { "operator": "!=", "thresholdValue": "Yes", "representation": "Blank", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "isEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "solution_publisher_id", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkIsContextBlade": false } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_Included in E5 benefit_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_Included in E5 benefit_4", "sortOrder": 2 } ] }, "customWidth": "75", "name": "query - 1 - Copy" }, { "type": 1, "content": { "json": "These data sources and Connectors are billable, but add value and security coverage. We have suggested the Importance of the source - but you will have to evaluate.\r\n\r\n| Priority | Code | Name | Tables (Alphabetical) |\r\n|----------|-----------|-----------------------------------------------------------|------------------------|\r\n| 1 | Entra/AAD | Microsoft Entra ID (Azure Active Directory) logs | ADFSSignInLogs, AgentRiskEvents, AuditLogs, AzureADGraphActivityLogs, EnrichedOffice365AuditLogs, GraphNotificationsActivityLogs, ManagedIdentitySignInLogs, MicrosoftGraphActivityLogs, MicrosoftServicePrincipalSignInLogs, NetworkAccessAlerts, NetworkAccessConnectionEvents, NetworkAccessGenerativeAIInsights, NetworkAccessTrafficLogs, NonInteractiveUserSignInLogs, ProvisioningLogs, RemoteNetworkHealthLogs, RiskyAgents, RiskyServicePrincipals, RiskyUsers, ServicePrincipalRiskEvents, ServicePrincipalSignInLogs, SignInLogs, UserRiskEvents |\r\n| 2 | Infra | Infrastructure logs (Windows Events and Syslog) | SecurityEvent, Syslog, WindowsEvent |\r\n| 2 | CSL | CommonSecurityLog (CEF/Syslog security device logs) | CommonSecurityLog |\r\n| 3 | MDE | Microsoft Defender for Endpoint | DeviceEvents, DeviceFileCertificateInfo, DeviceFileEvents, DeviceImageLoadEvents, DeviceInfo, DeviceLogonEvents, DeviceNetworkEvents, DeviceNetworkInfo, DeviceProcessEvents, DeviceRegistryEvents |\r\n| 3 | MDO | Microsoft Defender for Office 365 | EmailAttachmentInfo, EmailEvents, EmailPostDeliveryEvents, EmailUrlInfo |\r\n| 3 | MDI | Microsoft Defender for Identity | IdentityDirectoryEvents, IdentityLogonEvents, IdentityQueryEvents |\r\n| 4 | Other | Other sources (MDCA, Threat Intelligence, etc.) | CloudAppEvents, ThreatIntelligenceIndicator |" }, "customWidth": "25", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-07-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"TableName\",\"columnType\":\"string\"},{\"path\":\"$..properties.schema.tableType\",\"columnid\":\"TableType\",\"columnType\":\"string\"},{\"path\":\"$..properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"$..properties.retentionInDays\",\"columnid\":\"InteractiveRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"$..properties.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"properties.plan\",\"columnid\":\"TablePlan\",\"substringRegexMatch\":\"Auxiliary\",\"substringReplace\":\"Auxiliary / data lake\"}]}}]}", "size": 1, "title": "Table overview, use to lookup a Table if required, count: {$rowCount}", "noDataMessage": "Currently no Basic Logs being configured", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "TableType", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Microsoft", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "CustomLog", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ], "customColumnWidthSetting": "14ch" } }, { "columnMatch": "TotalRetentionInDays", "formatter": 8, "formatOptions": { "min": 0, "palette": "turquoise", "customColumnWidthSetting": "24ch" } }, { "columnMatch": "InteractiveRetentionInDays", "formatter": 8, "formatOptions": { "min": -180, "max": 730, "palette": "purpleBlue", "customColumnWidthSetting": "28ch" } }, { "columnMatch": "ArchiveRetentionInDays", "formatter": 8, "formatOptions": { "min": 0, "max": 700, "palette": "purpleDark", "customColumnWidthSetting": "26ch" } } ], "rowLimit": 1000, "filter": true } }, "customWidth": "50", "name": "query-BasicLogsTable" }, { "type": 1, "content": { "json": "## Reference & Documentation\n\n| Topic | Link |\n|---|---|\n| Free data sources in Sentinel | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#free-data-sources) |\n| E5 Security benefit for Sentinel | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#microsoft-365-e5-a5-f5-and-g5-customers) |\n| E5 eligible tables list | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration#tables-eligible-for-the-microsoft-365-e5-benefit) |\n| Defender for Servers P2 benefit (500 MB/VM/day) | [Microsoft Learn](https://learn.microsoft.com/azure/defender-for-cloud/faq-defender-for-servers#is-the-500-mb-of-free-data-ingestion-allowance-applied-to-an-entire-workspace-or-strictly-per-machine-) |\n| Sentinel pricing | [Azure Pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) |\n| Plan costs and billing | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers) |\n| Auxiliary Logs plan (data lake) | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/basic-logs-configure) |\n| Connect Defender XDR to Sentinel | [Microsoft Learn](https://learn.microsoft.com/azure/sentinel/connect-microsoft-365-defender) |\n| Ingestion-time transformations | [Microsoft Learn](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations) |" }, "customWidth": "50", "name": "reference-docs" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "onboarding" }, "name": "group - onboarding" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7c1f108f-d8ec-4cb8-a33f-12c942a444fe", "version": "KqlParameterItem/1.0", "name": "SelectPct", "label": "Anomaly spikes %", "type": 10, "description": "anomaly spikes greater than this %", "isRequired": true, "query": "range value from 10 to 100 step 10\r\n| project value, display=value, selected=value", "crossComponentResources": [ "{Workspace}" ], "value": "70", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "parameters - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//source: https://techcommunity.microsoft.com/t5/azure-sentinel/ingestion-cost-spike-detection-playbook/ba-p/2591301\r\nlet UpperAnomalyThreshold = +3;\r\nlet ReportingQty = 0;\r\nlet PercentIncrease = {SelectPct};\r\nlet UpperThreshold = UpperAnomalyThreshold; //+3 is the suggested number and it indicates a strong anomaly though you can modify it : Outlier - Wikipedia\r\nUsage\r\n| where IsBillable == \"true\" //we are only interested in tables getting notified when a spike is detected in a billable table \r\n| where Quantity > ReportingQty //Allows you to report only on variations that are above a certain threshold that you deem significant enough to warrant an alert\r\n| make-series Qty=sum(Quantity) on TimeGenerated from {TimeRange:start} to now() step 1d by DataType //creates a time series to look at the ingestion pattern over the period defined in the LookBack variable\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Qty, 1.5, 7, 'linefit', 1, 'ctukey', 0.01) //takes the time series of ingested data across the days specified in the β€˜LookBack’ variable and extract anomalous points with scores based on predicted values using the linear regression concept. See https://docs.microsoft.com/azure/data-explorer/kusto/query/series-decompose-anomaliesfunction for a detailed explanation of each argument. For an explanation of 'ctukey' read: Outlier - Wikipedia.\r\n| where anomalies[-1] == 1 or anomalies[-1] == -1 //the output of series_decompose_anomalies function is three things: A ternary (as opposed to binary) series containing (+1, -1, 0) marking up/down/no anomaly respectively, the Anomaly score and the predicted value or baseline. \r\n| extend Score = score[-1] //this part picks up the anomaly state from the most recent run. -1 indicates a position in the array. \r\n| where Score >= UpperAnomalyThreshold //compare with strong anomaly indicator values extracted from the time series data\r\n| extend PercentageQtyIncrease = ((round(todouble(Qty[-1]),0)-round(todouble(baseline[-1]),1))/round(todouble(Qty[-1]),0) * 100) //calculates percentage increase to present data in percent terms for easier appreciation of the anomaly\r\n| project DataType,ExpectedQty=round(todouble(baseline[-1]),0), ActualQty=round(todouble(Qty[-1]),0),round(PercentageQtyIncrease,0) \r\n| order by round(todouble(PercentageQtyIncrease),0) desc \r\n| where PercentageQtyIncrease >= PercentIncrease //only alert if the percentage increase exceeds the threshold beyond which you specified that you wish to be notified", "size": 4, "title": "Ingestion Spikes - anomaly detection > {SelectPct}% increase", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "PercentageQtyIncrease", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ] } }, "customWidth": "70", "name": "query - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| make-series count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DataType\r\n| extend lastDay = toreal(trim(@\"[^\\w]+\",tostring(array_slice(count_,-1,-1)))), lastWeek = array_slice(count_,array_length(count_) -7,-1)\r\n| order by DataType asc", "size": 1, "title": "Data Ingestion trend: {TimeRange:label} for {$rowCount} Tables", "timeContext": { "durationMs": 2592000000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 10, "formatOptions": { "palette": "red" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumFractionDigits": 3 } } }, { "columnMatch": "TimeGenerated", "formatter": 5 }, { "columnMatch": "lastDay", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "4", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "10", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "lastWeek", "formatter": 10, "formatOptions": { "palette": "blueDark" } }, { "columnMatch": "BilledSize", "formatter": 21, "formatOptions": { "palette": "green" }, "numberFormat": { "unit": 4, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 3 } } } ], "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Count per hour", "comment": "Data received by Hour" } ] }, "sortBy": [] }, "name": "query - 15" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "anomaly" }, "name": "group - anomaly" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nAzureActivity\r\n| where ResourceProvider == \"Microsoft.SecurityInsights\"\r\n| summarize Requests=count() by bin(TimeGenerated, 1h)\r\n| render timechart", "size": 0, "title": "Sentinel ActivityLog Information by time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity \r\n| where ResourceProvider =~ \"Microsoft.SecurityInsights\" \r\n//| where OperationName !in (\"Microsoft.SecurityInsights/Incidents/investigations/write\", \"Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action\" )\r\n| summarize count() by OperationName\r\n| top 10 by count_ desc \r\n", "size": 1, "title": "Sentinel ActivityLog Information - Top 10", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "OperationName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "query - 22" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity \r\n| where ResourceProvider == \"Microsoft.SecurityInsights\" \r\n//| where OperationName !in (\"Microsoft.SecurityInsights/Incidents/investigations/write\", \"Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action\" )\r\n| summarize count() by OperationName, TimeGenerated\r\n| top 10 by count_ desc \r\n| make-series count() on bin(TimeGenerated,1d) from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by OperationName\r\n", "size": 1, "title": "Sentinel ActivityLog Information - Top n trending, {TimeRange:label} ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 9, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "TimeGenerated", "formatter": 5 } ], "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Daily Count", "comment": "Trend for selected period" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "OperationName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "query - 22 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet base =\r\n AzureActivity\r\n | where ResourceProvider == \"Microsoft.SecurityInsights\"\r\n | extend Status = tostring(ActivityStatusValue)\r\n | extend IsSuccess = iff(Status has_any (\"Succeeded\",\"Success\"), 1, 0);\r\nbase\r\n| summarize Total=count(), Succeeded=sum(IsSuccess)\r\n| extend SuccessRate = todouble(Succeeded) / todouble(Total) * 100.0\r\n| project Total, Succeeded, SuccessRate", "size": 1, "title": "Sentinel ActivityLog Information - Success Rate", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SuccessRate", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "OperationName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "query - 22 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where ResourceProvider == \"Microsoft.SecurityInsights\"\r\n| where tostring(ActivityStatusValue) has \"Failed\"\r\n| summarize Failures=count() by OperationNameValue\r\n| top 20 by Failures desc", "size": 1, "title": "Top failed Operation", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Failures", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "SuccessRate", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "OperationName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "query - 22 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where ResourceProvider == \"Microsoft.SecurityInsights\"\r\n| summarize Requests=count() by Caller\r\n| top 20 by Requests desc", "size": 1, "title": "Top Callers", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Failures", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "SuccessRate", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "OperationName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "query - 22 - Copy - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "activity" }, "name": "group -activity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlistAlias\r\n| order by WatchlistAlias asc", "size": 0, "title": "Watchlists, click for details. Count: {$rowCount}", "timeContextFromParameter": "TimeRange", "exportFieldName": "WatchlistAlias", "exportParameterName": "exportWatchlistAlias", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "sortBy": [ { "itemKey": "WatchlistAlias", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "WatchlistAlias", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n\r\n// Thresholds\r\nlet stale_days = 30;\r\nlet aging_days = 14;\r\n\r\n// Pull the watchlist\r\nlet WL = _GetWatchlist('{exportWatchlistAlias}');\r\n\r\n// Watchlist stats\r\nWL\r\n| summarize\r\n NumberOfLines = count(),\r\n FirstItemAdded = min(LastUpdatedTimeUTC),\r\n LastItemAdded = max(LastUpdatedTimeUTC)\r\n| extend\r\n DaysSinceUpdate = datetime_diff('day', now(), LastItemAdded)\r\n| extend\r\n RecentlyUpdated = iif(DaysSinceUpdate <= 7 and DaysSinceUpdate >= 0, \"Yes\", \"No\"),\r\n HealthStatus = case(\r\n NumberOfLines == 0, \"Empty\",\r\n DaysSinceUpdate > stale_days, \"Stale\",\r\n DaysSinceUpdate > aging_days, \"Aging\",\r\n DaysSinceUpdate < 0, \"FutureDate?\",\r\n \"Healthy\"\r\n )", "size": 4, "title": "Watchlists details for: '{exportWatchlistAlias}'", "timeContextFromParameter": "TimeRange", "exportFieldName": "WatchlistAlias", "exportParameterName": "exportWatchlistAlias", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "sortBy": [] }, "conditionalVisibility": { "parameterName": "exportWatchlistAlias", "comparison": "isNotEqualTo" }, "name": "query - wlist" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "watchlist" }, "name": "group - watchlist" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nThreatIntelIndicators\r\n| where IsDeleted == false\r\n| extend IndicatorType = case(\r\n // IPs (ipv4 + common network-traffic src/dst)\r\n ObservableKey in ('ipv4-addr:value','ipv6-addr:value',\r\n 'network-traffic:src_ref.value','network-traffic:dst_ref.value'), \"IP\",\r\n\r\n // URL\r\n ObservableKey == 'url:value', \"URL\",\r\n\r\n // Email address (new schema uses email-addr:value)\r\n ObservableKey == 'email-addr:value', \"Email\",\r\n\r\n // File hash\r\n ObservableKey has 'file:hashes', \"File\",\r\n\r\n // Domain\r\n ObservableKey == 'domain-name:value', \"Domain\",\r\n\r\n // Catch-all (includes rows where the pattern couldn’t be parsed into key/value)\r\n \"Other\"\r\n)\r\n| summarize CountOfIndicators = count() by IndicatorType, TimeBucket = bin(TimeGenerated, {TimeRange:grain})\r\n| order by CountOfIndicators desc", "size": 1, "title": "Threat Intelligence, Indicator Type {TimeRange:label}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let grain = 1d; // set to 15m, 1d, etc.\r\nThreatIntelligenceIndicator\r\n| extend IndicatorType = case(\r\n isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \"IP\",\r\n isnotempty(Url), \"URL\",\r\n isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \"Email\",\r\n isnotempty(FileHashValue), \"File\",\r\n isnotempty(DomainName) or isnotempty(EmailSourceDomain), \"Domain\",\r\n \"Other\"\r\n)\r\n| summarize CountOfIndicators = count() by IndicatorType, TimeBucket = bin(TimeGenerated, grain)\r\n| order by CountOfIndicators desc", "size": 1, "title": "Threat Intelligence, Threat Type {TimeRange:label}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart" }, "name": "query - 13 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/resourceGroups/{resourceGroup:name}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/threatIntelligence/main/metrics?api-version=2025-09-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[]}}]}", "size": 1, "title": "Threat Intelligence Indicator Metrics", "queryType": 12 }, "name": "query - ti metrics" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/resourceGroups/{resourceGroup:name}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-09-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}", "size": 1, "title": "Threat Intelligence Indicators, count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "rowLimit": 1000, "filter": true } }, "name": "query -Threat Intelligence Indicators" } ] }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "ti" }, "name": "group - TI" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/resourceGroups/{resourceGroup:name}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/sourcecontrols?api-version=2021-10-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.repoType\",\"columnid\":\"repoType\"},{\"path\":\"properties.repository.url\",\"columnid\":\"url\"},{\"path\":\"properties.contentTypes\",\"columnid\":\"contentTypes\"},{\"path\":\"type\",\"columnid\":\"type\"},{\"path\":\"id\",\"columnid\":\"id\"},{\"path\":\"systemData\",\"columnid\":\"systemData\"},{\"path\":\"properties\",\"columnid\":\"properties\"}]}}]}", "size": 0, "title": "Source Control / Repo, count: {$rowCount}", "queryType": 12 }, "conditionalVisibility": { "parameterName": "selectedSentinelTab", "comparison": "isEqualTo", "value": "repo" }, "name": "query - Source Controls" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "group - Sentinel" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Latency", "items": [ { "type": 1, "content": { "json": "### End to End Latency Report by Table" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Latency" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ConnectorMapping =\r\nexternaldata\r\n(\r\n Table:string,\r\n Solution_Name:string,\r\n Solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n connector_id:string,\r\n connector_publisher:string,\r\n connector_title:string,\r\n connector_description:string,\r\n connector_files:string,\r\n is_unique:bool\r\n)\r\n[\r\n@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith(format=\"csv\", ignoreFirstRecord=true)\r\n| summarize\r\n Solutions = strcat_array(make_set(Solution_Name,20), \", \"),\r\n Connectors = strcat_array(make_set(connector_title,20), \", \"),\r\n Publishers = strcat_array(make_set(connector_publisher,20), \", \")\r\nby Table;\r\n\r\nlet TableStats =\r\nunion withsource=TableName1 *\r\n| summarize\r\n RecordCount = count(),\r\n AvgLatencySeconds =\r\n round(avg(todouble(datetime_diff(\"second\", ingestion_time(), TimeGenerated))), 2),\r\n P95LatencySeconds =\r\n round(percentile(todouble(datetime_diff(\"second\", ingestion_time(), TimeGenerated)), 95), 2),\r\n P99LatencySeconds =\r\n round(percentile(todouble(datetime_diff(\"second\", ingestion_time(), TimeGenerated)), 99), 2),\r\n LatestEventTime = max(TimeGenerated)\r\nby TableName = TableName1;\r\n\r\nTableStats\r\n| join kind=leftouter (\r\n ConnectorMapping\r\n | project\r\n TableName = Table,\r\n Solutions,\r\n Connectors,\r\n Publishers\r\n) on TableName\r\n| extend MinutesSinceLastData =\r\n datetime_diff(\"minute\", now(), LatestEventTime)\r\n| extend Health =\r\n case(\r\n MinutesSinceLastData > 1440, \"πŸ”Έ No Recent Data\",\r\n P95LatencySeconds > 3600, \"πŸ”΄ High Latency\",\r\n P95LatencySeconds > 300, \"🟠 Elevated Latency\",\r\n \"🟒 Healthy\"\r\n )\r\n| project\r\n TableName,\r\n RecordCount,\r\n AvgLatencySeconds,\r\n P95LatencySeconds,\r\n P99LatencySeconds,\r\n MinutesSinceLastData,\r\n Health,\r\n Solutions,\r\n Connectors,\r\n Publishers\r\n| order by P95LatencySeconds desc", "size": 0, "title": "Latency reporting by Table, Count: {$rowCount}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RecordCount", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "AvgLatencySeconds", "formatter": 3, "formatOptions": { "palette": "green" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "P95LatencySeconds", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "P99LatencySeconds", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "MinutesSinceLastData", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "average E2E IngestionLatency", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "average E2E IngestionLatency", "color": "blue" }, { "columnName": "minimun E2E IngestionLatency", "color": "green" }, { "columnName": "maximum E2E IngestionLatency", "color": "redBright" } ] } }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "minimun E2E IngestionLatency", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "maximum E2E IngestionLatency", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "TotalGBytes", "formatter": 3, "formatOptions": { "aggregation": "Count" } } ], "filter": true }, "sortBy": [], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "SolutionName", "formatter": 1 }, "leftContent": { "columnMatch": "TotalGBytes", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "SolutionName", "formatter": 1 }, "centerContent": { "columnMatch": "TotalGBytes", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "70", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Latency" }, "name": "query - 8 - Copy" }, { "type": 1, "content": { "json": "## Health Status\r\n\r\nThe Health column is calculated using both data freshness and ingestion latency.\r\n\r\n### Health Logic\r\n\r\n| Status | Criteria |\r\n|----------|----------|\r\n| πŸ”΄ No Recent Data | No events received in the last **1,440 minutes (24 hours)**. |\r\n| πŸ”΄ High Latency | Data is being received, but **P95 ingestion latency exceeds 3,600 seconds (1 hour)**. |\r\n| 🟠 Elevated Latency | Data is being received, but **P95 ingestion latency exceeds 300 seconds (5 minutes)**. |\r\n| 🟒 Healthy | Data has been received within the last 24 hours and **P95 ingestion latency is less than 5 minutes**. |\r\n\r\n### Threshold Rationale\r\n\r\n| Metric | Threshold | Reasoning |\r\n|----------|----------|----------|\r\n| Data Freshness | 24 Hours | Identifies disconnected or non-reporting connectors while avoiding false positives for low-volume data sources. |\r\n| Elevated Latency | 5 Minutes | Most cloud-native and streaming connectors should ingest within a few minutes. Exceeding 5 minutes may indicate ingestion delays or connector performance issues. |\r\n| High Latency | 1 Hour | Sustained delays exceeding 1 hour may impact detection, investigation, and incident response activities. |\r\n| P95 Latency | Used instead of Maximum Latency | Prevents a small number of delayed or backfilled events from skewing the overall health assessment. |\r\n\r\n### Example\r\n\r\n| Table | P95 Latency | Last Data Received | Health |\r\n|----------|----------|----------|----------|\r\n| SigninLogs | 45 seconds | 2 minutes ago | 🟒 Healthy |\r\n| OfficeActivity | 12 minutes | 10 minutes ago | 🟠 Elevated Latency |\r\n| CommonSecurityLog | 95 minutes | 15 minutes ago | πŸ”΄ High Latency |\r\n| AWSCloudTrail | N/A | 2 days ago | πŸ”΄ No Recent Data |\r\n\r\n## Important Considerations\r\n\r\nThe latency values shown in this report are calculated using the difference between an event's `TimeGenerated` timestamp and the time the event was ingested into the workspace (`ingestion_time()`).\r\n\r\n### Not All High Latency Indicates a Problem\r\n\r\nSome data sources naturally produce higher ingestion latency due to the way data is collected, processed, or delivered. Elevated latency should always be assessed in the context of the connector's expected behaviour.\r\n\r\nExamples include:\r\n\r\n| Data Source | Typical Behaviour |\r\n|-------------|-------------------|\r\n| OfficeActivity | Microsoft 365 audit data is delivered via the Management Activity API and can experience delays ranging from minutes to several hours depending on Microsoft processing and workload volume. |\r\n| AWSCloudTrail | Events may be delayed by CloudTrail processing and connector polling intervals. |\r\n| SaaS Connectors | Many API-based connectors operate on scheduled polling intervals rather than real-time streaming. |\r\n| Threat Intelligence Feeds | Indicators are often imported in batches and may not update continuously. |\r\n| Historical Backfills | Newly enabled connectors or connector reconfigurations may ingest historical events, resulting in unusually high latency values. |\r\n| Custom Connectors | Latency is dependent on the implementation, polling frequency, and source system performance. |\r\n\r\n### Understanding P95 Latency\r\n\r\nThis report uses **P95 latency** rather than maximum latency when determining connector health.\r\n\r\nP95 represents the latency experienced by 95% of events and helps reduce the impact of:\r\n\r\n- Historical data imports\r\n- Connector restarts\r\n- Temporary source-side delays\r\n- Backfilled events\r\n- Timestamp anomalies in source systems\r\n\r\nAs a result, a table may show a high maximum latency while still being considered healthy if the vast majority of events are being ingested within expected timeframes.\r\n\r\n### Investigating Potential Issues\r\n\r\nA connector may require investigation when:\r\n\r\n- **No data has been received for more than 24 hours**\r\n- **P95 latency consistently exceeds 5 minutes**\r\n- **P95 latency exceeds 1 hour**\r\n- **Latency increases significantly compared to historical behaviour**\r\n- **Multiple related tables from the same solution exhibit elevated latency simultaneously**\r\n\r\nAlways validate findings against the connector's documented ingestion model and expected update frequency before escalating as a service issue." }, "customWidth": "30", "name": "text - 11" }, { "type": 1, "content": { "json": "## Computers and Latency : {TimeRange}" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Latency" }, "name": "text - 11" }, { "type": 1, "content": { "json": "This view provides a consolidated inventory of devices discovered across Microsoft Defender, Sentinel, and Log Analytics data sources.\r\n\r\nLatency values represent the time since each device was last observed, while the activity trend visualises telemetry volume over the selected time range.\r\n\r\nDevices may appear in multiple sources (Heartbeat, MDE, Security Events, Syslog), helping identify coverage gaps, stale devices, and ingestion issues." }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8af2b724-4a74-4b37-a836-50d18c2276c5", "version": "KqlParameterItem/1.0", "name": "HealthFilter", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n {\r\n \"value\": \"Healthy\",\r\n \"label\": \"Healthy (< 1 Hour)\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"Warning\",\r\n \"label\": \"Warning (1 Hour - 24 Hours)\"\r\n },\r\n {\r\n \"value\": \"Stale\",\r\n \"label\": \"Stale (1 Day - 7 Days)\"\r\n },\r\n {\r\n \"value\": \"Critical\",\r\n \"label\": \"Critical (> 7 Days)\"\r\n }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let NormalizeComputer = (name:string) {\r\n tolower(tostring(split(name, \".\")[0]))\r\n};\r\n\r\nlet HeartbeatData =\r\nHeartbeat\r\n| summarize HeartbeatLastSeen = max(TimeGenerated) by ComputerName = Computer\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet DeviceInfoData =\r\nDeviceInfo\r\n| summarize DeviceInfoLastSeen = max(Timestamp) by ComputerName = DeviceName\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet DeviceEventsData =\r\nDeviceEvents\r\n| summarize DeviceEventsLastSeen = max(Timestamp) by ComputerName = DeviceName\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet DeviceNetworkData =\r\nDeviceNetworkEvents\r\n| summarize DeviceNetworkLastSeen = max(Timestamp) by ComputerName = DeviceName\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet DeviceProcessData =\r\nDeviceProcessEvents\r\n| summarize DeviceProcessLastSeen = max(Timestamp) by ComputerName = DeviceName\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet SecurityEventData =\r\nSecurityEvent\r\n| summarize SecurityEventLastSeen = max(TimeGenerated) by ComputerName = Computer\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet SyslogData =\r\nSyslog\r\n| summarize SyslogLastSeen = max(TimeGenerated) by ComputerName = Computer\r\n| extend ComputerKey = NormalizeComputer(ComputerName);\r\n\r\nlet ActivityTrend =\r\nunion isfuzzy=true\r\n(\r\n Heartbeat\r\n //| where TimeGenerated > ago(30d)\r\n | project ComputerName = Computer, EventTime = TimeGenerated\r\n),\r\n(\r\n DeviceInfo\r\n //| where Timestamp > ago(30d)\r\n | project ComputerName = DeviceName, EventTime = Timestamp\r\n),\r\n(\r\n DeviceEvents\r\n // | where Timestamp > ago(30d)\r\n | project ComputerName = DeviceName, EventTime = Timestamp\r\n),\r\n(\r\n DeviceProcessEvents\r\n // | where Timestamp > ago(30d)\r\n | project ComputerName = DeviceName, EventTime = Timestamp\r\n),\r\n(\r\n DeviceNetworkEvents\r\n // | where Timestamp > ago(30d)\r\n | project ComputerName = DeviceName, EventTime = Timestamp\r\n),\r\n(\r\n SecurityEvent\r\n // | where TimeGenerated > ago(30d)\r\n | project ComputerName = Computer, EventTime = TimeGenerated\r\n),\r\n(\r\n Syslog\r\n // | where TimeGenerated > ago(30d)\r\n | project ComputerName = Computer, EventTime = TimeGenerated\r\n)\r\n| where isnotempty(ComputerName)\r\n| extend ComputerKey = NormalizeComputer(ComputerName)\r\n| summarize EventCount = count()\r\n by ComputerKey, Day = bin(EventTime, 1d)\r\n| order by ComputerKey asc, Day asc\r\n| summarize ActivityTrend = make_list(tolong(EventCount))\r\n by ComputerKey;\r\n\r\nunion isfuzzy=true\r\n HeartbeatData,\r\n DeviceInfoData,\r\n DeviceEventsData,\r\n DeviceNetworkData,\r\n DeviceProcessData,\r\n SecurityEventData,\r\n SyslogData\r\n| summarize\r\n ComputerName = any(ComputerName),\r\n HeartbeatLastSeen = max(HeartbeatLastSeen),\r\n DeviceInfoLastSeen = max(DeviceInfoLastSeen),\r\n DeviceEventsLastSeen = max(DeviceEventsLastSeen),\r\n DeviceNetworkLastSeen = max(DeviceNetworkLastSeen),\r\n DeviceProcessLastSeen = max(DeviceProcessLastSeen),\r\n SecurityEventLastSeen = max(SecurityEventLastSeen),\r\n SyslogLastSeen = max(SyslogLastSeen)\r\n by ComputerKey\r\n| extend LastSeen =\r\n coalesce(\r\n HeartbeatLastSeen,\r\n DeviceInfoLastSeen,\r\n DeviceEventsLastSeen,\r\n DeviceNetworkLastSeen,\r\n DeviceProcessLastSeen,\r\n SecurityEventLastSeen,\r\n SyslogLastSeen\r\n )\r\n| extend\r\n Heartbeat = iff(isnotempty(HeartbeatLastSeen), \"Yes\", \"No\"),\r\n MDE = iff(\r\n isnotempty(DeviceInfoLastSeen)\r\n or isnotempty(DeviceEventsLastSeen)\r\n or isnotempty(DeviceNetworkLastSeen)\r\n or isnotempty(DeviceProcessLastSeen),\r\n \"Yes\",\r\n \"No\"\r\n ),\r\n SecurityLogs = iff(isnotempty(SecurityEventLastSeen), \"Yes\", \"No\"),\r\n SyslogPresent = iff(isnotempty(SyslogLastSeen), \"Yes\", \"No\")\r\n| extend\r\n OverallLatency = todouble((now() - LastSeen) / 1s),\r\n HeartbeatLatency = iff(\r\n isnotempty(HeartbeatLastSeen),\r\n todouble((now() - HeartbeatLastSeen) / 1s),\r\n real(null)\r\n ),\r\n DeviceInfoLatency = iff(\r\n isnotempty(DeviceInfoLastSeen),\r\n todouble((now() - DeviceInfoLastSeen) / 1s),\r\n real(null)\r\n ),\r\n SecurityEventLatency = iff(\r\n isnotempty(SecurityEventLastSeen),\r\n todouble((now() - SecurityEventLastSeen) / 1s),\r\n real(null)\r\n ),\r\n SyslogLatency = iff(\r\n isnotempty(SyslogLastSeen),\r\n todouble((now() - SyslogLastSeen) / 1s),\r\n real(null)\r\n )\r\n| extend Health =\r\n case(\r\n OverallLatency <= 3600.0, \"Healthy\",\r\n OverallLatency <= 86400.0, \"Warning\",\r\n OverallLatency <= 604800.0, \"Stale\",\r\n \"Critical\"\r\n )\r\n| join kind=leftouter ActivityTrend on ComputerKey\r\n| extend ActivityTrend = coalesce(ActivityTrend, dynamic([0]))\r\n| where 'All' in ({HealthFilter}) \r\n or Health in ({HealthFilter})\r\n| project\r\n ComputerName,\r\n Health,\r\n OverallLatency,\r\n ActivityTrend,\r\n Heartbeat,\r\n MDE,\r\n SecurityLogs,\r\n SyslogPresent,\r\n HeartbeatLatency,\r\n DeviceInfoLatency,\r\n SecurityEventLatency,\r\n SyslogLatency,\r\n LastSeen,\r\n HeartbeatLastSeen,\r\n DeviceInfoLastSeen,\r\n DeviceEventsLastSeen,\r\n DeviceNetworkLastSeen,\r\n DeviceProcessLastSeen,\r\n SecurityEventLastSeen,\r\n SyslogLastSeen\r\n| order by OverallLatency asc", "size": 0, "title": "Computer latency, count: {$rowCount} - {HealthFilter}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Health", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Stale", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Healthy", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "OverallLatency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "ActivityTrend", "formatter": 10, "formatOptions": { "palette": "blue" } }, { "columnMatch": "HeartbeatLatency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "DeviceInfoLatency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "SecurityEventLatency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "SyslogLatency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } } ], "rowLimit": 1000, "filter": true }, "chartSettings": { "showLegend": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Latency" }, "name": "query - 13" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Latency" }, "name": "group - latency" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Cost", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "b2d72148-33fb-4afc-9860-476d2afb7b7f", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "bb092bc8-2753-40d1-9044-507915dcbbe8", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Table Analysis ", "subTarget": "table", "style": "link" }, { "id": "ed5e9da0-5b84-413d-a198-0338b248f2b7", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Microsoft Sentinel ", "subTarget": "sentinel", "style": "link" }, { "id": "f23e1ce4-a2b5-4947-9dc3-6211e1021765", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Defender for Cloud", "subTarget": "asc", "style": "link" }, { "id": "56d37b06-6b2e-4f71-be8a-ba20aeeb7ee0", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "E5/7 benefit", "subTarget": "e5", "style": "link" }, { "id": "68478fa5-e791-4eb7-836f-4c7ba3002fda", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Syslog", "subTarget": "syslog", "style": "link" }, { "id": "7728c496-7831-4089-afc2-133fbe5fa06b", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Common Security Format (CEF)", "subTarget": "cef", "style": "link" }, { "id": "f78cc110-ba82-4410-85df-f8b7423322da", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "Retention Estimate", "subTarget": "retention", "style": "link" } ] }, "name": "links - 20" }, { "type": 1, "content": { "json": "### Workspace Pricing\r\n\r\nPrice Parameter: Please provide an estimated cost so that we can get a value in the \"Estimated Table Price\" column, in the [Workspace Info] tab. \r\ni.e If your Log Analytics PAYG is Β£2.00 per GB enter 2.00. You can enter an interger (without a currency symbol), in format 1.0, 2.0, 3.1 etc... \r\nIf you want to see the combined Log Analytics + Sentinel estimated cost please use both PAYG prices i.e. 2.00 + 2.00 = 4.00. Please see the licence pages for both products.\r\n\r\nBase value on 7th July 2020, using an example of Sentinel ($2.46 US Central PAYG) + Log Analytics ($2.76 US Central PAYG) \r\n\r\n\r\nNote: No capacity reservation is taken into account.\r\n\r\n\r\n### Anomoly Detection\r\nSome reports now show anomoly detection, this explains the Score:\r\nhttps://docs.microsoft.com/azure/data-explorer/anomaly-detection#time-series-anomaly-detection\r\n\r\nAnomaly scores above 1.5 or below -1.5 indicate a mild anomaly rise or decline respectively. Anomaly scores above 3.0 or below -3.0 indicate a strong anomaly.", "style": "info" }, "customWidth": "48", "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 15" }, { "type": 1, "content": { "json": "### Microsoft Defender for Cloud (formally Azure Security Center) \r\n\r\nDefender for Cloud allows for 500MB/day (0.5GBytes) of *free* data to be sent by each Computer. Please see the licencing link at the bottom of this text box.\r\nYou have two variables\r\n1. The total allowed: < number of computers> * 0.5GB (this is a pooled metric). \t\r\n\te.g 4 computers * 0.5GB = 2.0GB, the maximum value which is allowed to be sent for free. Any data over this number will have the standard (Sentinel + Log Analytics) charge applied. \r\n2. The actual data sent by each computer\r\n\te.g 4 * computers * 0.1GB = 0.4GB, which is allowed for free.\r\n\r\nTo fully calculate the Microsoft Sentinel average GBytes per day, if D4C data is present, we need to take #1 from the total or #2. This is shown as the \"Revised GB Number\". \r\n\r\n### Note: Licencing is subject to change, you must fully investigate and understand from the current documentation the implications.\r\nhttps://azure.microsoft.com/pricing/details/security-center/ correct as of 17th September 2020. \r\nRESOURCE TYPE\tFREE TIER\tSTANDARD TIER (a.k.a \"Azure Defender ON\")\r\nVirtual Machine\tFree\t$0.02/Server/Hour\r\nIncluded data - 500 MB/day", "style": "info" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 15 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Sentinel Usage", "items": [ { "type": 1, "content": { "json": "Icon-security-248" }, "name": "text - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "923d55a3-75ac-4ce2-8820-50b4a530a553", "version": "KqlParameterItem/1.0", "name": "SentinelPrice", "type": 1, "description": "Enter a value for Sentinel Data cost, default: 2.0", "value": "2.0", "timeContext": { "durationMs": 86400000 } }, { "id": "f809d158-af16-4583-95af-980cd064e15f", "version": "KqlParameterItem/1.0", "name": "Retention", "label": "Retention price per GB", "type": 1, "description": "Obtain a value from the Azure Pricing Calculator, default: 0.10", "value": "0.10" }, { "id": "8de07ce7-c61a-417b-a364-5fd3e52ad622", "version": "KqlParameterItem/1.0", "name": "retentionDays", "label": "How many days retention are required? Defaults to current setting", "type": 1, "description": "Do you need to retain data for more than 90days in Sentinel? Defaults to current setting, alter for an estimate e.g 180days, max 730days. 1yr=365, 2yr=720, 3yr=1095, 4yr=1460, 5yr=1825, 6yr=2190 & 7yr=2555", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend retentionDays = trim(' ', tostring(properties.retentionInDays))\r\n| project retentionDays", "crossComponentResources": [ "{Subscription}" ], "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "f87b71cc-4738-41b7-8625-63656640e6ad", "version": "KqlParameterItem/1.0", "name": "SentinelCap", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 200 , sku = \"capacityreservation\"\r\n//\r\n| project capacityReservationLevel\r\n\r\n\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "72f36500-a03a-42ed-bac1-db83d92ca534", "version": "KqlParameterItem/1.0", "name": "discountRate", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 2000 , sku = \"capacityreservation\"\r\n| extend discountRate = case(\r\ncapacityReservationLevel == 100,50,\r\ncapacityReservationLevel == 200,55,\r\ncapacityReservationLevel == 300,57,\r\ncapacityReservationLevel == 400,58,\r\ncapacityReservationLevel == 500,60,\r\ncapacityReservationLevel == 1000,61,\r\ncapacityReservationLevel == 2000,63,\r\ncapacityReservationLevel >= 5000,65,\r\n// else\r\n0\r\n)\r\n| project discountRate\r\n\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "version": "KqlParameterItem/1.0", "name": "lawCap", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| project capacityReservationLevel = properties.sku.capacityReservationLevel\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "id": "2665b7ce-d7df-4130-a67f-1486b598edb7" }, { "id": "2b57d534-a06f-43c3-a6da-b01158540eab", "version": "KqlParameterItem/1.0", "name": "SentinelSku", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| project sku = tolower(properties.sku.name)", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 5000 , sku = \"capacityreservation\"\r\n//\r\n| extend pricingTier = case(\r\nsku == 'capacityreservation' and capacityReservationLevel == 100,\r\n'100 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 200,\r\n'200 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 300,\r\n'300 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 400,\r\n'400 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 500,\r\n'500 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 1000,\r\n'1000 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 2000,\r\n'2000 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel >= 5000,\r\n'5000 GB/day and above Commitment Tier',\r\nsku == 'free',\r\n'Free',\r\nsku == 'standard',\r\n'Standard',\r\nsku == 'premium',\r\n'Premium',\r\nsku == 'standalone',\r\n'Standalone',\r\nsku == 'pernode',\r\n'Per Node',\r\nsku == 'lacluster',\r\n'Cluster Level Capacity Reservation',\r\nsku == 'pergb2018' or sku == 'pergb',\r\n'Pay-as-you-go',\r\nstrcat('Unknown:',sku))\r\n| extend discountRate = case(\r\ncapacityReservationLevel == 100,50,\r\ncapacityReservationLevel == 200,55,\r\ncapacityReservationLevel == 300,57,\r\ncapacityReservationLevel == 400,58,\r\ncapacityReservationLevel == 500,60,\r\ncapacityReservationLevel == 1000,61,\r\ncapacityReservationLevel == 2000,63,\r\ncapacityReservationLevel >= 5000,65,\r\n// else\r\n0\r\n)\r\n| extend retentionInSentinel = iif({retentionDays} > 90,({retentionDays} -90) * {GBperday} * {Retention} ,toreal(0))\r\n| project ['Workspace Name']=id, location, sku, commitmentTier = capacityReservationLevel, discountRate , tags, dataRetention = {retentionDays}, dataRetentionMinusFree = {retentionDays}-90, RetentionEstimatedPrice = retentionInSentinel\r\n\r\n\r\n", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "RetentionEstimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Workspace", "comparison": "isNotEqualTo" }, "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == True\r\n| summarize dataPerDay = sum(Quantity)/1000 by bin(TimeGenerated,1d), SentinelCT='{SentinelCap}'\r\n| extend higherCT = case(\r\n dataPerDay < 100, 100,\r\n dataPerDay > 100 and dataPerDay < 200, 200,\r\n dataPerDay > 200 and dataPerDay < 300, 300,\r\n dataPerDay > 300 and dataPerDay < 400, 400,\r\n dataPerDay > 400 and dataPerDay < 500, 500,\r\n dataPerDay > 500 and dataPerDay < 1000, 1000,\r\n dataPerDay > 1000 and dataPerDay < 10000, 10000,\r\n dataPerDay > 2000 and dataPerDay < 20000, 20000,\r\n dataPerDay > 5000 and dataPerDay < 50000, 50000,\r\n // else\r\n 0\r\n )\r\n//| extend lowerCT= (higherCT - 100)\r\n\r\n\r\n\r\n", "size": 1, "aggregation": 3, "showAnnotations": true, "title": "Actual Data Volume and Commitment Tier. Data from: {TimeRange:label}. ", "timeContextFromParameter": "TimeRange", "exportFieldName": "y", "exportParameterName": "yAxis", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "Column1", "formatter": 5 }, { "columnMatch": "dataPerDay", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ] }, "sortBy": [], "chartSettings": { "yAxis": [ "higherCT", "SentinelCT", "dataPerDay" ], "seriesLabelSettings": [ { "seriesName": "higherCT", "label": "Next Commitment Tier" }, { "seriesName": "SentinelCT", "label": "Actual Commitment Tier", "color": "purple" }, { "seriesName": "dataPerDay", "color": "green" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "query - chart of CR" }, { "type": 1, "content": { "json": "### Commitment Tier Insight\r\nThis report, shows the Average GB/day (based on the TimeRange parameter), which is rounded up to the nearest whole number, this is the number the Azure Pricing Calculator requires. https://azure.microsoft.com/pricing/calculator/ for Sentinel.\r\n- The Pay as You Go (PAYG_estimate) is the GB/day multiplied by the [Sentinel Price] parameter, default is 2.0 (the price in $ for EAST US). This is location and currency neutral, so adjust to your own preferred value. This is the Daily estimate of the price.\r\n- The Pay as You Go (PAYG_estimate_mthly) is the Monthly (31day) estimate of the price.\r\n- Commitment Tier_Estimate_Monthly is the (PAYG_estimate_mthly) minus any discount for the commitment Tier that is *currently* set.\r\n- Data ingested into Sentinel exceeding the selected daily commitment tier is charged at the effective tier prices. source: https://azure.microsoft.com/pricing/details/azure-sentinel/" }, "name": "text - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " project actual_ = '{GBperday}' , roundUp_ = round(toreal('{GBperday}'),0)\r\n| extend lookBack = 31\r\n| extend roundUp_ = iif(isnan(roundUp_),toreal(0),toreal(roundUp_))\r\n| extend PAYG_estimate = roundUp_ * {SentinelPrice}\r\n| extend discountRate = iif(isempty('{discountRate}'),\"0\",'{discountRate}') \r\n| extend PAYG_estimate_mthly = (PAYG_estimate * lookBack)\r\n| extend CT_estimate_mthly = PAYG_estimate_mthly * tolong(discountRate) / 100\r\n| summarize by ['avg GB/day']=roundUp_, PAYG_estimate, PAYG_estimate_mthly, CT_estimate_mthly", "size": 4, "aggregation": 5, "showAnnotations": true, "title": "Commitment Tier. Price per GB:{SentinelPrice}, Discount %: {discountRate} ", "exportFieldName": "y", "exportParameterName": "yAxis", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "PAYG_estimate", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "PAYG_estimate_mthly", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "avgDataPerDay", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "PAYG_estimate_daily", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ], "labelSettings": [ { "columnId": "CT_estimate_mthly", "label": "Commitment Tier estimate mthly", "comment": "Estimated Monthly price" } ] }, "sortBy": [] }, "name": "query - billing - Copy" }, { "type": 1, "content": { "json": "### Commitment Tier for your Average GB/day value? \r\nThis report helps you decide:\r\n- A green circle in a Status column 🟒 indicates your are on the Optimal setting, based on your average data ingestion (GB/day) and Pay As You Go/commitment tier settings.\r\n- A recommend value of \"0\" / zero, means that you are on a setting (SKU) such as Free, PerGB etc.. rather than a commitment tier setting.\r\n- If the 'recommend' Sentinel or Workspace setting doesn't match the 'current' setting you will get a Red Cross in the Status columns ❌.\r\n- Please read https://azure.microsoft.com/pricing/details/azure-sentinel/ and https://azure.microsoft.com/pricing/details/monitor/ before deciding. " }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " project actual_ = '{GBperday}' , roundUp_ = round(toreal('{GBperday}'),0)\r\n| extend lookBack = 31\r\n| extend i = roundUp_ //* 100\r\n| extend i = iif(isnan(i),toreal(0),toreal(i))\r\n// Sentinel commitment tier logic\r\n| extend recommendedSentinelCT = case(\r\n i <= 50,\"0\",\r\n i between (51 .. 180),\"100\",\r\n i between (181 .. 286),\"200\",\r\n i between (287 .. 390),\"300\",\r\n i between (391 .. 476),\"400\",\r\n i between (477 .. 975),\"500\",\r\n i between (976 .. 1897),\"1000\",\r\n i between (1898 .. 4729),\"2000\",\r\n i >= 4730 ,\"5000\",\r\n //else\r\n strcat(\"unknown Sentinel CT: \", i)\r\n)\r\n// Azure Log Analytics (LAW) commitment tier logic\r\n| extend recommendedWorkspaceCT = case(\r\n i <= 85,\"0\",\r\n i between (86 .. 187),\"100\",\r\n i between (188 .. 293),\"200\",\r\n i between (294 .. 391),\"300\",\r\n i between (392 .. 491),\"400\",\r\n i between (492 .. 982),\"500\",\r\n i between (983 .. 1952),\"1000\",\r\n i between (1953 .. 4849),\"2000\",\r\n i >= 4850 ,\"5000\",\r\n //else\r\n strcat(\"unknown LAW CT: \", i)\r\n)\r\n| extend avgDataPerDay = i\r\n| extend currentSentinelCT = iif(isempty('{SentinelCap}'),\"0\",'{SentinelCap}')\r\n| extend currentWorkspaceCT = iif(isempty('{lawCap}'),\"0\",'{lawCap}')\r\n| extend sentinelOptimal = iif(recommendedSentinelCT == currentSentinelCT,1,0)\r\n| extend lawOptimal = iif(recommendedWorkspaceCT == currentWorkspaceCT,1,0)\r\n| summarize by ['avg GB/day']=avgDataPerDay,['Sentinel Status']=sentinelOptimal, ['Log Analytics Status']=lawOptimal, recommendedSentinelCT, recommendedWorkspaceCT,currentSentinelCT, currentWorkspaceCT", "size": 4, "title": "Commitment Tier Recommendations", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Sentinel Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "failed", "text": "" } ] }, "tooltipFormat": { "tooltip": "If Current and Recommended settings dont match the avg. GB/day - look to adjust? " } }, { "columnMatch": "Log Analytics Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "failed", "text": "" } ] }, "tooltipFormat": { "tooltip": "If Current and Recommended settings dont match the avg. GB/day - look to adjust? " } } ] } }, "name": "query - CR optimal" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "sentinel" }, "name": "group - capReservation" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Defender for Cloud Usage", "items": [ { "type": 1, "content": { "json": "" }, "name": "text - 11" }, { "type": 1, "content": { "json": "## Defender for Cloud : Usage Reports\r\n- - - " }, "name": "text - 15" }, { "type": 1, "content": { "json": "The following two charts help you understand Microsoft Defender for Cloud / **SecuityEvent** data if its present.\r\n- Top 10 computers, sending that SecuityEvent logs information & the capacity SecuityEvent \r\n- The final chart shows the potential allowance (each Defender for Cloud licence allows for 500MB/day). \r\n\t\r\n\t- Defender for Cloud / a.k.a \"Azure Defender ON\" was formally \"ASC standard\". \r\n\t- You can see what was Used vs. Allowed (where allowed = 500MB * < count of servers>) " }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// https://docs.microsoft.com/azure/azure-monitor/logs/manage-cost-storage#log-analytics-and-security-center\r\nlet ascTables = dynamic(['WindowsEvent', 'SecurityAlert', 'SecurityBaseline', 'SecurityBaselineSummary', 'SecurityDetection', 'SecurityEvent','WindowsFirewall', 'MaliciousIPCommunication', 'LinuxAuditLog', 'SysmonEvent', 'ProtectionStatus']);\r\nunion withsource = tt *\r\n| where TimeGenerated > ago(30d)\r\n| where _IsBillable == True\r\n// Calculate the daily GB size per billable Table and unique Server count \r\n| summarize allGBytes =sum(_BilledSize)/(1024*1024*1024), ascGBytes=sumif(_BilledSize, Type in (ascTables))/(1024*1024*1024), ascComputerCount = dcountif(Computer,tt in (ascTables)) by bin(TimeGenerated, 1d)\r\n// Calculate daily GB average, and average ASC server count. Each Server is allowed max 0.5GB each\r\n| summarize avg(allGBytes), avg(ascGBytes),ascComputers=round(avg(ascComputerCount),0),ascMaxGB = avg(ascComputerCount) * 0.5\r\n// If ASC sends less than the allowed max, revise the GB averge per day, else use the max allowed (all servers * 0.5)\r\n| extend revisedNumber = iif(avg_ascGBytes <= ascMaxGB, allMinusASCused = (avg_allGBytes - avg_ascGBytes),allMinusASCused = (avg_allGBytes - ascMaxGB) )\r\n| extend withinPool = iif(avg_ascGBytes >= ascMaxGB,\"Yes\",\"No\")\r\n| extend overBy = iif(round(avg_ascGBytes,2) - round(ascMaxGB,2) < 0 , toreal(0), round(avg_ascGBytes,2) - round(ascMaxGB,2) )\r\n| project ['Raw Average GB'] = avg_allGBytes,\r\n ['Defender has used, GB'] = strcat(round(avg_ascGBytes,1),\" GB of \" ,round(ascMaxGB,1), \" GB across \", ascComputers , \" Computers\"), \r\n ['Revised GB Number']= round(revisedNumber,2),\r\n ['Help'] =\"Please toggle [Show Help] to Yes, for more information\", \r\n ['Sent more than allocation?'] = withinPool,\r\n ['Overage in GB'] = overBy\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n", "size": 4, "aggregation": 3, "title": "Average GB per day: past 30days only", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Raw Average GB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "ASC has used, GB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Sent more than allocation?", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "yes", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "ASC has used", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Revised Number", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Average GB/day", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Average GB per day", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Adjusted for ASC standard 500MB allowance", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "sum_ASCs", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "ASCsize", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Adjusted for ASC standard", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "avg_TotalGBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "name": "query - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "find in (WindowsEvent, SecurityAlert, SecurityBaseline, SecurityBaselineSummary, SecurityDetection, SecurityEvent,WindowsFirewall, MaliciousIPCommunication, LinuxAuditLog, SysmonEvent, ProtectionStatus) where isnotempty(_BilledSize) project _BilledSize, Computer\r\n| summarize MBytes=sum(_BilledSize) by Computer\r\n| top 10 by MBytes desc", "size": 1, "aggregation": 3, "title": "Top 10 Computers, using Defender for Cloud, from: {TimeRange:label} ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "MBytes", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ] }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 36, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - 20 - top 10 d4cloud" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "find in (WindowsEvent, SecurityAlert, SecurityBaseline, SecurityBaselineSummary, SecurityDetection, SecurityEvent,WindowsFirewall, MaliciousIPCommunication, LinuxAuditLog, SysmonEvent, ProtectionStatus) where isnotempty(_BilledSize) project _BilledSize, Computer, TimeGenerated\r\n// ASC Standard allows 500MB per machine - in a pool \r\n| summarize allowedMBytes=524288000 * dcount(Computer), usedMBytes=sum(_BilledSize) , dcount(Computer) by bin(TimeGenerated,{TimeRange:grain})\r\n", "size": 0, "aggregation": 3, "title": "Defender for Cloud, allowance vs. in use, Last 30days", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "unstackedbar", "gridSettings": { "formatters": [ { "columnMatch": "MBytes", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 36, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - 20 - allowance" }, { "type": 1, "content": { "json": "The following three charts help you understand SecuityEvent data if its present.\r\n- SecurityEvents are captured in Groups: All, Common, Minimal and None\r\n- Using https://docs.microsoft.com/azure/data-explorer/kusto/query/series-decompose-anomaliesfunction we will look at this data\r\n- There are displays for Activity and EventIds that are captured in _Minimal_ and _Common_. Note _Minimal_ is a subset of _Common_\r\n- _\"All\"_ is a special case, as there isn't a list of those, I have listed any EventIds found, but only those not within _Common_\r\n- Using anomoliesfunction, we look at the expected count, actual count, give that a score (the higer varienences are marked in Red), a baseline and and Trend for the TimeRange ", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text -ASC help for minimal common and all " }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9f998673-d827-4bbf-97c3-16bd0b85bd5f", "version": "KqlParameterItem/1.0", "name": "AnomalyTuning", "type": 10, "description": "Anomaly scores above 1.5 or below -1.5 indicate a mild anomaly rise or decline respectively. Anomaly scores above 3.0 or below -3.0 indicate a strong anomaly. 2.0 added for a Medium range.", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"0\", \"label\": \"None\" },\r\n { \"value\": \"1.5\", \"label\": \"Mild\" },\r\n { \"value\": \"2.0\", \"label\": \"Medium\", \"selected\":true },\r\n { \"value\": \"3.0\", \"label\": \"Strong\"}\r\n]\r\n", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// source: https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection#data-collection-tier\r\n//\r\nlet minimal = dynamic([1102,4624,4625,4657,4663,4688,4700,4702,4719,4720,4722,4723,4724,4727,4728,4732,4735,4737,4739,4740,4754,4755,\r\n4756,4767,4799,4825,4946,4948,4956,5024,5033,8001,8002,8003,8004,8005,8006,8007,8222]);\r\nSecurityEvent\r\n| where EventID in (minimal)\r\n| summarize Count = count(), BilledSize= sum(_BilledSize) by EventID, Activity\r\n| order by EventID asc \r\n| join \r\n( \r\n SecurityEvent\r\n | make-series Trend = count() on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step {TimeRange:grain} by EventID\r\n | extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n | extend Score = score[-1]\r\n | extend expectedEventCounts=baseline[-1], actualEventCount=Trend[-1], Score = score[-1], Trend\r\n | project-away score\r\n) on EventID\r\n| where Score > {AnomalyTuning} or Score < toreal(strcat(\"-\",{AnomalyTuning}))\r\n| project-away EventID1\r\n| project Activity, expectedEventCounts, actualEventCount, Score, Trend, baseline, anomalies, Count, BilledSize\r\n//https://docs.microsoft.com/azure/data-explorer/anomaly-detection#time-series-anomaly-detection", "size": 1, "title": "\"minimal\" data set - {TimeRange:label}. anomaly-detection: {AnomalyTuning:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "expectedEventCounts", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "Score", "formatter": 8, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "10ch" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "pink" } }, { "columnMatch": "baseline", "formatter": 21, "formatOptions": { "palette": "purple" } }, { "columnMatch": "anomalies", "formatter": 10, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "BilledSize", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "EventID", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "TimeGenerated", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "EventID", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "EventID", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Activity", "sourceIdField": "Activity", "targetIdField": "EventID", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "GBytes", "type": 1, "colorPalette": "cool" }, "hivesMargin": 5 } }, "name": "query - MD4C minimal" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// source: https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection#data-collection-tier\r\n//\r\nlet common = dynamic([1,299,300,324,340,403,404,410,411,412,413,431,500,501,1100,1102,1107,1108,4608,4610,4611,4614,4622,\r\n4624,4625,4634,4647,4648,4649,4657,4661,4662,4663,4665,4666,4667,4688,4670,4672,4673,4674,4675,4689,4697,\r\n4700,4702,4704,4705,4716,4717,4718,4719,4720,4722,4723,4724,4725,4726,4727,4728,4729,4733,4732,4735,4737,\r\n4738,4739,4740,4742,4744,4745,4746,4750,4751,4752,4754,4755,4756,4757,4760,4761,4762,4764,4767,4768,4771,\r\n4774,4778,4779,4781,4793,4797,4798,4799,4800,4801,4802,4803,4825,4826,4870,4886,4887,4888,4893,4898,4902,\r\n4904,4905,4907,4931,4932,4933,4946,4948,4956,4985,5024,5033,5059,5136,5137,5140,5145,5632,6144,6145,6272,\r\n6273,6278,6416,6423,6424,8001,8002,8003,8004,8005,8006,8007,8222,26401,30004]);\r\nSecurityEvent\r\n| where EventID in (common)\r\n| summarize Count = count(), BilledSize= sum(_BilledSize) by EventID, Activity\r\n| order by EventID asc \r\n| join \r\n( \r\n SecurityEvent\r\n | make-series Trend = count() on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step {TimeRange:grain} by EventID\r\n | extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n | extend Score = score[-1]\r\n | extend expectedEventCounts=baseline[-1], actualEventCount=Trend[-1], Score = score[-1], Trend\r\n | project-away score\r\n) on EventID\r\n| where Score > {AnomalyTuning} or Score < toreal(strcat(\"-\",{AnomalyTuning}))\r\n| project-away EventID1\r\n| project Activity, expectedEventCounts, actualEventCount, Score, Trend, baseline, anomalies, Count, BilledSize", "size": 1, "title": "\"common\" data set - {TimeRange:label}. anomaly-detection: {AnomalyTuning:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "expectedEventCounts", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "Score", "formatter": 8, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "10ch" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "minimumFractionDigits": 2, "maximumSignificantDigits": 1 } }, "tooltipFormat": { "tooltip": "Look for large positive numbers" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "pink" } }, { "columnMatch": "baseline", "formatter": 21, "formatOptions": { "palette": "purple" } }, { "columnMatch": "anomalies", "formatter": 10, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "BilledSize", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "EventID", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "TimeGenerated", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "EventID", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "EventID", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Activity", "sourceIdField": "Activity", "targetIdField": "EventID", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "GBytes", "type": 1, "colorPalette": "cool" }, "hivesMargin": 5 } }, "name": "query - ASC common" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// source: https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection#data-collection-tier\r\n//\r\nlet common = dynamic([1,299,300,324,340,403,404,410,411,412,413,431,500,501,1100,1102,1107,1108,4608,4610,4611,4614,4622,\r\n4624,4625,4634,4647,4648,4649,4657,4661,4662,4663,4665,4666,4667,4688,4670,4672,4673,4674,4675,4689,4697,\r\n4700,4702,4704,4705,4716,4717,4718,4719,4720,4722,4723,4724,4725,4726,4727,4728,4729,4733,4732,4735,4737,\r\n4738,4739,4740,4742,4744,4745,4746,4750,4751,4752,4754,4755,4756,4757,4760,4761,4762,4764,4767,4768,4771,\r\n4774,4778,4779,4781,4793,4797,4798,4799,4800,4801,4802,4803,4825,4826,4870,4886,4887,4888,4893,4898,4902,\r\n4904,4905,4907,4931,4932,4933,4946,4948,4956,4985,5024,5033,5059,5136,5137,5140,5145,5632,6144,6145,6272,\r\n6273,6278,6416,6423,6424,8001,8002,8003,8004,8005,8006,8007,8222,26401,30004]);\r\nSecurityEvent\r\n| where EventID !in (common)\r\n| summarize Count = count(), BilledSize=sum(_BilledSize) by EventID, Activity, TimeGenerated\r\n| order by EventID asc \r\n| join \r\n( \r\n SecurityEvent\r\n //\r\n // anomalies - seasonality baseline that captures the repetitive pattern. Outliers can be clearly spotted in the Score\r\n //\r\n | make-series Trend = count() on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step {TimeRange:grain} by EventID\r\n | extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n | extend Score = score[-1]\r\n | extend expectedEventCounts=baseline[-1], actualEventCount=Trend[-1], Score = score[-1], Trend\r\n | project-away score\r\n) on EventID\r\n| where Score > {AnomalyTuning} or Score < toreal(strcat(\"-\",{AnomalyTuning}))\r\n| project-away EventID1\r\n| project Activity, expectedEventCounts, actualEventCount, Score, Trend, baseline, anomalies, Count, BilledSize\r\n", "size": 0, "title": "possible \"all\" data set - EventsIDs found that are not in \"common\" or \"minmal\" - {TimeRange:label}. anomaly-detection: {AnomalyTuning:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "expectedEventCounts", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "Score", "formatter": 8, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "10ch" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2, "maximumSignificantDigits": 2 } } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "pink" } }, { "columnMatch": "baseline", "formatter": 21, "formatOptions": { "palette": "purple" } }, { "columnMatch": "anomalies", "formatter": 10, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "BilledSize", "formatter": 0, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "TimeGenerated", "formatter": 5 }, { "columnMatch": "sum__BilledSize", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 2 } } }, { "columnMatch": "score", "formatter": 5, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_Score_3", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "EventID", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "EventID", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Activity", "sourceIdField": "Activity", "targetIdField": "EventID", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "GBytes", "type": 1, "colorPalette": "cool" }, "hivesMargin": 5 } }, "name": "query - All SecurityEvents with Trend" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _lookback = 31;\r\nSecurityEvent\r\n| where TimeGenerated > startofday(ago(31d))\r\n| where _IsBillable == True\r\n| extend _ResourceId = iif(isempty(_ResourceId),Computer,_ResourceId)\r\n| parse _ResourceId with * \"/subscriptions/\" SubscriptionId \"/resourcegroups/\" resourceGroups \"/\" *\r\n| summarize sum(_BilledSize) by _ResourceId, SubscriptionId, resourceGroups\r\n//| project DeviceName =_ResourceId, sum__BilledSize, ['Estimated Price'] = (sum__BilledSize/(1024*1024*1024) - ( 0.5 * _lookback)) * {Price} \r\n| project DeviceName =_ResourceId, sum__BilledSize, adjustedNumber = (sum__BilledSize/(1024*1024*1024) - ( 0.5 * _lookback)) * {Price} , SubscriptionId, resourceGroups\r\n| extend adjustedNumber = iif(adjustedNumber <= 0,toreal(\"Included\"),adjustedNumber) \r\n| order by adjustedNumber desc\r\n", "size": 0, "title": "BilledSize vs. Overage per resource, Month View", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "sum__BilledSize", "formatter": 0, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "adjustedNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "is Empty", "thresholdValue": "0", "representation": "Blank", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0} Overage" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "Estimated Price", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_adjustedNumber_2", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "sum__BilledSize", "label": "BilledSize" }, { "columnId": "adjustedNumber", "label": "Estimated Price" } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_adjustedNumber_2", "sortOrder": 2 } ] }, "name": "query - 9" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "asc" }, "name": "group - ASC" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Retention Estimator", "items": [ { "type": 1, "content": { "json": "Reproduced from: Archiving, Basic Logs, and Retention " }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Update Pricing Based on your Region", "expandable": true, "expanded": true, "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "34d44a0e-a9d2-4ad7-81fb-21b232320cbb", "version": "KqlParameterItem/1.0", "name": "totalRetentionInDays", "type": 1, "description": "Enter the number of days for retention (max)", "isRequired": true, "value": "1000" } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "16.6", "name": "Cost Estimates - Copy", "styleSettings": { "margin": "5px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b8c3969f-967e-4672-a272-a65209d1a042", "version": "KqlParameterItem/1.0", "name": "basiclogPrice", "label": "Basic Logs Price", "type": 1, "description": "Enter the Basic Logs Price Per GB based on your region.", "isRequired": true, "value": "0.50" } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "16.6", "name": "Cost Estimates - Copy - Copy", "styleSettings": { "margin": "5px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f69784cb-ed7d-41b2-a86b-02bd3ef56dd9", "version": "KqlParameterItem/1.0", "name": "ArchivePrice", "label": "Data Archive Price", "type": 1, "description": "Enter the Data Archive Price Per GB based on your region.", "isRequired": true, "value": "0.02" } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "16.6", "name": "Cost Estimates - Copy", "styleSettings": { "margin": "5px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "34c07ca6-2aa1-4a75-815d-c0e709936dcd", "version": "KqlParameterItem/1.0", "name": "RetentionPrice", "label": "Workspace Retention Price", "type": 1, "description": "Enter the workspace retention price per GB/month.", "isRequired": true, "value": "0.10" } ], "style": "formVertical", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "16.6", "name": "Cost Estimates - Copy", "styleSettings": { "margin": "5px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "729ed7b8-0d53-4582-b6f1-c97baa71ab85", "version": "KqlParameterItem/1.0", "name": "workspaceRetention", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-07-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties.retentionInDays\",\"columns\":[]}}]}", "isHiddenWhenLocked": true, "queryType": 12 }, { "id": "0f574f27-60ca-4bc3-8c13-3ffa9b415a3b", "version": "KqlParameterItem/1.0", "name": "workspaceRetentionPeriod_estimate", "label": "Workspace Retention Period (Months)", "type": 1, "description": "The Workspace Retention Period in Months. (Update for an estimate)", "isRequired": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "workspaceRetention", "operator": "<=", "rightValType": "static", "rightVal": "90", "resultValType": "static", "resultVal": "3" } }, { "criteriaContext": { "operator": "Default", "resultValType": "param", "resultVal": "workspaceRetention" } } ] } ], "style": "formVertical", "queryType": 12 }, "customWidth": "25", "conditionalVisibility": { "parameterName": "workspaceRetention", "comparison": "isNotEqualTo" }, "name": "Cost Estimates - Copy", "styleSettings": { "margin": "5px" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "datalakeIngestionUSD", "type": 1, "value": "5", "label": "data lake Ingestion (GB)", "id": "5c147664-ee01-492c-a033-df02cb7a6869" }, { "version": "KqlParameterItem/1.0", "name": "datalakeProcessingUSD", "type": 1, "value": "0.1", "label": "data lake processing (GB)", "id": "3c33d3c7-9e45-4839-a9f2-261b6a6f2705" }, { "id": "9f3ce670-960a-4d26-9157-9eefcdf4385b", "version": "KqlParameterItem/1.0", "name": "datalakeStorageUSD", "label": "data lake storage (GB)", "type": 1, "description": "This value will be DIVIDED by 6 ", "value": "0.026" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "50", "name": "parameters - 1" } ], "exportParameters": true }, "name": "Price Parameters" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Data is based on the {TimeRange:label}", "loadType": "always", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\",\"substringRegexMatch\":\"Auxiliary\",\"substringReplace\":\"Auxiliary / data lake\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 4, "title": "Retention settings for All Tables", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "rowLimit": 5000, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "TableRetentionQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(((@.properties.schema.tableSubType=='DataCollectionRuleBased' || @.properties.schema.name=='AppTraces' || @.properties.schema.name=='ContainerLog' || @.properties.schema.name=='ContainerLogV2') && @.properties.schema.tableType!='RestoredLogs' && @.properties.schema.tableType!='SearchResults'))]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\",\"substringRegexMatch\":\"Auxiliary\",\"substringReplace\":\"Auxiliary / data lake\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 4, "title": "Basic Log Tables", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TablePlan", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TablePlan", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "basicLogTables" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Size'] = size,\r\n ['Estimated Workspace Retention Cost'] = size * iif({workspaceRetentionPeriod_estimate} <= 3, 0, ({workspaceRetentionPeriod_estimate} - 3)) * {RetentionPrice},\r\n IsBillable\r\n| extend dlIngestion = ['Table Size'] * {datalakeIngestionUSD}\r\n\t", "size": 0, "title": "Tables Found in the {WorkspaceName} workspace", "timeContextFromParameter": "TimeRange", "exportFieldName": "DataType", "exportParameterName": "DataType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } } ], "sortBy": [ { "itemKey": "Table", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Table", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "LAWTableQuery" }, { "type": 1, "content": { "json": "The below table shows current Workspace Retention and Data Archive Cost Estimates. \r\n\r\nThese are only estimates and do not reflect current billed costs. You can use these for planning before enabling Data Archive\r\n\r\nUpdate the **Total Retention in Days** for estimate on Data Archiving. The TotalRetention column reflects the current settings. ", "style": "upsell" }, "name": "text - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"Table Size (GB)\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Data Archive Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Table Size (GB)\\\"] * ({totalRetentionInDays} / 30 )* {ArchivePrice}\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Workspace Retention Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"InteractiveRetention\",\"operator\":\"<=\",\"rightValType\":\"static\",\"rightVal\":\"90\",\"resultValType\":\"static\",\"resultVal\":\"0.0\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Table Size (GB)\\\"] * {RetentionPrice}\"}}]},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].IsBillable\"},{\"originalName\":\"[LAWTableQuery].dl\"},{\"originalName\":\"[LAWTableQuery].dlIngestion\"}]}", "size": 1, "title": "Estimated Data Retention Costs - Planning for Data Archiving", "noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TableName", "parameterName": "TableName", "parameterType": 1 }, { "fieldName": "TablePlan", "parameterName": "TablePlan", "parameterType": 1 }, { "fieldName": "InteractiveRetention", "parameterName": "InteractiveRetention", "parameterType": 1 }, { "fieldName": "ArchiveRetention", "parameterName": "ArchiveRetention", "parameterType": 1 }, { "fieldName": "TotalRetention", "parameterName": "TotalRetention", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35.2857ch" } }, { "columnMatch": "TableType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15.8571ch" } }, { "columnMatch": "TablePlan", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "InteractiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "ArchiveRetention", "formatter": 4, "formatOptions": { "min": 0, "max": 2556, "palette": "blue", "customColumnWidthSetting": "20.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetention", "formatter": 4, "formatOptions": { "min": 90, "max": 2556, "palette": "turquoise", "customColumnWidthSetting": "18.2857ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "Table Size (GB)", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "Estimated Data lake Cost", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Added columnstimated Data lake Cost", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "LAW Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "IsBillable", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Basic Log Costs", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "lastPlanModifiedDate", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "33.1429ch" } }, { "columnMatch": "TableInteractivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26.5714ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TableArchivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetentionPeriod", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "{workspaceRetention}", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "23.4286ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "TableSize", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "SizeUnit", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Last Updated Time", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26ch" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "$gen_number_InteractiveRetention_3", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_number_InteractiveRetention_3", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TableName", "formatter": 1 }, "leftContent": { "columnMatch": "LAW Table Size", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "TableName", "formatter": 1 }, "centerContent": { "columnMatch": "LAW Table Size", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "yAxis": [ "Estimated Ingestion Cost" ], "group": "TableType", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "currency": "USD", "style": "currency", "useGrouping": true } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "LAW Table Size", "sizeAggregation": "Sum", "legendMetric": "LAW Table Size", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "LAW Table Size", "heatmapPalette": "greenRed" } } }, "name": "query - 9 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"Table Size (GB)\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Data lake Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Table Size (GB)\\\"] * {totalRetentionInDays} * ({datalakeStorageUSD} /6)\"}}]},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].IsBillable\"},{\"originalName\":\"[LAWTableQuery].dl\"},{\"originalName\":\"[LAWTableQuery].dlIngestion\"}]}", "size": 1, "title": "Estimated Data Retention Costs - Planning for Data Lake", "noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TableName", "parameterName": "TableName", "parameterType": 1 }, { "fieldName": "TablePlan", "parameterName": "TablePlan", "parameterType": 1 }, { "fieldName": "InteractiveRetention", "parameterName": "InteractiveRetention", "parameterType": 1 }, { "fieldName": "ArchiveRetention", "parameterName": "ArchiveRetention", "parameterType": 1 }, { "fieldName": "TotalRetention", "parameterName": "TotalRetention", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35.2857ch" } }, { "columnMatch": "TableType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15.8571ch" } }, { "columnMatch": "TablePlan", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "InteractiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "ArchiveRetention", "formatter": 4, "formatOptions": { "min": 0, "max": 2556, "palette": "blue", "customColumnWidthSetting": "20.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetention", "formatter": 4, "formatOptions": { "min": 90, "max": 2556, "palette": "turquoise", "customColumnWidthSetting": "18.2857ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "Table Size (GB)", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Data lake Cost", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Added columnstimated Data lake Cost", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "LAW Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "IsBillable", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Basic Log Costs", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "lastPlanModifiedDate", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "33.1429ch" } }, { "columnMatch": "TableInteractivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26.5714ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TableArchivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetentionPeriod", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "{workspaceRetention}", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "23.4286ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "TableSize", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "SizeUnit", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Last Updated Time", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26ch" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "$gen_number_InteractiveRetention_3", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_number_InteractiveRetention_3", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TableName", "formatter": 1 }, "leftContent": { "columnMatch": "LAW Table Size", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "TableName", "formatter": 1 }, "centerContent": { "columnMatch": "LAW Table Size", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "yAxis": [ "Estimated Ingestion Cost" ], "group": "TableType", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "currency": "USD", "style": "currency", "useGrouping": true } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "LAW Table Size", "sizeAggregation": "Sum", "legendMetric": "LAW Table Size", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "LAW Table Size", "heatmapPalette": "greenRed" } } }, "name": "query - 9 - dl " }, { "type": 1, "content": { "json": "The below table shows current Analytics Plan Ingestion Cost Estimates. Use this table to estimate costs associated with enabling basic logs\r\n\r\nThese are only estimates and do not reflect current billed costs. ", "style": "upsell" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"leftouter\",\"leftTable\":\"basicLogTables\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[basicLogTables].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TableInteractivePeriod\",\"mergedName\":\"TableInteractivePeriod\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"Table Size (GB)\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Ingestion Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"IsBillable\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"false\",\"resultValType\":\"expression\",\"resultVal\":\"0.0\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Table Size (GB)\\\"] * {Price}\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Basic Logs Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Table Size (GB)\\\"] * {basiclogPrice}\"}}]},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].dl\",\"mergedName\":\"dl\",\"fromId\":\"unknown\"},{\"originalName\":\"[LAWTableQuery].dlIngestion\",\"mergedName\":\"dlIngestion\",\"fromId\":\"unknown\"},{\"originalName\":\"[basicLogTables].TableArchivePeriod\"},{\"originalName\":\"[basicLogTables].TotalRetentionPeriod\"},{\"originalName\":\"[basicLogTables].lastPlanModifiedDate\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].Estimated Workspace Retention Cost\"}]}", "size": 1, "title": "Estimated Data Ingestion Costs - Planning for Basic Logs", "noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TableName", "parameterName": "TableName", "parameterType": 1 }, { "fieldName": "TablePlan", "parameterName": "TablePlan", "parameterType": 1 }, { "fieldName": "InteractiveRetention", "parameterName": "InteractiveRetention", "parameterType": 1 }, { "fieldName": "ArchiveRetention", "parameterName": "ArchiveRetention", "parameterType": 1 }, { "fieldName": "TotalRetention", "parameterName": "TotalRetention", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35.2857ch" } }, { "columnMatch": "TableType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15.8571ch" } }, { "columnMatch": "TablePlan", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "TableInteractivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26.5714ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size (GB)", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Basic Logs Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "IsBillable", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "dlIngestion", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "LAW Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "InteractiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "ArchiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetention", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "{workspaceRetention}", "representation": "yellow", "text": "{0} {1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0} {1}" } ], "customColumnWidthSetting": "18.2857ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Estimated Basic Log Costs", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "lastPlanModifiedDate", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "33.1429ch" } }, { "columnMatch": "TableArchivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetentionPeriod", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "{workspaceRetention}", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "23.4286ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "TableSize", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "SizeUnit", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Last Updated Time", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26ch" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "name": "query - 9 - Copy" } ] }, "name": "CostAnalysis" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "retention" }, "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "E5 Benefit ", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "E5 and Defender for Servers ", "items": [ { "type": 1, "content": { "json": "If you have **Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security licenses** in your environment, enter the **total number of seats in the parameter** below. This will be used to determine the total data grant.", "style": "info" }, "customWidth": "70", "name": "text - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "E3or5 benefit estimate", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n//Infers Potential P1 usage\r\n//Infers Potential P2 usage\r\n//Calculates:\r\n//Potential P1 user count\r\n//Potential P2 user count\r\n//Total distinct users\r\n//Still keeps the supporting signal metrics\r\n\r\n\r\nlet lookback = 30d;\r\nlet minCASigninsForSignal = 10;\r\nlet minRiskSigninsForSignal = 5;\r\n\r\nlet base =\r\nSigninLogs\r\n| where TimeGenerated >= ago(lookback)\r\n| where isnotempty(UserPrincipalName)\r\n| extend HasCAArray = isnotempty(ConditionalAccessPolicies)\r\n| mv-expand CA = iff(HasCAArray, ConditionalAccessPolicies, dynamic([dynamic(null)])) to typeof(dynamic)\r\n| extend CAResult = tostring(CA.result)\r\n| extend CAApplied =\r\n iff(HasCAArray and CAResult in (\"success\",\"failure\",\"reportOnlySuccess\",\"reportOnlyFailure\"), 1, 0)\r\n| extend RiskSignal =\r\n iff(\r\n tostring(RiskState) != \"\" and tostring(RiskState) != \"none\"\r\n or tostring(RiskLevelDuringSignIn) != \"\" and tostring(RiskLevelDuringSignIn) != \"none\"\r\n or tostring(RiskDetail) != \"\" and tostring(RiskDetail) != \"none\",\r\n 1, 0\r\n )\r\n| extend StrongP2Signal =\r\n iff(\r\n tostring(RiskLevelDuringSignIn) in (\"medium\",\"high\")\r\n or (tostring(RiskDetail) !in (\"none\",\"\", \"hidden\") and tostring(RiskDetail) !contains \"none\"),\r\n 1, 0\r\n );\r\n\r\nlet userLevel =\r\nbase\r\n| summarize\r\n UserCASignins = sum(CAApplied),\r\n UserRiskSignals = sum(RiskSignal),\r\n UserStrongP2Signals = sum(StrongP2Signal)\r\n by TenantId, UserPrincipalName\r\n| extend P1User =\r\n iff(UserCASignins > 0, 1, 0)\r\n| extend P2User =\r\n iff(UserStrongP2Signals >= minRiskSigninsForSignal\r\n or UserRiskSignals >= minRiskSigninsForSignal,\r\n 1, 0);\r\n\r\nuserLevel\r\n| summarize\r\n TotalDistinctUsers = dcount(UserPrincipalName),\r\n PotentialP1Users = sum(P1User),\r\n PotentialP2Users = sum(P2User)\r\n by TenantId\r\n| join kind=leftouter (\r\n base\r\n | summarize\r\n TotalSignins = dcount(CorrelationId),\r\n CAAppliedSignins = sum(CAApplied),\r\n RiskySignins = sum(RiskSignal),\r\n StrongP2Signals = sum(StrongP2Signal)\r\n by TenantId\r\n) on TenantId\r\n| extend PotentialP1 =\r\n case(\r\n PotentialP1Users >= 1 and CAAppliedSignins >= minCASigninsForSignal, \"Likely in use\",\r\n PotentialP1Users >= 1, \"Possible\",\r\n \"No signal\"\r\n )\r\n| extend PotentialP2 =\r\n case(\r\n PotentialP2Users >= 1 and StrongP2Signals >= minRiskSigninsForSignal, \"Likely in use\",\r\n PotentialP2Users >= 1, \"Possible\",\r\n \"No signal\"\r\n )\r\n| project\r\n //TenantId,\r\n PotentialP1,\r\n PotentialP2,\r\n TotalDistinctUsers,\r\n PotentialP1Users,\r\n PotentialP2Users,\r\n TotalSignins,\r\n CAAppliedSignins,\r\n RiskySignins,\r\n StrongP2Signals\r\n//| order by TenantId asc", "size": 4, "title": "P1/P2 check ", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "75", "name": "query - 6" }, { "type": 1, "content": { "json": "This infers the possible licence counts based on the logs found - this maybe an aid, but you should confirm your User count yourself:\r\n\r\nP1 usage β†’ Conditional Access actively applied\r\n\r\nP2 usage β†’ Risk-based signals meaningfully present\r\n\r\nIt does not prove licensing β€” it infers feature use from telemetry.", "style": "info" }, "customWidth": "25", "name": "text - 7" } ] }, "name": "group - egroup" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7b1675c0-7726-4f9e-876c-f3f7c17fa181", "version": "KqlParameterItem/1.0", "name": "E5Licenses", "label": "Total seats (E5/A5/F5/G5)", "type": 1, "description": "Enter the total number of Microsoft 365 E5, A5, F5, G5 and Microsoft 365 E5, A5, F5, G5 Security licenses in your environment", "timeContext": { "durationMs": 86400000 }, "value": "300" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters-E5Utilization" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\nlet E5Licenses = toint(\"{E5Licenses}\");\nlet FreeAllowanceMBPerDay = E5Licenses * 5;\nlet FreeAllowanceGBPerDay = round(todouble(FreeAllowanceMBPerDay) / 1000.0, 2);\n\n// =====================\n// Expected E5 tables by section\n// =====================\nlet ExpectedE5 =\n datatable(Table:string, Section:string)\n [\n \"AADManagedIdentitySignInLogs\", \"Entra/AAD\",\n \"AADNonInteractiveUserSignInLogs\", \"Entra/AAD\",\n \"AADProvisioningLogs\", \"Entra/AAD\",\n \"AADRiskyUsers\", \"Entra/AAD\",\n \"AADServicePrincipalRiskEvents\", \"Entra/AAD\",\n \"AADServicePrincipalSignInLogs\", \"Entra/AAD\",\n \"AADUserRiskEvents\", \"Entra/AAD\",\n \"ADFSSignInLogs\", \"Entra/AAD\",\n \"AuditLogs\", \"Entra/AAD\",\n \"SigninLogs\", \"Entra/AAD\",\n \"DeviceEvents\", \"MDE\",\n \"DeviceFileCertificateInfo\", \"MDE\",\n \"DeviceFileEvents\", \"MDE\",\n \"DeviceImageLoadEvents\", \"MDE\",\n \"DeviceInfo\", \"MDE\",\n \"DeviceLogonEvents\", \"MDE\",\n \"DeviceNetworkEvents\", \"MDE\",\n \"DeviceNetworkInfo\", \"MDE\",\n \"DeviceProcessEvents\", \"MDE\",\n \"DeviceRegistryEvents\", \"MDE\",\n \"IdentityDirectoryEvents\", \"MDI\",\n \"IdentityLogonEvents\", \"MDI\",\n \"IdentityQueryEvents\", \"MDI\",\n \"EmailAttachmentInfo\", \"MDO\",\n \"EmailEvents\", \"MDO\",\n \"EmailPostDeliveryEvents\", \"MDO\",\n \"EmailUrlInfo\", \"MDO\",\n \"CloudAppEvents\", \"MDA\",\n \"AlertInfo\", \"Alerts\",\n \"AlertEvidence\", \"Alerts\"\n ];\n\n// =====================\n// Actual E5 ingestion from Usage\n// =====================\nlet ActualE5 =\n Usage\n | where TimeGenerated >= ago(lookback)\n | where DataType in (\n \"AADManagedIdentitySignInLogs\", \"AADNonInteractiveUserSignInLogs\", \"AADProvisioningLogs\",\n \"AADRiskyUsers\", \"AADServicePrincipalRiskEvents\", \"AADServicePrincipalSignInLogs\",\n \"AADUserRiskEvents\", \"ADFSSignInLogs\", \"AuditLogs\", \"SigninLogs\",\n \"DeviceEvents\", \"DeviceFileCertificateInfo\", \"DeviceFileEvents\",\n \"DeviceImageLoadEvents\", \"DeviceInfo\", \"DeviceLogonEvents\",\n \"DeviceNetworkEvents\", \"DeviceNetworkInfo\", \"DeviceProcessEvents\", \"DeviceRegistryEvents\",\n \"IdentityDirectoryEvents\", \"IdentityLogonEvents\", \"IdentityQueryEvents\",\n \"EmailAttachmentInfo\", \"EmailEvents\", \"EmailPostDeliveryEvents\", \"EmailUrlInfo\",\n \"CloudAppEvents\", \"AlertInfo\", \"AlertEvidence\"\n )\n | summarize\n IngestedGB = sum(Quantity) / 1000.0,\n DaysWithData = dcount(startofday(TimeGenerated))\n by Table = DataType\n | extend\n IngestedGB = round(IngestedGB, 2),\n AvgDailyGB = round(IngestedGB / iff(DaysWithData > 0, DaysWithData, 1), 2),\n IsEnabled = true\n | project Table, IsEnabled, IngestedGB, AvgDailyGB;\n\n// =====================\n// Final: E5 benefit coverage\n// =====================\nExpectedE5\n| join kind=leftouter ActualE5 on Table\n| extend\n IsEnabled = coalesce(IsEnabled, false),\n IngestedGB = coalesce(IngestedGB, 0.0),\n AvgDailyGB = coalesce(AvgDailyGB, 0.0),\n Status = iff(IsEnabled, \"Enabled\", \"Not Enabled\"),\n ['Free Allowance (GB/Day)'] = FreeAllowanceGBPerDay\n| project\n Section,\n Table,\n Status,\n ['Ingested GB'] = IngestedGB,\n ['Average Daily (GB)'] = AvgDailyGB,\n ['Free Allowance (GB/Day)']\n| order by Section asc, Table asc", "size": 0, "title": "E5/7 Security Benefit β€” Table Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Enabled", "representation": "success", "text": "{0}" }, { "operator": "==", "thresholdValue": "Not Enabled", "representation": "error", "text": "{0}" }, { "operator": "Default", "representation": "unknown", "text": "{0}" } ] } }, { "columnMatch": "IngestedGB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "AvgDailyGB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } } ], "labelSettings": [ { "columnId": "Section", "label": "Product Area" }, { "columnId": "Table", "label": "Table" }, { "columnId": "Status", "label": "Status" } ] }, "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "customWidth": "60", "name": "e5-table-details" }, { "type": 1, "content": { "json": "## Microsoft 365 E5/7 Security Benefit\r\n\r\nOrganizations with **Microsoft 365 E5, A5, G5** or the **E5/A5/G5 Security add-on** receive a data ingestion benefit of **5 MB per user per day** for the following Sentinel tables. This benefit applies to the tables listed below when ingested through the relevant data connectors.\r\n\r\nThe tables are grouped by product area:\r\n- **Entra ID / AAD** β€” Identity logs and sign-in data\r\n- **Microsoft Defender for Endpoint (MDE)** β€” Device telemetry\r\n- **Microsoft Defender for Identity (MDI)** β€” Identity threat detection\r\n- **Microsoft Defender for Office 365 (MDO)** β€” Email security\r\n- **Microsoft Defender for Cloud Apps (MDA)** β€” Cloud app monitoring\r\n- **Alert tables** β€” Alert metadata and evidence from Defender XDR\r\n\r\n> πŸ“– [Microsoft Sentinel benefit for Microsoft 365 E5 customers](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#microsoft-365-e5-a5-f5-and-g5-customers)\r\n>\r\n> πŸ“– [Tables eligible for the E5 benefit](https://learn.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration#tables-eligible-for-the-microsoft-365-e5-benefit)" }, "customWidth": "40", "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\nlet E5Licenses = toint(\"{E5Licenses}\");\nlet FreeAllowanceGBPerDay = round(todouble(E5Licenses * 5) / 1000.0, 2);\n\n// =====================\n// E5 tables in scope\n// =====================\nlet E5Tables = dynamic([\n \"AADManagedIdentitySignInLogs\", \"AADNonInteractiveUserSignInLogs\", \"AADProvisioningLogs\",\n \"AADRiskyUsers\", \"AADServicePrincipalRiskEvents\", \"AADServicePrincipalSignInLogs\",\n \"AADUserRiskEvents\", \"ADFSSignInLogs\", \"AuditLogs\", \"SigninLogs\",\n \"DeviceEvents\", \"DeviceFileCertificateInfo\", \"DeviceFileEvents\",\n \"DeviceImageLoadEvents\", \"DeviceInfo\", \"DeviceLogonEvents\",\n \"DeviceNetworkEvents\", \"DeviceNetworkInfo\", \"DeviceProcessEvents\", \"DeviceRegistryEvents\",\n \"IdentityDirectoryEvents\", \"IdentityLogonEvents\", \"IdentityQueryEvents\",\n \"EmailAttachmentInfo\", \"EmailEvents\", \"EmailPostDeliveryEvents\", \"EmailUrlInfo\",\n \"CloudAppEvents\", \"AlertInfo\", \"AlertEvidence\"\n]);\n\n// =====================\n// Daily E5 ingestion from Usage\n// =====================\nlet DailyE5Ingestion =\n Usage\n | where TimeGenerated >= ago(lookback)\n | where DataType in (E5Tables)\n | summarize DailyGB = sum(Quantity) / 1000.0 by Day = startofday(TimeGenerated)\n | project Day, DailyGB = round(DailyGB, 2);\n\n// =====================\n// Final: E5 allowance vs ingestion\n// =====================\nDailyE5Ingestion\n| summarize\n ['Avg Daily Ingestion (GB)'] = round(avg(DailyGB), 2),\n ['Max Daily Ingestion (GB)'] = round(max(DailyGB), 2)\n| extend\n ['E5 Daily Allowance (GB)'] = FreeAllowanceGBPerDay,\n ['Daily Overage (GB)'] = round(\n iff(['Avg Daily Ingestion (GB)'] > FreeAllowanceGBPerDay, ['Avg Daily Ingestion (GB)'] - FreeAllowanceGBPerDay, 0.0),\n 2\n ),\n ['Coverage Status'] = iff(['Avg Daily Ingestion (GB)'] <= FreeAllowanceGBPerDay, \"Fully covered\", \"Overage detected\")\n| project\n ['Avg Daily Ingestion (GB)'],\n ['Max Daily Ingestion (GB)'],\n ['E5 Daily Allowance (GB)'],\n ['Daily Overage (GB)'],\n ['Coverage Status']", "size": 4, "title": "E5/7 Benefit β€” Daily Allowance vs Actual Ingestion", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Avg Daily Ingestion", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Max Daily Ingestion", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "E5 Daily Allowance", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Daily Overage", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Coverage Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Fully covered", "representation": "success", "text": "{0}" }, { "operator": "==", "thresholdValue": "Overage detected", "representation": "warning", "text": "{0}" }, { "operator": "Default", "representation": "unknown", "text": "{0}" } ] } } ] } }, "name": "e5-allowance-summary" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyIngestion = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yyyy-MM-dd') \r\n| extend MaxDataGrant = ((5*toreal({E5Licenses}))/1000)\r\n| sort by TimeGenerated asc\r\n", "size": 1, "aggregation": 3, "title": "E5/7 eligible data ingestion vs Max data grant:, from: {TimeRange:label} data", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "formatters": [ { "columnMatch": "IsBillable", "formatter": 5 }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 4, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ] }, "chartSettings": { "xAxis": "TimeGenerated", "seriesLabelSettings": [ { "seriesName": "DailyIngestionGB", "color": "blueDark" }, { "seriesName": "MaxDataGrantGB", "color": "orange" } ], "showDataPoints": true, "ySettings": { "numberFormatSettings": { "unit": 39, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "customWidth": "95", "conditionalVisibility": { "parameterName": "E5Licenses", "comparison": "isNotEqualTo" }, "name": "queryDailyE5IngestionAllocation" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DailyMaxDiscountGB = ((5*toreal({E5Licenses}))/1000);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| extend DailyMaxGrantGB = DailyMaxDiscountGB\r\n| summarize MaxDataGrantGB = sum(toreal(DailyMaxGrantGB))\r\n\r\n", "size": 4, "title": "Total E5/7 Data Grant Limit, {TimeRange:label}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "MaxDataGrantGB", "formatter": 12, "formatOptions": { "palette": "orangeBlue" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "35", "conditionalVisibility": { "parameterName": "E5Licenses", "comparison": "isNotEqualTo" }, "name": "queryE5DataGrantLimit" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DailyMaxDiscountGB = ((5*toreal({E5Licenses}))/1000);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| summarize TotalEligibleGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB))\r\n\r\n\r\n", "size": 4, "title": "Total E5/7 Data Grant Used, {TimeRange:label}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "billedData", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "TotalEligibleGB", "formatter": 12, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "35", "conditionalVisibility": { "parameterName": "E5Licenses", "comparison": "isNotEqualTo" }, "name": "queryTotalEligibleE5Ingestion" } ] }, "customWidth": "70", "name": "groupE5Ingestion" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a1b2c3d4-0001-0001-0001-000000000005", "version": "KqlParameterItem/1.0", "name": "DfSP2VMs", "label": "Number of Defender for Servers P2 VMs", "type": 1, "value": "1", "typeSettings": { "paramValidationRules": [ { "regExp": "^[0-9]+$", "match": true, "message": "Please enter a valid number" } ] } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\n\n// =====================\n// Defender for Servers P2 tables\n// =====================\nlet DfSP2Tables = dynamic([\n \"SecurityAlert\",\n \"SecurityBaseline\",\n \"SecurityBaselineSummary\",\n \"SecurityDetection\",\n \"SecurityEvent\",\n \"WindowsFirewall\",\n \"ProtectionStatus\",\n \"Update\",\n \"UpdateSummary\",\n \"MDCFileIntegrityMonitoringEvents\",\n \"WindowsEvent\"\n]);\n\n// =====================\n// Expected Defender for Servers P2 tables\n// =====================\nlet ExpectedDfS =\n datatable(Table:string, Description:string)\n [\n \"SecurityAlert\", \"Security alerts (also free tier - always free)\",\n \"SecurityBaseline\", \"Security baseline assessment results\",\n \"SecurityBaselineSummary\", \"Security baseline summary\",\n \"SecurityDetection\", \"Security detections\",\n \"SecurityEvent\", \"Windows Security Events (MMA/AMA)\",\n \"WindowsFirewall\", \"Windows Firewall events\",\n \"ProtectionStatus\", \"Antimalware protection status\",\n \"Update\", \"Update assessment (when Update Mgmt not running)\",\n \"UpdateSummary\", \"Update assessment summary (when Update Mgmt not running)\",\n \"MDCFileIntegrityMonitoringEvents\", \"File Integrity Monitoring events\",\n \"WindowsEvent\", \"Windows Events (AMA new format)\"\n ];\n\n// =====================\n// Actual Defender for Servers P2 ingestion from Usage\n// =====================\nlet ActualDfS =\n Usage\n | where TimeGenerated >= ago(lookback)\n | where DataType in (DfSP2Tables)\n | summarize\n IngestedGB = sum(Quantity) / 1000.0,\n DaysWithData = dcount(startofday(TimeGenerated))\n by Table = DataType\n | extend\n IngestedGB = round(IngestedGB, 2),\n AvgDailyGB = round(IngestedGB / iff(DaysWithData > 0, DaysWithData, 1), 2),\n IsEnabled = true\n | project Table, IsEnabled, IngestedGB, AvgDailyGB;\n\n// =====================\n// Final: Defender for Servers P2 coverage\n// =====================\nExpectedDfS\n| join kind=leftouter ActualDfS on Table\n| extend\n IsEnabled = coalesce(IsEnabled, false),\n IngestedGB = coalesce(IngestedGB, 0.0),\n AvgDailyGB = coalesce(AvgDailyGB, 0.0),\n Status = iff(IsEnabled, \"Enabled\", \"Not Enabled\")\n| project\n Table,\n Description,\n Status,\n ['Ingested GB'] = IngestedGB,\n ['Average Daily (GB)'] = AvgDailyGB\n| order by Table asc", "size": 0, "title": "Defender for Servers P2 β€” Table Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Enabled", "representation": "success", "text": "{0}" }, { "operator": "==", "thresholdValue": "Not Enabled", "representation": "error", "text": "{0}" }, { "operator": "Default", "representation": "unknown", "text": "{0}" } ] } }, { "columnMatch": "IngestedGB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "AvgDailyGB", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } } ], "labelSettings": [ { "columnId": "Table", "label": "Table" }, { "columnId": "Description", "label": "Description" }, { "columnId": "Status", "label": "Status" } ] } }, "customWidth": "50", "name": "dfsp2-table-details" }, { "type": 1, "content": { "json": "---\r\n## Defender for Servers Plan 2 Benefit\r\n\r\nMachines protected by **Microsoft Defender for Servers Plan 2** receive a combined data ingestion benefit of **500 MB per VM per day** across all the following security data types. The allowance is the total across all VMs and applies to the sum of all tables below.\r\n\r\n| Table | Description |\r\n|---|---|\r\n| SecurityAlert | Security alerts generated by Defender for Servers |\r\n| SecurityBaseline | Security baseline assessment results |\r\n| SecurityBaselineSummary | Summary of security baseline assessments |\r\n| SecurityDetection | Security detections |\r\n| SecurityEvent | Windows Security Events collected via AMA or MMA |\r\n| WindowsFirewall | Windows Firewall events |\r\n| ProtectionStatus | Antimalware protection status |\r\n| Update | Update assessment results (when Update Management solution is not running or solution targeting is enabled) |\r\n| UpdateSummary | Update assessment summary (when Update Management solution is not running or solution targeting is enabled) |\r\n| MDCFileIntegrityMonitoringEvents | File Integrity Monitoring events from Defender for Cloud |\r\n| WindowsEvent | Windows Events collected via AMA (new format) |\r\n\r\nNote: SecurityAlert is also part of the free tier and is always free regardless of P2.\r\n\r\n> πŸ“– [Defender for Servers data ingestion benefit](https://learn.microsoft.com/azure/defender-for-cloud/faq-defender-for-servers#is-the-500-mb-of-free-data-ingestion-allowance-applied-to-an-entire-workspace-or-strictly-per-machine-)\r\n>\r\n> πŸ“– [Connect Windows security events to Sentinel](https://learn.microsoft.com/azure/sentinel/connect-windows-security-events)" }, "customWidth": "50", "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\nlet DfSP2VMs = toint(\"{DfSP2VMs}\");\nlet FreeAllowanceGBPerDay = round(todouble(DfSP2VMs * 500) / 1000.0, 2);\n\n// =====================\n// Defender for Servers P2 tables in scope\n// =====================\nlet DfSP2Tables = dynamic([\n \"SecurityAlert\",\n \"SecurityBaseline\",\n \"SecurityBaselineSummary\",\n \"SecurityDetection\",\n \"SecurityEvent\",\n \"WindowsFirewall\",\n \"ProtectionStatus\",\n \"Update\",\n \"UpdateSummary\",\n \"MDCFileIntegrityMonitoringEvents\",\n \"WindowsEvent\"\n]);\n\n// =====================\n// Daily Defender for Servers P2 ingestion from Usage\n// =====================\nlet DailyDfSP2Ingestion =\n Usage\n | where TimeGenerated >= ago(lookback)\n | where DataType in (DfSP2Tables)\n | summarize DailyGB = sum(Quantity) / 1000.0 by Day = startofday(TimeGenerated)\n | project Day, DailyGB = round(DailyGB, 2);\n\n// =====================\n// Final: Defender for Servers P2 allowance vs ingestion\n// =====================\nDailyDfSP2Ingestion\n| summarize\n ['Avg Daily Ingestion (GB)'] = round(avg(DailyGB), 2),\n ['Max Daily Ingestion (GB)'] = round(max(DailyGB), 2)\n| extend\n ['P2 Daily Allowance (GB)'] = FreeAllowanceGBPerDay,\n ['Daily Overage (GB)'] = round(\n iff(['Avg Daily Ingestion (GB)'] > FreeAllowanceGBPerDay, ['Avg Daily Ingestion (GB)'] - FreeAllowanceGBPerDay, 0.0),\n 2\n ),\n ['Coverage Status'] = iff(['Avg Daily Ingestion (GB)'] <= FreeAllowanceGBPerDay, \"Fully covered\", \"Overage detected\")\n| project\n ['Avg Daily Ingestion (GB)'],\n ['Max Daily Ingestion (GB)'],\n ['P2 Daily Allowance (GB)'],\n ['Daily Overage (GB)'],\n ['Coverage Status']", "size": 0, "title": "P2 Benefit β€” Daily Allowance vs Actual Ingestion", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Avg Daily Ingestion", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Max Daily Ingestion", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "P2 Daily Allowance", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Daily Overage", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumFractionDigits": 2, "maximumFractionDigits": 4 } } }, { "columnMatch": "Coverage Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Fully covered", "representation": "success", "text": "{0}" }, { "operator": "==", "thresholdValue": "Overage detected", "representation": "warning", "text": "{0}" }, { "operator": "Default", "representation": "unknown", "text": "{0}" } ] } } ] } }, "name": "dfsp2-allowance-summary" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "e5" }, "name": "group-E5Utilization", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "CEF Usage", "items": [ { "type": 1, "content": { "json": "## CommonSecurityLog (CEF) Insights\r\n- - - " }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where _IsBillable == true\r\n| summarize count(), sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} , ProductCount=dcount(DeviceProduct), ProductList=make_set(DeviceProduct) by DeviceVendor\r\n| order by sum__BilledSize desc\r\n", "size": 0, "aggregation": 3, "title": "CEF DeviceVendor, count of activity and BilledSize", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "sum__BilledSize", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "ProductCount", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "23ch" } }, { "columnMatch": "gb", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "MBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "sortBy": [ { "itemKey": "DeviceVendor", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "count_", "label": "Count" }, { "columnId": "sum__BilledSize", "label": "BilledSize" } ] }, "sortBy": [ { "itemKey": "DeviceVendor", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "DeviceVendor", "formatter": 1 }, "leftContent": { "columnMatch": "gb", "formatter": 1, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "BilledSize" } }, "secondaryContent": { "columnMatch": "estimatedPrice", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 18, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Estimated Cost" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - CEF chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where _IsBillable == true\r\n| summarize count(LogSeverity),sum(_BilledSize) by LogSeverity \r\n| join (CommonSecurityLog\r\n | make-series Trend = count(LogSeverity) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by LogSeverity\r\n) on LogSeverity\r\n//| extend LogSeverity = round(tolong(LogSeverity),2)\r\n| order by LogSeverity asc\r\n", "size": 0, "title": "CEF count by Severity, BilledSize and Trend", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "is Empty", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] }, "tooltipFormat": { "tooltip": "Log Severity Value" } }, "subtitleContent": { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "BilledSize" } }, "leftContent": { "columnMatch": "count_LogSeverity", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "" } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "green" } }, "showBorder": false } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where _IsBillable == true\r\n// add price column \r\n| summarize sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} by DeviceVendor, DeviceName, DeviceProduct\r\n| order by DeviceVendor asc\r\n// add cost by facility \r\n", "size": 1, "aggregation": 3, "title": "Data by CEF Vendors, from: {TimeRange:label} , count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DeviceName", "formatter": 5 }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 3 } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "DeviceVendor" ], "expandTopLevel": true }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 2 } ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "xSettings": {}, "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - CEF chart - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where _IsBillable == true\r\n| summarize count(), sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} by DeviceEventClassID, DeviceVendor, DeviceName, DeviceProduct, LogSeverity\r\n| order by sum__BilledSize, estimatedPrice desc\r\n", "size": 1, "aggregation": 3, "title": "Data by CEF Vendors, from: {TimeRange:label} , filter by DeviceEventClassID, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "DeviceVendor" ], "expandTopLevel": true } }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "xSettings": {}, "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - CEF DeviceEventClassID" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| summarize dcount(DeviceEventClassID), sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} by DeviceVendor, SourceIP, DestinationIP, _ResourceId\r\n", "size": 1, "title": "CEF: data set - {TimeRange:label}, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "_ResourceId", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "BilledSize", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "expectedEventCounts", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "Score", "formatter": 8, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "10ch" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "pink" } }, { "columnMatch": "baseline", "formatter": 21, "formatOptions": { "palette": "purple" } }, { "columnMatch": "anomalies", "formatter": 10, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "EventID", "formatter": 5 }, { "columnMatch": "TimeGenerated", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "labelSettings": [ { "columnId": "dcount_DeviceEventClassID", "label": "Count of unique ClassIDs", "comment": "DeviceEventClassIDs" }, { "columnId": "sum__BilledSize", "label": "BilledSize" }, { "columnId": "estimatedPrice", "label": "Estimated Price" } ] }, "sortBy": [], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "EventID", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "EventID", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Activity", "sourceIdField": "Activity", "targetIdField": "EventID", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "GBytes", "type": 1, "colorPalette": "cool" }, "hivesMargin": 5 } }, "name": "query - CEF events" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "cef" }, "name": "group - CEF" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Syslog Usage", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where _IsBillable == true\r\n| summarize count(), sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} by Facility\r\n| order by count_ desc\r\n", "size": 0, "title": "Syslog Facility, count of activity and BilledSize", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "sum__BilledSize", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } } ], "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Count" }, { "columnId": "sum__BilledSize", "label": "BilledSize" } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where _IsBillable == true\r\n| summarize count(SeverityLevel), sum(_BilledSize) by SeverityLevel \r\n| join (Syslog\r\n | make-series Trend = count(SeverityLevel) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeverityLevel\r\n) on SeverityLevel\r\n", "size": 0, "title": "Syslog count by Severity, BilledSize and Trend", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "sum__BilledSize", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SeverityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "info", "representation": "1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "warn", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "notice", "representation": "Important", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "err", "representation": "error", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "alert", "representation": "warning", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] }, "tooltipFormat": {} }, "subtitleContent": { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "BilledSize" } }, "leftContent": { "columnMatch": "count_SeverityLevel", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "Count" } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "blue" }, "tooltipFormat": { "tooltip": "Trend" } }, "showBorder": false } }, "customWidth": "50", "name": "query - 0 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where _IsBillable == true\r\n| summarize sum(_BilledSize), estimatedPrice = sum(_BilledSize)/(1024*1024*1024) * {Price} by HostName, SeverityLevel, Facility, SyslogMessage, ProcessName\r\n| order by sum__BilledSize desc ", "size": 0, "title": "Syslog by Hostname: detailed view", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SeverityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "warn", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "info", "representation": "info", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "err", "representation": "error", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "alert", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "notice", "representation": "Normal", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "sum__BilledSize", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "estimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ], "rowLimit": 500, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "HostName", "Facility" ] }, "labelSettings": [ { "columnId": "sum__BilledSize", "label": "BilledSize" } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SeverityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "info", "representation": "1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "warn", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "notice", "representation": "Important", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "err", "representation": "error", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "alert", "representation": "warning", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] }, "tooltipFormat": {} }, "subtitleContent": { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "BilledSize" } }, "leftContent": { "columnMatch": "count_SeverityLevel", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } }, "tooltipFormat": { "tooltip": "Count" } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "blue" }, "tooltipFormat": { "tooltip": "Trend" } }, "showBorder": false } }, "name": "query - 0 - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "syslog" }, "name": "group - syslog" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Cost Overview", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 0, "title": "Retention and Plan details for All Tables", "showRefreshButton": true, "showExportToExcel": true, "queryType": 12, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "text": "Auxiliary/data lake" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } } ], "rowLimit": 1000, "filter": true, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "TableRetentionQuery" }, { "type": 1, "content": { "json": "Manually enter data lake procing (GB per day) from https://www.microsoft.com/security/pricing/microsoft-sentinel/" }, "name": "text - 22" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "datalakeIngestionUSD", "type": 1, "value": "5", "label": "data lake Ingestion (GB)", "id": "5c147664-ee01-492c-a033-df02cb7a6869" }, { "version": "KqlParameterItem/1.0", "name": "datalakeProcessingUSD", "type": 1, "value": "0.1", "label": "data lake processing (GB)", "id": "3c33d3c7-9e45-4839-a9f2-261b6a6f2705" }, { "id": "9f3ce670-960a-4d26-9157-9eefcdf4385b", "version": "KqlParameterItem/1.0", "name": "datalakeStorageUSD", "label": "data lake storage (GB)", "type": 1, "description": "This value will be DIVIDED by 6 ", "value": "0.026" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "50", "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| summarize ['Table Size'] =sum(Quantity)/1000 by ['Table Name'] =DataType,['IsBillable'] =IsBillable\r\n\r\n| extend AnalyticsCharge = ['Table Size'] * {Price},\r\n datalakeprocessingCharge = round(['Table Size'] * {datalakeProcessingUSD},4),\r\n datalakeIngestion = round(['Table Size'] * {datalakeIngestionUSD},4),\r\n datalakeStorage = round(['Table Size'] * {datalakeStorageUSD}/6 ,4) // divide by 6 to add compression factor \r\n//| extend estimatedCost = iif(['Table Name']=~'ConditionalAccessPolicies_CL',strcat(tostring( datalakeprocessingCharge + datalakeIngestion + datalakeStorage ), ' (USD)') ,tostring(estimatedCost)) \r\n| order by ['Table Size'] desc", "size": 0, "showAnalytics": true, "title": "{Workspace:name} Status for {TimeRange:label}, Billable Tables have an average use of: {GBperday} GB per day, Billable Tables have a Total size of {GBtotal} GB", "exportedParameters": [ { "fieldName": "Table Name", "parameterName": "Table", "defaultValue": "All Tables" }, { "fieldName": "Table Name", "parameterName": "Table1", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "green", "text": "True" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "AnalyticsCharge", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_2", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Defender" }, "name": "query - 2 -basic Table " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\",\"mergeType\":\"innerunique\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"query - 2 -basic Table \",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table Name\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[query - 2 -basic Table ].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[query - 2 -basic Table ].Table Size\",\"mergedName\":\"Table Size\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[query - 2 -basic Table ].AnalyticsCharge\",\"mergedName\":\"AnalyticsCharge\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 2 -basic Table ].AnalyticsUSD\",\"mergedName\":\"AnalyticsUSD\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 2 -basic Table ].datalakeprocessingCharge\",\"mergedName\":\"datalakeprocessingCharge\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 2 -basic Table ].datalakeIngestion\",\"mergedName\":\"datalakeIngestion\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 2 -basic Table ].datalakeStorage\",\"mergedName\":\"datalakeStorage\",\"fromId\":\"unknown\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"TableInteractivePeriod\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"TableArchivePeriod\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetentionPeriod\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[query - 2 -basic Table ].Table Name\",\"mergedName\":\"Table Name\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c5f9\"},{\"originalName\":\"[query - 2 -basic Table ].Table Name\"}]}", "size": 0, "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "green", "text": "True" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "False" } ] } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "246px" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "TableType", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Microsoft", "representation": "amethyst", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "representation": null, "text": "Auxiliary/data lake" }, { "operator": "!=", "thresholdValue": "Auxiliary", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, { "columnMatch": "AnalyticsCharge", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "datalakeprocessingCharge", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "sourceColumn": "TablePlan", "operator": "==", "thresholdValue": "Analytics", "representation": "Blank", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "datalakeIngestion", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "sourceColumn": "TablePlan", "operator": "==", "thresholdValue": "Analytics", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "datalakeStorage", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "sourceColumn": "TablePlan", "operator": "==", "thresholdValue": "Analytics", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 4 } } }, { "columnMatch": "AnalyticsUSD", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "sourceColumn": "TablePlan", "operator": "!=", "thresholdValue": "Analytics", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } } ], "rowLimit": 1000, "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_2", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "showPin": false, "name": "query - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"ee0c7894-ecb7-4b92-81b2-4424f545c604\",\"mergeType\":\"table\",\"leftTable\":\"query - 19\"}],\"projectRename\":[{\"originalName\":\"[query - 19].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c604\"},{\"originalName\":\"[query - 19].Table Size\",\"mergedName\":\"Table Size\",\"fromId\":\"ee0c7894-ecb7-4b92-81b2-4424f545c604\"},{\"originalName\":\"[query - 19].datalakeprocessingCharge\",\"mergedName\":\"datalakeprocessingCharge\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].datalakeIngestion\",\"mergedName\":\"datalakeIngestion\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].datalakeStorage\",\"mergedName\":\"datalakeStorage\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].AnalyticsUSD\",\"mergedName\":\"AnalyticsUSD\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].AnalyticsCharge\",\"mergedName\":\"AnalyticsCharge\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].Table Name\",\"mergedName\":\"Table Name\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 19].TableName\"},{\"originalName\":\"[query - 19].IsBillable\"},{\"originalName\":\"[query - 19].TableType\"},{\"originalName\":\"[query - 19].TableInteractivePeriod\"},{\"originalName\":\"[query - 19].TotalRetentionPeriod\"},{\"originalName\":\"[query - 19].lastPlanModifiedDate\"},{\"originalName\":\"[query - 19].TableArchivePeriod\"}]}", "size": 1, "title": "{Workspace:name} split by Tier", "queryType": 7, "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "text": "Auxiliary/data lake" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } } ], "sortBy": [ { "itemKey": "$gen_thresholds_TablePlan_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_TablePlan_1", "sortOrder": 2 } ], "chartSettings": { "yAxis": [ "Table Size" ], "group": "TablePlan", "createOtherGroup": null, "seriesLabelSettings": [ { "seriesName": "Auxiliary", "label": "Auxiliary/data lake" } ], "ySettings": { "numberFormatSettings": { "unit": 39, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 3 } } } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "showPin": false, "name": "query - Tier pie chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n// main logic \r\nunion withsource=TableName1 *\r\n| where TimeGenerated > ago(30d)\r\n| summarize Entries = count(), Size = sumif(_BilledSize, _IsBillable==true), last_log = datetime_diff(\"second\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by TableName1, _IsBillable\r\n| project ['Table Name'] = TableName1, ['Table Size'] = Size , ['% of Total GB'] = (Size /(1024*1024*1024)) / {GBtotal} * 100,['IsBillable'] = _IsBillable, ['Last Record Received'] = last_log , ['Estimated Table Price'] = (estimate/(1024*1024*1024)) * {Price}\r\n\r\n\r\n\r\n ", "size": 0, "showAnalytics": true, "title": "{Workspace:name} Details for 30days, total: {GBtotal} GB. Click a row to see connector and solution info", "timeContextFromParameter": "TimeRange", "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "coldHot" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "%", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "15ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2, "maximumSignificantDigits": 2 } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Last Record Received", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Size per Entry", "formatter": 3, "formatOptions": { "min": 0, "palette": "orange" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Table Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "Table Size", "label": "", "comment": "Capacity of the Table" }, { "columnId": "IsBillable", "comment": "Is the Table Free or Billable?" }, { "columnId": "Last Record Received", "comment": "When did the last record arrive?" } ] }, "sortBy": [ { "itemKey": "$gen_bar_Table Size_1", "sortOrder": 2 } ] }, "customWidth": "75", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\"Table\",\"solution_name\",\"solution_folder\",\"solution_publisher_id\",\"solution_offer_id\",\"solution_first_publish_date\",\"solution_last_publish_date\",\"solution_version\",\"solution_support_name\",\"solution_support_tier\",\"solution_support_link\",\"solution_author_name\",\"solution_categories\",\"connector_id\",\"connector_publisher\",\"connector_title\",\"connector_description\",\"connector_instruction_steps\",\"connector_permissions\",\"connector_files\",\"is_unique\"\r\nlet list_ = \r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n// Main query: show tables found OR not found\r\nlist_\r\n| join kind=leftouter (\r\n Usage\r\n | distinct Table = DataType\r\n | extend found_ = true\r\n) on Table\r\n| extend found_ = coalesce(found_, false)\r\n| where Table == '{Table}' \r\n| summarize solution_Name= array_sort_asc(make_set(solution_Name)), connector_id=array_sort_asc(make_set(connector_id)) by Table\r\n//| project Table, found_, connector_id, connector_title, solution_Name, solution_Folder\r\n| order by Table asc", "size": 0, "title": "Display Connector and Solution data for: {Table}", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "sortBy": [] }, "conditionalVisibility": { "parameterName": "Table1", "comparison": "isNotEqualTo" }, "name": "query - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| extend IsBillable = iif(IsBillable == True,\"Billable\",\"Free\")\r\n| summarize sum(Quantity) by IsBillable\r\n\r\n\r\n ", "size": 1, "showAnalytics": true, "title": "{Workspace:name} Data use % {selectDepthLevel}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "coldHot" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Size per Entry", "formatter": 3, "formatOptions": { "min": 0, "palette": "orange" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "blueDark", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Last Record Received", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "Estimated Table Price", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" } } ], "filter": true }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "True", "label": "Billable" }, { "seriesName": "False", "label": "Free" } ], "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 2 } } } } }, "customWidth": "25", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| summarize sum(Quantity) by tostring(IsBillable) ", "size": 1, "showAnalytics": true, "title": "{Workspace:name} Data use % ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Table Name", "exportParameterName": "Table", "exportDefaultValue": "All Tables", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "sum_Quantity", "formatter": 0, "numberFormat": { "unit": 38, "options": { "style": "decimal", "useGrouping": false } } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "IsBillable" }, "leftContent": { "columnMatch": "sum_Quantity", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "True", "label": "Billable" }, { "seriesName": "False", "label": "Free" } ], "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 2 } } } } }, "customWidth": "25", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "name": "query - 2 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// Forecast billable data volume for the next 90 days\r\n//\r\nlet ForecastDays = 90;\r\nlet StartDate = {TimeRange:start};\r\nlet EndDate = now();\r\nlet ForecastEndDate = EndDate + ForecastDays * 1d;\r\nUsage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == true\r\n| summarize GBytes = sum(Quantity) by bin(TimeGenerated, 1d)\r\n| make-series GBytesActual = sum(GBytes) default=0\r\n on TimeGenerated\r\n from StartDate to ForecastEndDate\r\n step 1d\r\n| extend GBytesForecast = series_decompose_forecast(GBytesActual, ForecastDays)\r\n| mv-expand\r\n TimeGenerated to typeof(datetime),\r\n GBytesActual to typeof(real),\r\n GBytesForecast to typeof(real)\r\n| extend\r\n Type = iff(TimeGenerated <= EndDate, \"Actual\", \"Forecast\"),\r\n GBytesActual = iff(TimeGenerated <= EndDate, GBytesActual, real(null)),\r\n GBytesForecast = iff(TimeGenerated > EndDate, GBytesForecast, real(null))\r\n| project\r\n TimeGenerated,\r\n Type,\r\n GBytesActual = round(GBytesActual, 2),\r\n GBytesForecast = round(GBytesForecast, 2)\r\n| order by TimeGenerated asc", "size": 0, "aggregation": 5, "showAnnotations": true, "title": "Actual Data Volume vs. 90 day Prediction. Data from: {TimeRange:label}. Minimum 30days suggested, ideally 90days ", "exportFieldName": "y", "exportParameterName": "yAxis", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "GBytesToday", "color": "blueDark" }, { "seriesName": "GBytesForecast", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 38, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 3 } } } } }, "name": "query - 20 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// Predict billable data volume and estimated cost for the next 90 days\r\n//\r\nlet ForecastDays = 90;\r\nlet StartDate = {TimeRange:start};\r\nlet EndDate = now();\r\nlet ForecastEndDate = EndDate + ForecastDays * 1d;\r\nlet PricePerGB = todouble({Price});\r\nUsage\r\n| where TimeGenerated between (StartDate .. EndDate)\r\n| where IsBillable == true\r\n| summarize GBytes = sum(Quantity) / 1000.0 by bin(TimeGenerated, 1d)\r\n| make-series GBytesActual = sum(GBytes) default=0\r\n on TimeGenerated\r\n from StartDate to ForecastEndDate\r\n step 1d\r\n| extend GBytesForecast = series_decompose_forecast(GBytesActual, ForecastDays)\r\n| extend\r\n TodayVolumeGB = todouble(GBytesActual[array_length(GBytesActual) - ForecastDays - 1]),\r\n ForecastVolumeGB = todouble(GBytesForecast[array_length(GBytesForecast) - 1])\r\n| extend\r\n PriceToday = round(TodayVolumeGB * PricePerGB, 2),\r\n PricePrediction = round(ForecastVolumeGB * PricePerGB, 2),\r\n TodayVolumeGB = round(TodayVolumeGB, 2),\r\n ForecastVolumeGB = round(ForecastVolumeGB, 2)\r\n| project\r\n PriceToday,\r\n PricePrediction,\r\n TodayVolumeGB,\r\n ForecastVolumeGB", "size": 4, "title": "Predict billable data volume and estimated cost for the next 90 days", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "priceToday", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "pricePrediction", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "todayVolume", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "predictionVolume", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "UserSelectedAxis", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "GBytesToday", "color": "blueDark" }, { "seriesName": "GBytesForecast", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 5, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "69", "name": "query - Price Predict" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "print volume = {yAxis}, price = {yAxis} * {Price}", "size": 4, "title": "User selected Y-Axis details. ", "noDataMessage": "Please click on a point on the trend line in the graph above.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "volume", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "price", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } } ] } }, "customWidth": "29", "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where TimeGenerated between (startofmonth(now(), -3) .. endofmonth(now(), -1))\r\n| summarize\r\n TotalGB = round(sum(Quantity) / 1000.0, 2),\r\n BillableGB = round(sumif(Quantity, IsBillable == true) / 1000.0, 2),\r\n FreeGB = round(sumif(Quantity, IsBillable == false) / 1000.0, 2)\r\n by MonthStart = startofmonth(TimeGenerated)\r\n| extend\r\n Month = format_datetime(MonthStart, \"yyyy-MM\"),\r\n EstimatedCost = round(BillableGB * todouble('{Price}'), 2)\r\n| project\r\n Month,\r\n // EstimatedCost,\r\n TotalGB,\r\n BillableGB,\r\n FreeGB\r\n| order by Month asc", "size": 0, "title": "Month on Month report - Data Volume", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "categoricalbar", "chartSettings": { "customThresholdLine": "50", "customThresholdLineStyle": 3, "ySettings": { "numberFormatSettings": { "unit": 39, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - monthly history" }, { "type": 1, "content": { "json": "⚠️ Identifies tables with significant deviations in billed ingestion volume over the last **90 days** using time-series anomaly detection. \r\nResults are ranked by anomaly severity and highlight tables experiencing unusual increases or decreases compared to their historical baseline.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 9 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 90d;\r\nlet MinStrongScore = 3.0;\r\nunion withsource = TableName1 *\r\n| where TimeGenerated >= ago(Lookback)\r\n| summarize BilledGB = sum(_BilledSize) / 1024 / 1024 / 1024\r\n by TableName1, bin(TimeGenerated, 1d)\r\n| make-series Trend = sum(BilledGB) default=0\r\n on TimeGenerated\r\n from ago(Lookback) to now()\r\n step 1d\r\n by TableName1\r\n| extend (AnomalyFlagSeries, ScoreSeries, Baseline) =\r\n series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n| extend\r\n AnomalyFlag = toint(AnomalyFlagSeries[-1]),\r\n Score = todouble(ScoreSeries[-1]),\r\n ExpectedGB = round(todouble(Baseline[-1]), 2),\r\n ActualGB = round(todouble(Trend[-1]), 2)\r\n| where AnomalyFlag in (1, -1)\r\n| where abs(Score) >= MinStrongScore\r\n| extend\r\n Direction = iff(Score > 0, \"Increase\", \"Decrease\"),\r\n DeltaGB = round(ActualGB - ExpectedGB, 2),\r\n DeltaPercent = iff(ExpectedGB == 0.0, real(null), round((ActualGB - ExpectedGB) * 100.0 / ExpectedGB, 1))\r\n| extend TrendIndicator =\r\n case(\r\n Score >= 8, \"🚨 Major Increase\",\r\n Score >= 5, \"πŸ”₯ Large Increase\",\r\n Score >= 3, \"πŸ“ˆ Increase\",\r\n Score <= -8, \"🚨 Major Decrease\",\r\n Score <= -5, \"❄️ Large Decrease\",\r\n Score <= -3, \"πŸ“‰ Decrease\",\r\n \"βž– Normal\"\r\n )\r\n| project\r\n TableName=TableName1,\r\n TrendIndicator,\r\n Score = round(Score, 2),\r\n ExpectedGB,\r\n ActualGB,\r\n DeltaGB,\r\n DeltaPercent,\r\n Trend,\r\n Baseline\r\n| order by abs(Score) desc", "size": 1, "title": "BilledSize Anomalies: 90day, fixed look back period. anomaly-detection: Strong", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "expectedCounts", "formatter": 0, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "actualCount", "formatter": 0, "numberFormat": { "unit": 36, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Score", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } }, "tooltipFormat": { "tooltip": " Anomaly scores above 3.0 or below -3.0 indicate a strong anomaly" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "pink" } }, { "columnMatch": "Baseline", "formatter": 21, "formatOptions": { "palette": "purple" } } ], "filter": true }, "sortBy": [] }, "customWidth": "75", "name": "query - billedSize Anomalies" }, { "type": 1, "content": { "json": "# πŸ“Š BilledSize Anomalies\r\n\r\nDetects tables whose billed ingestion volume has significantly deviated from expected behaviour over the last **90 days**.\r\n\r\n## Overview\r\n\r\n| Metric | Description |\r\n| ---------------- | ------------------------------ |\r\n| Lookback Period | 90 Days |\r\n| Data Source | `_BilledSize` |\r\n| Detection Method | `series_decompose_anomalies()` |\r\n| Baseline | Historical trend analysis |\r\n| Threshold | Anomaly Score β‰₯ Β±3 |\r\n\r\n## Column Reference\r\n\r\n| Column | Meaning |\r\n| -------------- | --------------------------------- |\r\n| TableName | Log Analytics table |\r\n| TrendIndicator | Severity and direction of anomaly |\r\n| Score | Statistical anomaly score |\r\n| ExpectedGB | Predicted ingestion volume |\r\n| ActualGB | Actual ingestion volume |\r\n| DeltaGB | Difference from baseline |\r\n| DeltaPercent | Percentage variance |\r\n| Trend | 90-day ingestion trend |\r\n| Baseline | Expected trend |\r\n\r\n## Severity Guide\r\n\r\n| Indicator | Interpretation |\r\n| ----------------- | -------------------------------- |\r\n| 🚨 Major Increase | Significant ingestion spike |\r\n| πŸ”₯ Large Increase | Large increase above baseline |\r\n| πŸ“ˆ Increase | Moderate increase above baseline |\r\n| πŸ“‰ Decrease | Moderate decrease below baseline |\r\n| ❄️ Large Decrease | Large reduction below baseline |\r\n| 🚨 Major Decrease | Significant ingestion drop |\r\n\r\n## Investigation Checklist\r\n\r\n| Increased Volume πŸ“ˆ | Reduced Volume πŸ“‰ |\r\n| -------------------------- | ------------------------- |\r\n| New data connectors | Connector failures |\r\n| Diagnostic setting changes | Agent outages |\r\n| Increased log verbosity | Ingestion delays |\r\n| Security incidents | Network issues |\r\n| Duplicate collection | DCR configuration changes |\r\n\r\n> Large increases may indicate cost optimisation opportunities. Large decreases may indicate reduced visibility or data collection failures.\r\n" }, "customWidth": "25", "name": "text - 23" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//union withsource = TableName1 *\r\n//| where _IsBillable == True\r\n//| summarize totalGBytes =round(sum(_BilledSize/(1024*1024*1024)),2) by bin(TimeGenerated, 7d)\r\nUsage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == True\r\n| summarize totalGBytes =sum(Quantity) by bin(TimeGenerated, 7d)\r\n| order by TimeGenerated asc\r\n| serialize \r\n| extend changeInGB = totalGBytes - prev(totalGBytes,1)\r\n| extend pctChange = (changeInGB * 100) / prev(totalGBytes,1)\r\n| extend TimeGenerated = strcat( format_datetime(TimeGenerated, 'yyyy-MM-dd'), \", Week of year: \", week_of_year(TimeGenerated) )\r\n", "size": 0, "aggregation": 3, "title": "Data change (GBytes) and % , from: {TimeRange:label} grouping: Weekly", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "numberFormat": { "unit": 27, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "totalGBytes", "formatter": 0, "numberFormat": { "unit": 38, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "changeInGB", "formatter": 8, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 38, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "pctChange", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "labelSettings": [ { "columnId": "changeInGB", "label": "Change from last period (GBytes)" }, { "columnId": "pctChange", "label": "% Change" } ] }, "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "name": "query - 20 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource = TableName1 *\r\n| where _IsBillable == True\r\n| summarize rgtotalGBytes =sumif(_BilledSize, isnotempty(ResourceGroup)), notRGtotalGBytes =sumif(_BilledSize, isempty(ResourceGroup)) by ResourceGroup\r\n| order by rgtotalGBytes desc\r\n\r\n", "size": 0, "aggregation": 3, "title": "ResourceGroup from: {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "rgtotalGBytes", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "notRGtotalGBytes", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "TimeGenerated", "formatter": 0, "numberFormat": { "unit": 27, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "changeInGB", "formatter": 8, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "pctChange", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_rgtotalGBytes_1", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "rgtotalGBytes", "label": "BilledSize by Resource Group " }, { "columnId": "notRGtotalGBytes", "label": "BilledSize not in a Resource Group" } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_rgtotalGBytes_1", "sortOrder": 2 } ], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "name": "query - RG" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| summarize by sName = strcat(\"/subscriptions/\", subscriptionId), sId = subscriptionId\r\n\r\n", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "value::selected" ] }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - mergeIn_1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == True\r\n| parse ResourceUri with *'/subscriptions/' SubscriptionId '/resourcegroups/'*\r\n| summarize Gbytes = sum(Quantity)/1000 by SubscriptionId\r\n| project SubscriptionId, Gbytes, ['Estimated Price'] = (Gbytes * {Price})\r\n| order by ['Estimated Price'] desc\r\n", "size": 0, "aggregation": 3, "title": "Subscription from: {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Estimated Price", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "rgtotalGBytes", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "notRGtotalGBytes", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "TimeGenerated", "formatter": 0, "numberFormat": { "unit": 27, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "changeInGB", "formatter": 8, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "pctChange", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - by Subscription_1 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e551a41f-8bef-4fbb-a170-04837d9161be\",\"mergeType\":\"rightouter\",\"leftTable\":\"query - mergeIn_1\",\"rightTable\":\"query - by Subscription_1 - Copy\",\"leftColumn\":\"sId\",\"rightColumn\":\"SubscriptionId\"}],\"projectRename\":[{\"originalName\":\"sName\",\"mergedName\":\"sName\",\"fromId\":\"unknown\"},{\"originalName\":\"sId\",\"mergedName\":\"sId\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - mergeIn_1].sName\",\"mergedName\":\"sName1\",\"fromId\":\"e551a41f-8bef-4fbb-a170-04837d9161be\"},{\"originalName\":\"[query - mergeIn_1].sId\",\"mergedName\":\"sId1\",\"fromId\":\"e551a41f-8bef-4fbb-a170-04837d9161be\"},{\"originalName\":\"[query - by Subscription_1 - Copy].SubscriptionId\",\"mergedName\":\"SubscriptionId\",\"fromId\":\"e551a41f-8bef-4fbb-a170-04837d9161be\"},{\"originalName\":\"[query - by Subscription_1 - Copy].Gbytes\",\"mergedName\":\"Gbytes\",\"fromId\":\"e551a41f-8bef-4fbb-a170-04837d9161be\"},{\"originalName\":\"[query - by Subscription_1 - Copy].Estimated Price\",\"mergedName\":\"Estimated Price\",\"fromId\":\"e551a41f-8bef-4fbb-a170-04837d9161be\"}]}", "size": 0, "title": "Subscription from: Last 30 days", "showRefreshButton": true, "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "sId", "formatter": 5 }, { "columnMatch": "Gbytes", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } } }, { "columnMatch": "Estimated Price", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } } ], "filter": true, "sortBy": [ { "itemKey": "SubscriptionId", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "sName1", "label": "Subscription Name", "comment": "if known?" }, { "columnId": "Gbytes", "label": "BilledSize" } ] }, "sortBy": [ { "itemKey": "SubscriptionId", "sortOrder": 1 } ] }, "customWidth": "50", "showPin": false, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource = TableName1 *\r\n//| project SubscriptionId, _BilledSize, ResourceGroup, _IsBillable\r\n| where _IsBillable == True\r\n| summarize sum(_BilledSize) by SubscriptionId, ResourceGroup, Resource, _ResourceId\r\n| extend SubscriptionId = iif(isempty(SubscriptionId),'Data not associated with a Subscription',SubscriptionId)\r\n| project SubscriptionId, sum__BilledSize, ['Estimated Price'] = (sum__BilledSize/(1024*1024*1024)) * {Price}, ResourceGroup, Resource, _ResourceId\r\n| order by ['Estimated Price'] desc", "size": 0, "aggregation": 3, "title": "Subscription(s) BilledSize and Price from: {TimeRange:label},Query Time: {$queryTime}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SubscriptionId", "formatter": 5 }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed", "aggregation": "Sum" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Estimated Price", "formatter": 0, "formatOptions": { "aggregation": "Sum" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "ResourceGroup", "formatter": 5 }, { "columnMatch": "Total_", "formatter": 0, "formatOptions": { "aggregation": "Sum" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "SubscriptionId", "ResourceGroup" ], "expandTopLevel": false }, "labelSettings": [ { "columnId": "sum__BilledSize", "label": "BilledSize" } ] }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Basic" }, "name": "query - by Subscription - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let billedSizeBySub = materialize (union withsource = TableName1 *\r\n| project SubscriptionId, _BilledSize, ResourceGroup, _IsBillable\r\n| where _IsBillable == True\r\n| summarize sum(_BilledSize) by SubscriptionId, ResourceGroup\r\n| extend SubscriptionId = iif(isempty(SubscriptionId),'Data not assocated with a Subscription',SubscriptionId)\r\n| project SubscriptionId, sum__BilledSize, ['Estimated Price'] = (sum__BilledSize/(1024*1024*1024)) * {Price}, ResourceGroup\r\n| order by ['Estimated Price'] desc);\r\nbilledSizeBySub \r\n| union\r\n (billedSizeBySub \r\n | summarize sum__BilledSize = sum(sum__BilledSize), ['Estimated Price'] = sum(['Estimated Price'])\r\n ) \r\n| extend SubscriptionId = iif(isempty(SubscriptionId),'Final Total',SubscriptionId)", "size": 0, "aggregation": 3, "title": "Subscription(s) BilledSize and Price from: {TimeRange:label},Query Time: {$queryTime}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SubscriptionId", "formatter": 5 }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed", "aggregation": "Sum" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Estimated Price", "formatter": 0, "formatOptions": { "aggregation": "Sum" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "ResourceGroup", "formatter": 5 }, { "columnMatch": "Total_", "formatter": 0, "formatOptions": { "aggregation": "Sum" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "SubscriptionId", "ResourceGroup" ], "expandTopLevel": false }, "labelSettings": [ { "columnId": "sum__BilledSize", "label": "BilledSize" } ] }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectDepthLevel", "comparison": "isEqualTo", "value": "Advanced" }, "name": "query - by Subscription - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "overview" }, "name": "group - Cost Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Table Analysis", "items": [ { "type": 1, "content": { "json": "This report shows log ingestion volume and estimated cost by table over the last 30 days, using the configured ingestion price parameter.\r\n\r\nCurrent usage is compared against a historical baseline from 60–30 days ago to highlight growth or reduction in data volumes.\r\n\r\nCost bands help prioritise optimisation efforts: πŸ”΄ High (Β£1,000+), 🟠 Medium (Β£100–£999), 🟒 Low (Β£0–£99), and βšͺ None (no billable ingestion).\r\n\r\nBillable and non-billable data are shown separately, while trend indicators highlight tables with significant increases or decreases in ingestion volume.\r\n\r\nBillable and non-billable data are shown separately to distinguish chargeable ingestion from free data sources." }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CurrentPeriod =\r\nUsage\r\n| where TimeGenerated between (ago(30d) .. now())\r\n| summarize\r\n BillableGB = round(sumif(Quantity, IsBillable == true), 2),\r\n FreeGB = round(sumif(Quantity, IsBillable == false), 2)\r\n by TableName = DataType;\r\n\r\nlet PreviousPeriod =\r\nUsage\r\n| where TimeGenerated between (ago(60d) .. ago(30d))\r\n| summarize\r\n PreviousBillableGB = round(sumif(Quantity, IsBillable == true), 2)\r\n by TableName = DataType;\r\n\r\nCurrentPeriod\r\n| join kind=fullouter PreviousPeriod on TableName\r\n| extend TableName = coalesce(TableName, TableName1)\r\n| extend\r\n BillableGB = coalesce(BillableGB, 0.0),\r\n FreeGB = coalesce(FreeGB, 0.0),\r\n PreviousBillableGB = coalesce(PreviousBillableGB, 0.0)\r\n| extend TotalGB = round(BillableGB + FreeGB, 3)\r\n| extend EstimatedCost = round(BillableGB * todouble('{Price}') / 1000.0, 2)\r\n| extend BillablePercent = round(\r\n iff(TotalGB > 0, (BillableGB / TotalGB) * 100.0, 0.0),\r\n 2\r\n)\r\n| extend ChangeGB = round(BillableGB - PreviousBillableGB, 2)\r\n| extend ChangePercent = round(\r\n iff(PreviousBillableGB > 0, (ChangeGB / PreviousBillableGB) * 100.0, real(null)),\r\n 2\r\n)\r\n| extend Trend =\r\n case(\r\n PreviousBillableGB == 0 and BillableGB > 0, \"β–² New\",\r\n ChangePercent > 10, \"πŸ”Ί\",\r\n ChangePercent < -10, \"πŸ”»\",\r\n \"βž–\"\r\n )\r\n| extend CostBand =\r\n case(\r\n EstimatedCost >= 1000, \"πŸ”΄ High\",\r\n EstimatedCost >= 100, \"🟠 Medium\",\r\n EstimatedCost > 0, \"🟒 Low\",\r\n \"βšͺ None\"\r\n )\r\n| project\r\n TableName,\r\n CostBand,\r\n Trend,\r\n EstimatedCost,\r\n BillableGB,\r\n PreviousBillableGB,\r\n ChangeGB,\r\n ChangePercent,\r\n FreeGB,\r\n TotalGB,\r\n BillablePercent\r\n| order by EstimatedCost desc", "size": 0, "aggregation": 3, "title": "Top billable Tables, from: {TimeRange:label} data, count: {$rowCount}", "exportFieldName": "Table Name", "exportParameterName": "exportTblName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "EstimatedCost", "formatter": 4, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "19ch" } }, { "columnMatch": "BillableGB", "formatter": 0, "numberFormat": { "unit": 38, "options": { "style": "decimal" } } }, { "columnMatch": "ChangeGB", "formatter": 0, "numberFormat": { "unit": 38, "options": { "style": "decimal" } } }, { "columnMatch": "ChangePercent", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "TotalGB", "formatter": 0, "numberFormat": { "unit": 38, "options": { "style": "decimal" } } }, { "columnMatch": "BillablePercent", "formatter": 4, "formatOptions": { "palette": "coldHot", "customColumnWidthSetting": "124px" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 38, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "Price", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_BillablePercent_10", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_BillablePercent_10", "sortOrder": 2 } ], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "name": "query - 20 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SourceData =\r\nunion isfuzzy=true\r\n(\r\n SecurityEvent\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"SecurityEvent\"\r\n),\r\n(\r\n WindowsEvent\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"WindowsEvent\"\r\n),\r\n(\r\n CommonSecurityLog\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"CommonSecurityLog\"\r\n),\r\n(\r\n Syslog\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"Syslog\"\r\n),\r\n(\r\n Event\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"Event\"\r\n),\r\n(\r\n Perf\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"Perf\"\r\n),\r\n(\r\n Heartbeat\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"Heartbeat\"\r\n),\r\n(\r\n Update\r\n | project TimeGenerated, _ResourceId, Type, _BilledSize, _IsBillable, TableName = \"Update\"\r\n);\r\n\r\nlet ResourceSummary =\r\nSourceData\r\n| where TimeGenerated {TimeRange:Query}\r\n| where _IsBillable == true\r\n| where isnotempty(_ResourceId)\r\n| summarize TableSizeGB = round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2)\r\n by TableName, Type, _ResourceId;\r\n\r\nlet TopResources =\r\nResourceSummary\r\n| partition by TableName (\r\n top 10 by TableSizeGB desc\r\n);\r\n\r\nlet DailyTrend =\r\nSourceData\r\n| where TimeGenerated {TimeRange:Query}\r\n| where _IsBillable == true\r\n| where isnotempty(_ResourceId)\r\n| summarize DailyGB = round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 3)\r\n by TableName, Type, _ResourceId, Day = bin(TimeGenerated, 1d)\r\n| order by TableName asc, _ResourceId asc, Day asc\r\n| summarize GBperDay = make_list(DailyGB)\r\n by TableName, Type, _ResourceId;\r\n\r\nTopResources\r\n| join kind=leftouter DailyTrend on TableName, Type, _ResourceId\r\n| extend EstimatedCost = round(TableSizeGB * todouble('{Price}'), 2)\r\n| extend CostBand =\r\n case(\r\n EstimatedCost >= 1000, \"πŸ”΄ High\",\r\n EstimatedCost >= 100, \"🟠 Medium\",\r\n EstimatedCost > 0, \"🟒 Low\",\r\n \"βšͺ None\"\r\n )\r\n| project\r\n TableName,\r\n Type,\r\n CostBand,\r\n EstimatedCost,\r\n TableSizeGB,\r\n GBperDay,\r\n _ResourceId\r\n| order by EstimatedCost desc", "size": 0, "aggregation": 3, "title": "Top 10 Costs by Resource, from: {TimeRange:label} data", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "GBperDay", "formatter": 10, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 3 } } }, { "columnMatch": "Table Size", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "GBytesToday", "formatter": 10, "formatOptions": { "palette": "blue" } }, { "columnMatch": "bill", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, "name": "query - 20 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//find where TimeGenerated {TimeRange:Query} project _BilledSize, _IsBillable, Computer, _ResourceId, EventID\r\nfind withsource=TableName1 in (Event, SecurityEvent, Syslog, CommonSecurityLog) where TimeGenerated {TimeRange:Query} project _BilledSize, _IsBillable, Computer, _ResourceId, EventID, Activity, SyslogMessage, RenderedDescription\r\n| where _IsBillable == true\r\n| summarize ['Table Size'] = sum(_BilledSize) by TableName=TableName1 , EventID, Activity, RenderedDescription, SyslogMessage\r\n| extend EventDescription = iif(isempty(Activity),RenderedDescription,Activity)\r\n| extend EventDescription = iif(isempty(EventDescription),SyslogMessage,EventDescription)\r\n| project-away RenderedDescription, SyslogMessage, Activity\r\n| top 10 by ['Table Size'] desc", "size": 0, "aggregation": 3, "title": "Top 10 Costs by EventId, from: {TimeRange:label} data", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, "name": "query - 20 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 *\r\n| where _IsBillable == true\r\n| extend\r\n Computer = tostring(column_ifexists(\"Computer\", \"\")),\r\n EventID = tostring(column_ifexists(\"EventID\", \"\")),\r\n Activity = tostring(column_ifexists(\"Activity\", \"\")),\r\n RenderedDescription = tostring(column_ifexists(\"RenderedDescription\", \"\")),\r\n SyslogMessage = tostring(column_ifexists(\"SyslogMessage\", \"\"))\r\n| where isnotempty(Computer)\r\n| extend EventDescription =\r\n case(\r\n isnotempty(Activity), Activity,\r\n isnotempty(RenderedDescription), RenderedDescription,\r\n isnotempty(SyslogMessage), SyslogMessage,\r\n \"\"\r\n )\r\n| summarize\r\n ['Table Size GB'] = round(sum(_BilledSize) / 1024 / 1024 / 1024, 2),\r\n ExampleDescription = any(EventDescription)\r\n by TableName = TableName1, EventID, Computer\r\n| top 20 by ['Table Size GB'] desc", "size": 0, "aggregation": 3, "title": "Top 20 Costs by Event, from: {TimeRange:label} data by Computer", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "153px" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "filter": true }, "sortBy": [], "chartSettings": { "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, "name": "query - 20 - Copy - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "https://docs.microsoft.com/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor", "style": "info" }, "name": "text - 24" }, { "type": 1, "content": { "json": "This report estimates log ingestion volume and cost by device across Microsoft Sentinel and Microsoft Defender data sources.\r\n\r\nBillable and non-billable data are aggregated from supported tables, with costs calculated using the configured ingestion price parameter.\r\n\r\nUse this view to identify high-cost devices, understand data source contribution, and target opportunities for cost optimisation." }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(\r\n Heartbeat\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"Heartbeat\"\r\n),\r\n(\r\n SecurityEvent\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"SecurityEvent\"\r\n),\r\n(\r\n WindowsEvent\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"WindowsEvent\"\r\n),\r\n(\r\n Syslog\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"Syslog\"\r\n),\r\n(\r\n CommonSecurityLog\r\n | project\r\n ComputerName=coalesce(DeviceName, Computer, SourceHostName, tostring(DeviceAddress)),\r\n BilledSize=_BilledSize,\r\n IsBillable=_IsBillable,\r\n SourceTable=\"CommonSecurityLog\"\r\n),\r\n(\r\n DeviceEvents\r\n | project ComputerName=DeviceName, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"DeviceEvents\"\r\n),\r\n(\r\n DeviceProcessEvents\r\n | project ComputerName=DeviceName, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"DeviceProcessEvents\"\r\n),\r\n(\r\n DeviceNetworkEvents\r\n | project ComputerName=DeviceName, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"DeviceNetworkEvents\"\r\n),\r\n(\r\n Event\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"Event\"\r\n),\r\n(\r\n Perf\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"Perf\"\r\n),\r\n(\r\n Update\r\n | project ComputerName=Computer, BilledSize=_BilledSize, IsBillable=_IsBillable, SourceTable=\"Update\"\r\n)\r\n| where isnotempty(ComputerName)\r\n| extend ComputerName = tolower(tostring(split(ComputerName, \".\")[0]))\r\n| summarize\r\n BillableBytes=sumif(BilledSize, IsBillable =~ true),\r\n FreeBytes=sumif(BilledSize, IsBillable =~ false),\r\n HeartbeatRows=countif(SourceTable == \"Heartbeat\"),\r\n SecurityEventRows=countif(SourceTable == \"SecurityEvent\"),\r\n WindowsEventRows=countif(SourceTable == \"WindowsEvent\"),\r\n SyslogRows=countif(SourceTable == \"Syslog\"),\r\n CommonSecurityLogRows=countif(SourceTable == \"CommonSecurityLog\"),\r\n DeviceEventsRows=countif(SourceTable == \"DeviceEvents\"),\r\n DeviceProcessEventsRows=countif(SourceTable == \"DeviceProcessEvents\"),\r\n DeviceNetworkEventsRows=countif(SourceTable == \"DeviceNetworkEvents\"),\r\n EventRows=countif(SourceTable == \"Event\"),\r\n PerfRows=countif(SourceTable == \"Perf\"),\r\n UpdateRows=countif(SourceTable == \"Update\")\r\n by ComputerName\r\n| extend BillableGB = round(BillableBytes / 1024.0 / 1024.0 / 1024.0, 3)\r\n| extend FreeGB = round(FreeBytes / 1024.0 / 1024.0 / 1024.0, 3)\r\n| extend TotalGB = round(BillableGB + FreeGB, 3)\r\n| extend BillablePercent = round(iff(TotalGB > 0, (BillableGB / TotalGB) * 100.0, 0.0), 2)\r\n| extend EstimatedCost = round(BillableGB * todouble('{Price}'), 2)\r\n| extend\r\n Heartbeat=iff(HeartbeatRows > 0, \"βœ…\", \"❌\"),\r\n SecurityEvent=iff(SecurityEventRows > 0, \"βœ…\", \"❌\"),\r\n WindowsEvent=iff(WindowsEventRows > 0, \"βœ…\", \"❌\"),\r\n Syslog=iff(SyslogRows > 0, \"βœ…\", \"❌\"),\r\n CommonSecurityLog=iff(CommonSecurityLogRows > 0, \"βœ…\", \"❌\"),\r\n DeviceEvents=iff(DeviceEventsRows > 0, \"βœ…\", \"❌\"),\r\n DeviceProcessEvents=iff(DeviceProcessEventsRows > 0, \"βœ…\", \"❌\"),\r\n DeviceNetworkEvents=iff(DeviceNetworkEventsRows > 0, \"βœ…\", \"❌\"),\r\n Event=iff(EventRows > 0, \"βœ…\", \"❌\"),\r\n Perf=iff(PerfRows > 0, \"βœ…\", \"❌\"),\r\n Update=iff(UpdateRows > 0, \"βœ…\", \"❌\")\r\n| project\r\n ComputerName,\r\n EstimatedCost,\r\n BillableGB,\r\n FreeGB,\r\n TotalGB,\r\n BillablePercent,\r\n Heartbeat,\r\n SecurityEvent,\r\n WindowsEvent,\r\n Syslog,\r\n CommonSecurityLog,\r\n DeviceEvents,\r\n DeviceProcessEvents,\r\n DeviceNetworkEvents,\r\n Event,\r\n Perf,\r\n Update\r\n| order by EstimatedCost desc", "size": 0, "aggregation": 3, "title": "GB used by Computers, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ComputerName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "BillableGB", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "Computer", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "billedData", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "freeData", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "sum__BilledSize", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "MBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "bill", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } } ], "rowLimit": 1000, "filter": true }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BillingVolumeNow", "color": "green" }, { "seriesName": "BillingForecast", "color": "redBright" } ], "xSettings": {}, "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - 20 - GB per Computer" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 *\r\n| where isnotempty(SubscriptionId)\r\n| where _IsBillable == true\r\n| summarize BillableGB = round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2)\r\n by SubscriptionId, TableName1\r\n| extend EstimatedCost = round(BillableGB * todouble('{Price}'), 2)\r\n| extend CostBand =\r\n case(\r\n EstimatedCost >= 1000, \"πŸ”΄ High\",\r\n EstimatedCost >= 100, \"🟠 Medium\",\r\n EstimatedCost > 0, \"🟒 Low\",\r\n \"βšͺ None\"\r\n )\r\n| project\r\n SubscriptionId,\r\n TableName=TableName1,\r\n CostBand,\r\n EstimatedCost,\r\n BillableGB\r\n| order by EstimatedCost desc", "size": 0, "title": "Billing by Subscription", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "SubscriptionId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "sum__BilledSize", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "filter": true }, "sortBy": [] }, "name": "query - 9" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "table" }, "name": "group - Table" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Cost" }, "name": "group - cost" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Regular Checks", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "fc113fd5-ae1b-41d9-b34e-5bfe93d8f666", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "| 1️⃣ Daily |", "subTarget": "Daily", "style": "link" }, { "id": "9fe38fa7-0453-4d11-8ed5-c54b017d9b70", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "| 7️⃣ Weekly |", "subTarget": "Weekly", "style": "link" }, { "id": "04b5d677-9b0e-4d82-8735-00f1da101f35", "cellValue": "selectedTab1", "linkTarget": "parameter", "linkLabel": "| πŸ“… Monthly | ", "subTarget": "Monthly", "style": "link" } ] }, "customWidth": "30", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, "name": "links - 39" }, { "type": 1, "content": { "json": "This Tab is used to recommend tasks to perform on a Daily, Weekly or Monthly basis. These tasks have been taken from work in the community.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" } ], "name": "text - 16" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Daily Checks", "items": [ { "type": 1, "content": { "json": " Daily Operational Tasks\t\r\n1. Data Connectors \r\nLook through active Data Connector and verify the Last Log Received date/time is current to ensure data is flowing.\r\n2. Investigate Incidents and other, stats and checks \r\nInvestigate Incidents to determine if any Analytics Alerts rules were triggered. Set status and begin investigation. Resolve or reassign.\t\r\nMTTC has been added and some MFA checks. Note Priviledge logon uses IdentityInfo and checks if a user is in any group with \"Admin\" in the name - so this may only be indicative of a priviledge logon.\r\n3. Hunting Queries and Bookmarks (links provided)\t\r\nExplore the built-in query results. Update existing hunting queries and bookmarks. Manually generate new or update old Incidents if applicable. Apply automation (Playbooks) where required.\t\r\n4. Analytics Rules (links provided)\t\r\nIdentify any newly released (or newly available due to recently connected Data Connectors) Analytics Rules and enable those that are applicable. Apply automation (Playbooks) where essential.\t\r\n\r\n\t", "style": "success" }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "text - 46" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "20160cb9-20d6-4960-9f32-4f3b53138bb4", "version": "KqlParameterItem/1.0", "name": "dataAccuracy", "type": 10, "description": "Data connector data can be slow to access, the Fast version uses 1h to increase speed over the slow method which is accurate to the minute", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"fast\", \"label\": \"Fast ~1h\", \"selected\":true },\r\n { \"value\": \"slow\", \"label\": \"Slow ~1m\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "label": "Data Connector Accuracy" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// for big systems \r\n// 1) Load mapping once (materialize prevents re-reading during joins)\r\nlet list_ = materialize(\r\n externaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n )\r\n [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"]\r\n with (format=\"csv\", ignoreFirstRecord=true)\r\n);\r\n// 2) Aggregate mapping once (keep it small)\r\nlet mapping = materialize(\r\n list_\r\n | summarize\r\n solution_Name = make_set(solution_Name, 200),\r\n connector_title = make_set(connector_title, 200),\r\n connector_description = make_set(connector_description, 200)\r\n by Table\r\n);\r\n// 3) Use Usage (hourly ingestion metadata) to find last hour each table ingested\r\nUsage\r\n| where TimeGenerated >= ago(14d) // tune window: 2d/7d\r\n//| where DataType !endswith \"_RST\" and DataType !endswith \"_SRCH\"\r\n| summarize\r\n LastIngestSeen = max(TimeGenerated),\r\n IngestGB_24h = sumif(Quantity, TimeGenerated >= ago(1d)) / 1024.0\r\n by DataType, IsBillable\r\n| extend SecondsSinceLastIngest = datetime_diff(\"second\", now(), LastIngestSeen)\r\n| join kind=leftouter mapping on $left.DataType == $right.Table\r\n| extend Deprecated = iff(tostring(connector_description) has \"[Deprecated]\", true, false)\r\n| extend Status = case(\r\n SecondsSinceLastIngest > 24*3600, \"Delayed >24h\", // No ingest in 24h\r\n SecondsSinceLastIngest > 4*3600, \"Delayed >4h\", // No ingest in 4h\r\n \"Healthy\"\r\n )\r\n| project\r\n ['Table Name'] = DataType,\r\n ['Seconds Since Last Ingest'] = SecondsSinceLastIngest,\r\n ['Last Ingest Seen (hourly)'] = LastIngestSeen,\r\n ['Ingest GB (24h)'] = round(IngestGB_24h, 2),\r\n IsBillable,\r\n Status,\r\n Deprecated,\r\n solution_Name,\r\n connector_title,\r\n connector_description\r\n| order by ['Seconds Since Last Ingest'] desc, tostring(solution_Name) asc", "size": 0, "title": "Data Connector list and filter (for large data sets), count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Seconds Since Last Ingest", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Deprecated", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "3", "text": "Deprecated " }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot", "customColumnWidthSetting": "300px" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "labelSettings": [ { "columnId": "Seconds Since Last Ingest", "label": "Time Since Last Ingest" } ] }, "sortBy": [] }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, { "parameterName": "dataAccuracy", "comparison": "isEqualTo", "value": "fast" } ], "name": "query - 39 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Load connector mapping once\r\nlet list_ = \r\nexternaldata (\r\n Table:string, solution_Name:string, solution_Folder:string, solution_publisher_id:string, solution_offer_id:string,\r\n solution_first_publish_date:datetime, solution_last_publish_date:datetime, solution_version:string,\r\n solution_support_name:string, solution_support_tier:string, solution_support_link:string,\r\n solution_author_name:string, solution_categories:string, connector_id:string, connector_publisher:string,\r\n connector_title:string, connector_description:string, connector_instruction_steps:string, connector_permissions:string, connector_files:string, is_unique:bool\r\n)\r\n[\r\n @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"\r\n]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\n// Pre-aggregate once\r\nlet mapping =\r\nlist_\r\n| summarize\r\n solution_Name = make_set(solution_Name),\r\n connector_title = make_set(connector_title),\r\n connector_description = make_set(connector_description)\r\n by Table;\r\n// Only scan tables that exist in mapping\r\nlet tablesToCheck = toscalar(mapping | summarize make_set(Table));\r\nunion withsource=TableName1 *\r\n| where TableName1 in (tablesToCheck)\r\n//| where TableName1 !endswith \"_RST\" and TableName1 !endswith \"_SRCH\"\r\n//| where TimeGenerated {TimeRange:query}\r\n| summarize \r\n LastRecord = max(TimeGenerated)\r\n by TableName1\r\n| extend ['Last Record Received'] = datetime_diff(\"second\", now(), LastRecord)\r\n| join kind=leftouter mapping on $left.TableName1 == $right.Table\r\n| extend Deprecated = iff(array_length(connector_description) > 0 \r\n and tostring(connector_description) has \"[Deprecated]\", \r\n true, false)\r\n| extend Status = case(\r\n ['Last Record Received'] > 86400, \"No data 24h\",\r\n ['Last Record Received'] > 14400, \"Delayed >4h\",\r\n \"Healthy\"\r\n)\r\n| project \r\n ['Table Name'] = TableName1,\r\n ['Last Record Received'],\r\n Status,\r\n Deprecated,\r\n solution_Name,\r\n connector_title,\r\n connector_description\r\n| order by ['Last Record Received'] desc\r\n", "size": 0, "title": "Data Connector list and filter (slow load, more accurate)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot", "customColumnWidthSetting": "300px" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Deprecated", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "3", "text": "Deprecated " }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "connector_title", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "connector_title", "sortOrder": 1 } ] }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, { "parameterName": "dataAccuracy", "comparison": "isEqualTo", "value": "slow" } ], "name": "query - 39" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " //Which tables dipped in the last day\r\nlet lookback_days = 3;\r\n// Build daily GB by table, excluding partial today\r\nlet daily =\r\n Usage\r\n | where TimeGenerated between (startofday(ago(lookback_days * 1d)) .. startofday(now()))\r\n | where IsBillable == true\r\n | summarize GB = sum(Quantity) / 1024.0 // MB -> GB\r\n by day = bin(TimeGenerated, 1d), Table = DataType;\r\n// Split yesterday (D-1) and the day before (D-2)\r\nlet y = daily\r\n | where day == startofday(ago(1d))\r\n | project Table, GB_Y = GB;\r\nlet d2 = daily\r\n | where day == startofday(ago(2d))\r\n | project Table, GB_D2 = GB;\r\n// Compare and rank drops\r\ny\r\n| join kind=fullouter d2 on Table\r\n| extend GB_D1 = round(coalesce(GB_Y, 0.0), 3),\r\n GB_D2 = round(coalesce(GB_D2, 0.0), 3)\r\n| extend AbsDropGB = round(GB_D2 - GB_D1, 3),\r\n PctDrop = round(100.0 * iif(GB_D2 == 0, 0.0, (GB_D2 - GB_Y) / GB_D2), 2)\r\n| where AbsDropGB > 0 and isnotempty(Table) \r\n| order by AbsDropGB desc\r\n| project Table, PercentageDrop = PctDrop ,Yesterday = GB_D2, Today=GB_D1, GBdrop = AbsDropGB", "size": 0, "title": "Table ingestion change from yesterday until today", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "PercentageDrop", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_PercentageDrop_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_PercentageDrop_1", "sortOrder": 2 } ] }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize IncidentCount=count(), arg_max(LastActivityTime,LastActivityTime, CreatedTime, Title) by Title\r\n//| top 200 by IncidentNumber desc\r\n| project-away Title1, LastActivityTime1\r\n| order by IncidentCount desc\r\n\r\n\r\n\r\n", "size": 0, "title": "Daily Incident check, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "IncidentCount", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "30ch" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "rowLimit": 1000, "filter": true, "labelSettings": [ { "columnId": "IncidentCount", "label": " Incident Count" } ] } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//\r\n// Predict data volume for the next month\r\n//\r\nlet endDate = now(); // what is the date now\r\nlet projectTo = now()+90d; // project forward nn days\r\nlet projectForward = 90; // must be same as projectTo value\r\nSecurityIncident\r\n//| summarize IncidentCount=count() by Title, bin(TimeGenerated,1d)\r\n| make-series IncidentCount=count() default=0 on TimeGenerated from {TimeRange:start} to projectTo step 1d \r\n| extend IncidentCountForecast = series_decompose_forecast(IncidentCount, projectForward)\r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnnotations": true, "title": "Daily Incident count for {TimeRange:label} with 90day forecast", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "labelSettings": [ { "columnId": "IncidentCount", "label": "Alert Count" } ] } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - incident and forecast" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident \r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber \r\n| extend ClosureTime = coalesce(ClosedTime, LastModifiedTime) \r\n| summarize \r\n newIncidents = dcountif(IncidentNumber, \r\n CreatedTime >= startofday(ago(1d)) and CreatedTime < startofday(now())), \r\n resolvedIncidents = dcountif(IncidentNumber, \r\n Status == \"Closed\" and isnotempty(ClosureTime) \r\n and ClosureTime >= startofday(ago(1d)) and ClosureTime < startofday(now())), \r\n MTTC = avgif(datetime_diff(\"hour\", ClosureTime, CreatedTime), \r\n Status == \"Closed\" and isnotempty(ClosureTime) \r\n and ClosureTime >= startofday(ago(1d)) and ClosureTime < startofday(now())) \r\n| extend MTTCinHours = round(MTTC,1)\r\n| project-away MTTC\r\n\r\n\r\n\r\n\r\n", "size": 0, "title": "New vs. resolved Incidents, plus MTTC for {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "MTTCinHours", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "MTTCinHours", "color": "lightBlue", "backgroundPattern": "stripes-left" } ] } } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "labelSettings": [ { "columnId": "MTTCinHours", "label": "MTTC (hours)" } ] } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy - Copy - Copy" }, { "type": 1, "content": { "json": "### Define your SLA's or 1=High, 8=Medium, 24=Low will be used \r\n\r\n## - change HELP toggle to YES for more detail on SLA and Median, Average and P90 (tail-risk)\r\n", "style": "info" }, "name": "text - 15" }, { "type": 1, "content": { "json": "\r\n| Metric | Tells You |\r\n| ----------- | --------------------- |\r\n| **Median** | Typical performance |\r\n| **Average** | Total workload impact |\r\n| **P90** | Long-tail risk |\r\n\r\nFor example: \r\n- Median = 45 minutes (looks great) \r\n- P90 = 900 minutes (problem! β€œHow bad things get when they go wrong.”) \r\n- Average = 200 minutes (tail influencing cost, a.k.a tail-risk) \r\n-\r\nMedian reflects reality, average reflects mathematical distortion. \r\nMost incidents close quickly, however a small number take a very long time (waiting on customer, forensic work, third parties, etc... which is refelcted in the Average, put simply: Average gets Distorted by Outliers)\r\n\r\nExample\r\n\r\nImagine 100 incidents:\r\n\r\n- 85 resolved in under 60 minutes\r\n- 10 resolved in 2–4 hours\r\n- 5 took 20+ hours\r\n\r\nMedian might be:\r\n- 45 minutes (looks healthy) \r\n\r\nBut P90 might be:\r\n- 12 hours \r\n\r\nThat means:\r\n- 10% of incidents take 12+ hours\r\n\r\nThat’s your tail risk.\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 15 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1ee145ba-6384-48b5-b501-0d977832c21a", "version": "KqlParameterItem/1.0", "name": "slaHigh", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "1", "label": "SLA for HIGH in hours" }, { "version": "KqlParameterItem/1.0", "name": "slaMedium", "label": "SLA for MEDIUM in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "8", "id": "3b148959-329b-4d65-bbe2-aa6ac48d3f48" }, { "version": "KqlParameterItem/1.0", "name": "slaLow", "label": "SLA for Low in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "24", "id": "d59c2800-d4df-4695-a5ac-a3ea00232a59" }, { "version": "KqlParameterItem/1.0", "name": "slaInfo", "label": "SLA for Informational in hours", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "10000", "id": "b96aee49-14e6-4e52-bb27-1aaa0264df73" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Resolve workbook parameters (entered in HOURS) with defaults, convert to MINUTES\r\nlet SLA_High =\r\n iff(isempty(trim(\" \", \"{slaHigh}\")), 60.0, toreal(\"{slaHigh}\") * 60.0);\r\nlet SLA_Medium =\r\n iff(isempty(trim(\" \", \"{slaMedium}\")), 480.0, toreal(\"{slaMedium}\") * 60.0);\r\nlet SLA_Low =\r\n iff(isempty(trim(\" \", \"{slaLow}\")), 1440.0, toreal(\"{slaLow}\") * 60.0);\r\nlet SLA_Info =\r\n iff(isempty(trim(\" \", \"{slaInfo}\")), real(null), toreal(\"{slaInfo}\") * 60.0);\r\n\r\nlet closedIncidents = materialize(\r\n SecurityIncident\r\n | where Status == \"Closed\"\r\n | where isnotempty(CreatedTime) and isnotempty(ClosedTime)\r\n | extend TTR_Minutes = todouble(datetime_diff(\"minute\", ClosedTime, CreatedTime))\r\n | where TTR_Minutes >= 0\r\n);\r\n\r\n// Total minutes across all incidents (for % of SOC time)\r\nlet TotalMinutes = toscalar(\r\n closedIncidents\r\n | summarize sum(TTR_Minutes)\r\n);\r\n\r\nclosedIncidents\r\n| extend SLA_Minutes = case(\r\n Severity == \"High\", SLA_High,\r\n Severity == \"Medium\", SLA_Medium,\r\n Severity == \"Low\", SLA_Low,\r\n Severity == \"Informational\", SLA_Info,\r\n real(null)\r\n )\r\n| summarize\r\n Incidents = count(),\r\n TotalMinutesSeverity = sum(TTR_Minutes),\r\n AvgTTR = avg(TTR_Minutes),\r\n MedianTTR = percentile(TTR_Minutes, 50),\r\n P90TTR = percentile(TTR_Minutes, 90),\r\n SLA_Target_Minutes = any(SLA_Minutes),\r\n WithinSLA = countif(isnotnull(SLA_Minutes) and TTR_Minutes <= SLA_Minutes),\r\n Breaches = countif(isnotnull(SLA_Minutes) and TTR_Minutes > SLA_Minutes)\r\n by Severity\r\n| extend\r\n AvgTTR = round(AvgTTR, 2),\r\n MedianTTR = round(MedianTTR, 2),\r\n P90TTR = round(P90TTR, 2),\r\n PctOfTotalTime = iff(TotalMinutes > 0, round(TotalMinutesSeverity * 100.0 / TotalMinutes, 2), 0.0),\r\n SLA_Attainment = iff(isnull(SLA_Target_Minutes), real(null),\r\n round(WithinSLA * 100.0 / (WithinSLA + Breaches), 2)),\r\n MedianVsSLA = case(\r\n isnull(SLA_Target_Minutes), \"β€”\",\r\n MedianTTR <= SLA_Target_Minutes, \"βœ… Within SLA\",\r\n \"❌ SLA Breach\"\r\n ),\r\n P90VsSLA = case(\r\n isnull(SLA_Target_Minutes), \"β€”\",\r\n P90TTR <= SLA_Target_Minutes, \"βœ… Tail within SLA\",\r\n \"⚠️ Tail breaches SLA\"\r\n ),\r\n SeverityOrder = case(\r\n Severity == \"High\", 1,\r\n Severity == \"Medium\", 2,\r\n Severity == \"Low\", 3,\r\n Severity == \"Informational\", 4,\r\n 5\r\n )\r\n| order by SeverityOrder asc\r\n| project\r\n Severity,\r\n Incidents,\r\n [\"Total Time Spent (minutes)\"] = round(TotalMinutesSeverity, 2),\r\n [\"Avg Time to Resolve (minutes)\"] = AvgTTR,\r\n [\"Median Time to Resolve (minutes)\"] = MedianTTR,\r\n [\"P90 Time to Resolve (minutes)\"] = P90TTR,\r\n [\"% of Total SOC Time\"] = strcat(tostring(PctOfTotalTime), \"%\"),\r\n [\"SLA Target (hours)\"] = iff(isnull(SLA_Target_Minutes), real(null), round(SLA_Target_Minutes/60.0, 2)),\r\n [\"Within SLA\"] = WithinSLA,\r\n [\"Breaches\"] = Breaches,\r\n [\"SLA Attainment %\"] = iff(isnull(SLA_Attainment), \"β€”\", strcat(tostring(SLA_Attainment), \"%\")),\r\n [\"Median vs SLA\"] = MedianVsSLA,\r\n [\"P90 vs SLA\"] = P90VsSLA,\r\n SeverityOrder\r\n| order by SeverityOrder asc\r\n| project-away SeverityOrder\r\n", "size": 0, "title": "Median Time to Resolve (MTTR) reporting for {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "Total Time Spent", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "Total Minutes Spent", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "MTTCinHours", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "MTTCinHours", "color": "lightBlue", "backgroundPattern": "stripes-left" } ] } } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| summarize count() by AuthenticationRequirement", "size": 0, "title": "AuthenticationRequirement type by count", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let PrivilegedUsers =\r\nIdentityInfo\r\n| mv-expand AssignedRoles\r\n| where AssignedRoles contains \"Admin\"\r\n| distinct AccountUPN;\r\nSigninLogs\r\n| where TimeGenerated >= ago(30d)\r\n| extend IsPrivileged = iff(UserPrincipalName in (PrivilegedUsers), 1, 0)\r\n| summarize \r\n totalLogins = count(),\r\n mfaLogins = countif(AuthenticationRequirement == \"multiFactorAuthentication\"),\r\n privilegedLogins = countif(IsPrivileged == 1),\r\n privilegedMfaLogins = countif(IsPrivileged == 1 and AuthenticationRequirement == \"multiFactorAuthentication\")\r\n| extend \r\n mfaRate = round(toreal(mfaLogins) / totalLogins * 100.0, 2),\r\n privilegedMfaRate = round(toreal(privilegedMfaLogins) / privilegedLogins * 100.0, 2)\r\n", "size": 0, "title": "MFA coverage rate for: {TimeRange:label}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "totalLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedMfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "50", "representation": "4", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 50%" } }, { "columnMatch": "privilegedMfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "90", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 90%" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 39 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let PrivilegedUsers =\r\nIdentityInfo\r\n| mv-expand AssignedRoles\r\n| where AssignedRoles contains \"Admin\"\r\n| distinct AccountUPN;\r\nSigninLogs\r\n| where TimeGenerated >= ago(30d)\r\n| where UserPrincipalName in (PrivilegedUsers)\r\n| where AuthenticationRequirement != \"multiFactorAuthentication\"\r\n| summarize \r\n NonMfaSignins = count(),\r\n LastSeen = max(TimeGenerated)\r\n by UserPrincipalName\r\n| order by NonMfaSignins desc", "size": 0, "title": "Users with a PRIV account that has signed in without MFA: {TimeRange:label} - click row for more details", "timeContextFromParameter": "TimeRange", "exportFieldName": "UserPrincipalName", "exportParameterName": "exportUPN", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "totalLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedMfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "50", "representation": "4", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 50%" } }, { "columnMatch": "privilegedMfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "90", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 90%" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "sortBy": [ { "itemKey": "NonMfaSignins", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "NonMfaSignins", "sortOrder": 2 } ] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" } ], "name": "query - 39 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| mv-expand AssignedRoles\r\n| where AssignedRoles contains \"Admin\" and AccountUPN == '{exportUPN}'\r\n| summarize by tostring(AssignedRoles), JobTitle, AccountDisplayName, RiskLevel, BlastRadius\r\n", "size": 0, "title": "Users with a PRIV account that has signed in without MFA: {TimeRange:label}", "timeContext": { "durationMs": 2592000000 }, "exportFieldName": "UserPrincipalName", "exportParameterName": "exportUPN", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "totalLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "privilegedMfaLogins", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "mfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "50", "representation": "4", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 50%" } }, { "columnMatch": "privilegedMfaRate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "90", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "tooltipFormat": { "tooltip": "Considered CRITICAL if you are below 90%" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "TenantId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, { "parameterName": "exportUPN", "comparison": "isNotEqualTo" } ], "name": "query - 39 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "3cc494b9-3cde-4ac4-831d-e01ee44ce787", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries", "linkTarget": "Url", "linkLabel": "https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries", "preText": "3. Hunting Queries", "postText": "", "style": "link" }, { "id": "2df3d076-e803-4654-a803-df5ccfdaf581", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Detections", "linkTarget": "Url", "linkLabel": "https://github.com/Azure/Azure-Sentinel/tree/master/Detections", "preText": "4. Analytic Rules", "style": "link" } ] }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "links - 47" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Workspace:subscriptionid}/resourceGroups/{Workspace:resourcegroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/tables\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-07-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"properties.plan\",\"columnid\":\"plan\",\"columnType\":\"string\",\"substringRegexMatch\":\"Auxiliary\",\"substringReplace\":\"Auxiliary / data lake\"},{\"path\":\"properties.totalRetentionInDays\",\"columnid\":\"totalRetentionInDays\"},{\"path\":\"properties.archiveRetentionInDays\",\"columnid\":\"archiveRetentionInDays\"},{\"path\":\"properties.schema\",\"columnid\":\"schema\"},{\"path\":\"properties.provisioningState\",\"columnid\":\"provisioningState\"},{\"path\":\"properties.retentionInDays\",\"columnid\":\"retentionInDays\"}]}}]}", "size": 0, "title": "TABLES, from the API: Count: {$rowCount}", "exportFieldName": "descriptionHtml", "exportParameterName": "descriptionHtml", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "isNew", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "success", "text": "" }, { "operator": "==", "thresholdValue": "false", "representation": "Blank", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } }, { "columnMatch": "isPreview", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "Blank", "text": "" }, { "operator": "==", "thresholdValue": "true", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } }, { "columnMatch": "isFeatured", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "success", "text": "" }, { "operator": "==", "thresholdValue": "false", "representation": "Blank", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "descriptionHtml", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "id", "formatter": 7, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true } } ], "rowLimit": 5000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - Tables" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Daily" }, "name": "group - Daily", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Weekly", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "22b2f176-7f2b-4d52-be98-816801a90e07", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| βš™οΈ Data Connectivity |", "subTarget": "connectors", "preText": "Agents", "style": "link" }, { "id": "7879ae08-aee9-4089-bfa1-7c783c0df2f2", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ•΅οΈ Agents |", "subTarget": "agents", "preText": "Agents", "style": "link" }, { "id": "a6e78c51-911a-4cc8-858a-3709feefaf75", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ“š Workbooks | ", "subTarget": "workbooks", "style": "link" }, { "id": "7797b21c-05e1-4ec8-8d9a-d8d250089215", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ“ Rules |", "subTarget": "rules", "style": "link" }, { "id": "34a06bc8-c5f8-4263-bf81-44e1c08c61ab", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| Playbooks | ", "subTarget": "playbooks", "style": "link" }, { "id": "56fd063a-31a0-4bff-a49a-721368f423be", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| Content Hub |", "subTarget": "content", "style": "link" }, { "id": "43353f45-6e74-4b7e-bad2-971546d6e983", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "| πŸ—„οΈ Retention |", "subTarget": "retention", "style": "link" } ] }, "name": "links - 25" }, { "type": 1, "content": { "json": " Weekly Operational Tasks\t\r\n1. Log Analytics Agent\r\nVerify the servers (or workstations) are showing a connected status in the workspace. Troubleshoot and remediate failed connections.\r\n2. Workbooks Updates \r\nVerify in the Sentinel Dashboard blade if an installed Workbook has an update that needs installed.\r\n3. GitHub Alert Rules, Workbooks, Hunting queries, Content Hub and Playbooks\t\r\nVisit and review the Sentinel GitHub repository and explore if there are new or updated Detection Rules, Workbooks, Hunting queries, Content Hub or Playbooks of value that can be added to the environment.\t\r\n4. Data Connector health\r\n\t", "style": "success" }, "name": "text - 46 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a415c344-6eb5-405a-99ab-6ad509237f0f", "version": "KqlParameterItem/1.0", "name": "selectType", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"'Microsoft','Partner','Community','Other'\", \"label\": \"All\", \"selected\":true },\r\n { \"value\": \"'Microsoft'\", \"label\": \"Microsoft Sentinel (1p)\"},\r\n { \"value\": \"'Partner'\", \"label\": \"Partner (3p)\"},\r\n { \"value\": \"'Community'\", \"label\": \"Community\"},\r\n { \"value\": \"'Other'\", \"label\": \"Other\"}\r\n]\r\n\r\n\r\n", "timeContext": { "durationMs": 86400000 } }, { "id": "3f5d542a-082f-431c-8464-6a998ee779a7", "version": "KqlParameterItem/1.0", "name": "staleHours", "type": 1, "description": "Highlight when a connector is temp offline", "timeContext": { "durationMs": 86400000 }, "value": "1" }, { "version": "KqlParameterItem/1.0", "name": "deadHours", "type": 1, "description": "Highlight when a connector is fatally offline", "timeContext": { "durationMs": 86400000 }, "value": "24", "id": "9f1ef2c9-5281-4c16-b404-d0c761b38c5d" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "connectors" }, "name": "parameters - 17" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "20864f9b-ceb1-4a4d-98d8-850da872c1ee", "version": "KqlParameterItem/1.0", "name": "selectHealth", "type": 10, "description": "Choose to show unhealthy (default) state or \"All\" states", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"'Healthy'\", \"label\": \"NOT Healthy\", \"selected\":true},\r\n { \"value\": \"'All'\", \"label\": \"All\" }\r\n\r\n]\r\n", "timeContext": { "durationMs": 86400000 }, "value": "'All'" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "connectors" }, "name": "parameters - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Data Connectivity ", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Workbook parameters (defaults if empty)\r\nlet staleHours = iff(isempty(trim(\" \", \"{staleHours}\")), 1, toint(\"{staleHours}\"));\r\nlet deadHours = iff(isempty(trim(\" \", \"{deadHours}\")), 24, toint(\"{deadHours}\"));\r\n\r\n// Pull Microsoft’s Solutions/Connectors/Tables mapping (includes offer id)\r\nlet list_ = materialize(\r\n externaldata (\r\n Table:string,\r\n solution_Name:string,\r\n solution_Folder:string,\r\n solution_publisher_id:string,\r\n solution_offer_id:string,\r\n solution_first_publish_date:datetime,\r\n solution_last_publish_date:datetime,\r\n solution_version:string,\r\n solution_support_name:string,\r\n solution_support_tier:string,\r\n solution_support_link:string,\r\n solution_author_name:string,\r\n solution_categories:string,\r\n connector_id:string,\r\n connector_publisher:string,\r\n connector_title:string,\r\n connector_description:string,\r\n connector_instruction_steps:string,\r\n connector_permissions:string,\r\n connector_files:string,\r\n is_unique:bool\r\n )\r\n [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Tools/Solutions%20Analyzer/solutions_connectors_tables_mapping.csv\"]\r\n with (format=\"csv\", ignoreFirstRecord=true)\r\n);\r\n\r\n// Pre-aggregate to a compact lookup per table\r\nlet offersByTable = materialize(\r\n list_\r\n | summarize\r\n OfferIds = make_set(solution_offer_id, 50),\r\n Solutions = make_set(solution_Name, 50),\r\n ConnectorTitles = make_set(connector_title, 50),\r\n SupportLinks = make_set(solution_support_link, 10)\r\n by Table\r\n);\r\n\r\nUsage\r\n| where TimeGenerated >= ago(7d)\r\n| where DataType !endswith \"_RST\" and DataType !endswith \"_SRCH\"\r\n| summarize\r\n LastIngestSeen = max(TimeGenerated),\r\n IngestGB_24h = sumif(Quantity, TimeGenerated >= ago(1d)) / 1024.0\r\n by DataType, IsBillable\r\n| extend SecondsSinceLast = datetime_diff(\"second\", now(), LastIngestSeen)\r\n| extend Status = case(\r\n SecondsSinceLast > deadHours*3600, \"Dead\",\r\n SecondsSinceLast > staleHours*3600, \"Stale\",\r\n \"Healthy\"\r\n)\r\n// Enrich with offer/solution metadata\r\n| join kind=leftouter offersByTable on $left.DataType == $right.Table\r\n| extend SupportLinks = iif(isempty(SupportLinks),'Other',SupportLinks) \r\n| extend SupportLinks = coalesce(SupportLinks, \"\")\r\n| where SupportLinks has_any ( {selectType} )\r\n| project\r\n DataType,\r\n Status,\r\n LastIngestSeen,\r\n SecondsSinceLast,\r\n IngestGB_24h = round(IngestGB_24h, 2),\r\n IsBillable,\r\n OfferIds,\r\n Solutions,\r\n SupportLinks\r\n| order by Status desc, SecondsSinceLast desc", "size": 0, "title": "Data connector 7day check, count: {$rowCount} {selectType}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Stale", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Dead", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "SecondsSinceLast", "formatter": 8, "formatOptions": { "palette": "whiteBlack", "customColumnWidthSetting": "22ch" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IngestGB_24h", "formatter": 8, "formatOptions": { "palette": "whiteBlack" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "changeInCount", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "changeInPct", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "changePct", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5 }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Environment", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Azure", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "magenta", "text": "{0}{1}" } ] } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5 }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_IngestGB_24h_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_IngestGB_24h_4", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - heartbeat" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// 1) Weekday-aware baseline (Mon vs Mon, Tue vs Tue)\r\n// 2) Rolling 30-day median (responsive) and 90-day median (stable reference)\r\n// 3) Dynamic threshold using stdev (flags statistically significant drops, not just % drops)\r\n// 4) Connector health score (0–100)\r\n// 5) Ignore tiny tables (minimum baseline GB/day)\r\n\r\n\r\nlet lookback = 90d;\r\nlet minBaselineGB = 0.10; // ignore tiny tables (0.1 GB/day)\r\nlet pctDropTrigger = 50.0; // classic % drop\r\nlet sigmaTrigger = 2.0; // dynamic threshold: >=2Οƒ drop\r\nlet todayWindow = 1d; // last 24h\r\n\r\n// 1) Daily ingestion per table (GB/day) + weekday\r\nlet daily =\r\nUsage\r\n| where TimeGenerated >= ago(lookback)\r\n| where DataType !endswith \"_RST\" and DataType !endswith \"_SRCH\"\r\n| summarize GB = sum(Quantity) / 1024.0 by DataType, Day = bin(TimeGenerated, 1d)\r\n| extend Weekday = dayofweek(Day);\r\n\r\n// \"Today\" bucket (last 24h) projected onto today's weekday\r\nlet today =\r\ndaily\r\n| where Day >= ago(todayWindow)\r\n| summarize TodayGB = sum(GB), TodayDay = max(Day) by DataType\r\n| extend Weekday = dayofweek(TodayDay);\r\n\r\n// 2) Weekday-aware rolling baselines (median) + 3) stdev for dynamic thresholds\r\nlet baseline30 =\r\ndaily\r\n| where Day between (ago(30d) .. ago(1d)) // exclude last 24h to avoid contamination\r\n| summarize\r\n BaselineGB_30 = percentile(GB, 50),\r\n StdevGB_30 = stdev(GB),\r\n Samples_30 = count()\r\n by DataType, Weekday;\r\n\r\nlet baseline90 =\r\ndaily\r\n| where Day between (ago(90d) .. ago(1d))\r\n| summarize\r\n BaselineGB_90 = percentile(GB, 50),\r\n StdevGB_90 = stdev(GB),\r\n Samples_90 = count()\r\n by DataType, Weekday;\r\n\r\ntoday\r\n| join kind=leftouter baseline30 on DataType, Weekday\r\n| join kind=leftouter baseline90 on DataType, Weekday\r\n\r\n// Prefer 30d median (more responsive). Fall back to 90d if 30d is missing.\r\n| extend BaselineGB = coalesce(BaselineGB_30, BaselineGB_90),\r\n StdevGB = coalesce(StdevGB_30, StdevGB_90),\r\n Samples = coalesce(Samples_30, Samples_90)\r\n\r\n// 5) prevent noise from small tables\r\n| where isnotnull(BaselineGB) and BaselineGB >= minBaselineGB\r\n\r\n// Drop metrics\r\n| extend DropGB = BaselineGB - TodayGB\r\n| extend DropPct = iff(BaselineGB > 0, round(DropGB * 100.0 / BaselineGB, 2), real(null))\r\n| extend ZDrop = iff(StdevGB > 0, round(DropGB / StdevGB, 2), real(null)) // how many Οƒ below baseline\r\n\r\n// 4) Health / status (uses BOTH % and Οƒ so it's stable)\r\n| extend Status = case(\r\n TodayGB <= 0, \"Dead\",\r\n (DropPct >= pctDropTrigger and ZDrop >= sigmaTrigger), \"Degraded\",\r\n (DropPct >= 25.0 and ZDrop >= 1.0), \"Warning\",\r\n \"Healthy\"\r\n)\r\n\r\n// 4) Simple 0–100 health score (penalize big % drops + big Οƒ drops)\r\n| extend HealthScore =\r\n toint(\r\n max_of(\r\n 0.0,\r\n 100.0\r\n - min_of(80.0, max_of(0.0, DropPct)) // % drop penalty (capped)\r\n - min_of(20.0, max_of(0.0, (ZDrop - 1.0) * 10)) // Οƒ penalty after 1Οƒ\r\n )\r\n )\r\n\r\n| where \"All\" in ({selectHealth}) or Status !in ({selectHealth})\r\n\r\n| project\r\n DataType,\r\n Status,\r\n HealthScore,\r\n DropPct,\r\n DropGB = round(DropGB, 2),\r\n TodayGB = round(TodayGB, 2),\r\n BaselineGB = round(BaselineGB, 2),\r\n BaselineGB_30 = round(BaselineGB_30, 2),\r\n BaselineGB_90 = round(BaselineGB_90, 2)\r\n \r\n \r\n // ZDrop,\r\n // Samples_30,\r\n // Samples_90\r\n| order by Status desc, HealthScore asc, DropPct desc", "size": 0, "title": "Data connector Ingestion drop check: {$rowCount}. Median daily baseline over last 90 days (excluding last 1 day)", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Warning", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Healthy", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "HealthScore", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "DropPct", "formatter": 8, "formatOptions": { "palette": "whiteBlack" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "DropGB", "formatter": 3, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "TodayGB", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "BaselineGB", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "SecondsSinceLast", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "22ch" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IngestGB_24h", "formatter": 8, "formatOptions": { "palette": "whiteBlack" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "changeInCount", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "changeInPct", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "changePct", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5 }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Environment", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Azure", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "magenta", "text": "{0}{1}" } ] } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5 }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - heartbeat - Copy" }, { "type": 1, "content": { "json": "This report provides a health overview of Microsoft Sentinel data ingestion.\r\n\r\nIt identifies tables as Healthy, Stale, or Dead based on when data was last received (configurable thresholds), shows ingestion volume for the past 24 hours, and maps each table to its associated Microsoft solution/offer.\r\n\r\nUse this view to quickly detect broken connectors, ingestion gaps, and prioritise remediation." }, "customWidth": "50", "name": "text - 7" }, { "type": 1, "content": { "json": "This report compares today’s ingestion to weekday-aware rolling medians (30d/90d) and uses standard deviation to detect statistically significant drops. Tables below the minimum baseline are ignored to reduce noise. Each table gets a Status (Healthy/Warning/Degraded/Dead) and a 0–100 HealthScore so you can quickly prioritise the most severe ingestion regressions." }, "customWidth": "50", "name": "text - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Base7d =\r\nSecurityIncident\r\n| where TimeGenerated >= ago(7d)\r\n| summarize\r\n LastIncidentSeen_7d = max(TimeGenerated),\r\n Incidents_7d = count(),\r\n Title_nonempty = arg_max(iif(isempty(Title), datetime(1900-01-01), TimeGenerated), Title).[1],\r\n Title_latest = arg_max(TimeGenerated, Title).[1]\r\n by IncidentName\r\n| extend Title = tostring(coalesce(Title_nonempty, Title_latest));\r\n\r\nlet BasePrev90d =\r\nSecurityIncident\r\n| where TimeGenerated between (ago(90d) .. ago(7d))\r\n| summarize\r\n LastIncidentSeen_prev90d = max(TimeGenerated),\r\n Incidents_prev90d = count(),\r\n Title_nonempty = arg_max(iif(isempty(Title), datetime(1900-01-01), TimeGenerated), Title).[1],\r\n Title_latest = arg_max(TimeGenerated, Title).[1]\r\n by IncidentName\r\n| extend Title = tostring(coalesce(Title_nonempty, Title_latest));\r\n\r\nlet ByTitle7d =\r\nBase7d\r\n| summarize\r\n LastIncidentSeen_7d = max(LastIncidentSeen_7d),\r\n Incidents_7d = sum(Incidents_7d)\r\n by Title;\r\n\r\nlet ByTitlePrev90d =\r\nBasePrev90d\r\n| summarize\r\n LastIncidentSeen_prev90d = max(LastIncidentSeen_prev90d),\r\n Incidents_prev90d = sum(Incidents_prev90d)\r\n by Title;\r\n\r\n// ---- 90-day daily series by Title (for workbook charting) ----\r\nlet Series90d =\r\nSecurityIncident\r\n| where TimeGenerated >= ago(90d)\r\n| extend TitleNorm = tostring(Title)\r\n| where isnotempty(TitleNorm)\r\n| make-series CountsSeries_90d = count() default=0\r\n on TimeGenerated from startofday(ago(90d)) to startofday(now()) step 1d\r\n by Title = TitleNorm;\r\n\r\n// ---- Final output ----\r\nByTitlePrev90d\r\n| join kind=fullouter ByTitle7d on Title\r\n| join kind=leftouter Series90d on Title\r\n| extend\r\n Incidents_7d = coalesce(Incidents_7d, 0),\r\n Incidents_prev90d = coalesce(Incidents_prev90d, 0),\r\n LastIncidentSeen_7d = todatetime(LastIncidentSeen_7d),\r\n LastIncidentSeen_prev90d = todatetime(LastIncidentSeen_prev90d)\r\n| extend HealthFlag = case(\r\n Incidents_7d > 0 and LastIncidentSeen_7d >= ago(1d), \"Healthy\",\r\n Incidents_7d > 0 and LastIncidentSeen_7d < ago(1d), \"Warning (no incidents <24h)\",\r\n Incidents_7d == 0 and Incidents_prev90d > 0, \"Warning (No incidents 7d, had prev 90d)\",\r\n Incidents_7d > 0 and Incidents_prev90d == 0, \"New (not seen in prev 90d)\",\r\n Incidents_7d == 0 and Incidents_prev90d == 0, \"Unknown\",\r\n \"Unknown\"\r\n)\r\n| where isnotempty(Title)\r\n| order by Incidents_7d desc, LastIncidentSeen_7d desc\r\n| project\r\n HealthFlag,\r\n Title,\r\n LastIncidentSeen_7d,\r\n Incidents_7d,\r\n LastIncidentSeen_prev90d,\r\n Incidents_prev90d,\r\n CountsSeries_90d", "size": 0, "title": "Compare Incident count by Title, for 7days vs. 90days, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "HealthFlag", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "LastIncidentSeen_7d", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "162.996px" } }, { "columnMatch": "Incidents_7d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Incidents_prev90d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "CountsSeries_90d", "formatter": 10, "formatOptions": { "palette": "blackWhite" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - alerts - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query is a β€œrule firing drift” health check using SecurityAlert. It looks for alert names that were firing in the previous week but stopped or dropped sharply in the current week. \r\n \r\n SecurityAlert\r\n | where TimeGenerated between (ago(14d) .. now())\r\n | extend Period = case(TimeGenerated >= ago(7d), \"Current\", \"Prior\")\r\n | summarize Cnt=count() by AlertName, Period\r\n | evaluate pivot(Period, sum(Cnt), AlertName)\r\n | extend Prior=coalesce(Prior, 0), Current=coalesce(Current, 0)\r\n | extend DropRatio = iff(Prior == 0, real(null), todouble(Prior - Current) / todouble(Prior))\r\n | extend Status = case(\r\n Prior > 0 and Current == 0, \"Stopped\",\r\n Prior >= 10 and DropRatio >= 0.80, \"Dropped\",\r\n \"OK\"\r\n )\r\n | where Status != \"OK\"\r\n | extend Severity = case(Status==\"Stopped\",\"High\",\"Medium\")\r\n | project\r\n // Category=\"Analytics\",\r\n // Check=\"Rule firing drift (SecurityAlert proxy)\",\r\n Resource=tostring(AlertName),\r\n Status,\r\n Severity,\r\n // When=now(),\r\n Metric=strcat(\"CurrentWeek=\", Current, \"; PriorWeek=\", Prior,\r\n iff(isnull(DropRatio), \"\", strcat(\"; Drop%=\", round(DropRatio*100.0, 1)))),\r\n Details=\"A sudden stop/drop often indicates rule disabled/edited, missing upstream data, or schema/volume changes.\",\r\n Action=case(\r\n Status==\"Stopped\", \"Verify rule enabled and query still returns results; validate upstream ingestion and schema.\",\r\n \"Review recent tuning/threshold changes and upstream ingestion/volume shifts.\"\r\n )", "size": 0, "title": "β€œRule firing drift” looks for alert names that were firing in the previous week but stopped or dropped sharply in the current week, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Stopped", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50ch" } }, { "columnMatch": "Action", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50ch" } }, { "columnMatch": "HealthFlag", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "LastIncidentSeen_7d", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "162.996px" } }, { "columnMatch": "Incidents_7d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Incidents_prev90d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "CountsSeries_90d", "formatter": 10, "formatOptions": { "palette": "blackWhite" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - alerts - Copy - Copy" }, { "type": 1, "content": { "json": "This report groups incidents by Title and compares activity in the last 7 days against the previous 90-day period, producing a 90-day daily series for trend charts. Each Title receives a HealthFlag (Healthy / Warning / New / Unknown) based on counts and last-seen times to surface active, stale, or newly-emerging incident types. Use it to prioritise investigation, spot new incident classes, and monitor trends over time." }, "customWidth": "50", "name": "text - 9" }, { "type": 1, "content": { "json": "This report finds alert rules whose firing has stopped or dropped sharply by comparing the prior 7-day period to the most recent 7-day period. Alerts are flagged Stopped (went to zero) or Dropped (β‰₯80% decline with prior β‰₯10 alerts), with severity and a compact metric string. Use this to rapidly detect disabled/edited rules, upstream ingestion/schema regressions, or unintended tuning changes." }, "customWidth": "50", "name": "text - 9 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Last7Days =\r\n SecurityAlert\r\n | where TimeGenerated >= ago(7d)\r\n | summarize LastAlertSeen_7d = max(TimeGenerated),\r\n Alerts_7d = count()\r\n by ProductName;\r\nlet Previous90Days =\r\n SecurityAlert\r\n | where TimeGenerated between (ago(90d) .. ago(7d))\r\n | summarize LastAlertSeen_90d = max(TimeGenerated),\r\n Alerts_90d = count()\r\n by ProductName;\r\nPrevious90Days\r\n| join kind=fullouter Last7Days on ProductName\r\n| extend\r\n Alerts_7d = coalesce(Alerts_7d, 0),\r\n Alerts_90d = coalesce(Alerts_90d, 0)\r\n| extend HealthFlag = case(\r\n Alerts_7d > 0 and LastAlertSeen_7d >= ago(1d), \"Healthy\",\r\n Alerts_7d > 0 and LastAlertSeen_7d < ago(1d), \"Warning (no alerts <24h)\",\r\n Alerts_7d == 0 and Alerts_90d > 0, \"Warning (Low or No alerts)\",\r\n Alerts_7d > 0 and Alerts_90d == 0, \"New\",\r\n \"Unknown\"\r\n )\r\n| extend ProductName1 = iff(Alerts_7d > 0 and Alerts_90d == 0, ProductName1, \"\")\r\n| order by HealthFlag asc, LastAlertSeen_7d asc\r\n| project-rename PossiblyNewlyAdded = ProductName1\r\n| project HealthFlag, ProductName, LastAlertSeen_7d, Alerts_7d, LastAlertSeen_90d, Alerts_90d, PossiblyNewlyAdded", "size": 0, "title": "Heatmap and health check - compares Alerts counts from Products, which may indicate a data issue. Compares 90days to 7days", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "HealthFlag", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Alerts_7d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Alerts_90d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } } ], "filter": true, "sortBy": [ { "itemKey": "LastAlertSeen_7d", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "LastAlertSeen_7d", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "name": "query - alerts " }, { "type": 1, "content": { "json": "This report compares alert counts for each ProductName over the last 7 days vs the previous 90-day window and assigns a HealthFlag (Healthy / Warning / New / Unknown). It highlights product sources that have stopped or reduced alerting, those with no recent alerts, and newly appearing sources β€” enabling quick prioritisation of ingestion, tuning, or onboarding checks." }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Baseline comparison: last 7d vs previous 7d\r\n//Severity that flips to Warning/Critical on big increases\r\n//Metric = 7d GB (so the table still reads nicely)\r\n//Details includes % change + prior GB\r\n\r\nlet Window = 7d;\r\nlet Current =\r\nUsage\r\n| where TimeGenerated between (ago(Window) .. now())\r\n| where IsBillable == true\r\n| summarize GB_7d = sum(Quantity) / 1024.0 by DataType;\r\nlet Previous =\r\nUsage\r\n| where TimeGenerated between (ago(2*Window) .. ago(Window))\r\n| where IsBillable == true\r\n| summarize GB_prev7d = sum(Quantity) / 1024.0 by DataType;\r\nCurrent\r\n| join kind=fullouter Previous on DataType\r\n| extend\r\n DataType = coalesce(DataType, DataType1),\r\n GB_7d = coalesce(GB_7d, 0.0),\r\n GB_prev7d = coalesce(GB_prev7d, 0.0)\r\n| extend \r\n DeltaGB = GB_7d - GB_prev7d\r\n| extend DeltaPct = iif(GB_prev7d == 0.0 and GB_7d > 0.0, 100.0,\r\n iif(GB_prev7d == 0.0, 0.0, (DeltaGB / GB_prev7d) * 100.0))\r\n| extend\r\n Status = case(\r\n GB_prev7d > 0 and DeltaPct >= 50 and DeltaGB >= 5, \"Critical\",\r\n GB_prev7d > 0 and DeltaPct >= 25 and DeltaGB >= 2, \"Warning\",\r\n GB_prev7d == 0 and GB_7d >= 2, \"Warning\", // new billable source\r\n \"Info\"\r\n )\r\n| extend Severity = Status\r\n| top 10 by GB_7d desc\r\n| project\r\n //Category = \"Operations\",\r\n //Check = \"Top billable tables (Usage) - 7d vs prev 7d\",\r\n Resource = tostring(DataType),\r\n Status,\r\n Severity,\r\n //When = now(),\r\n Capacity = round(GB_7d, 2),\r\n Details = strcat(\r\n \"7d=\", round(GB_7d, 2), \"GB; prev7d=\", round(GB_prev7d, 2), \"GB; Ξ”=\",\r\n round(DeltaGB, 2), \"GB (\", round(DeltaPct, 1), \"%).\"\r\n ),\r\n Action = case(\r\n Status == \"Critical\", \"Investigate ingestion regression/noisy source; validate recent changes; tune diagnostics, DCR/DCE, connectors, or parsers.\",\r\n Status == \"Warning\", \"Review recent onboarding/changes; confirm expected volume; tune collection filters/parsers/diagnostics if unexpected.\",\r\n \"Use weekly to catch ingestion/cost regressions and noisy sources.\"\r\n )", "size": 0, "title": "Top billable Tables with Health check, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "Capacity", "formatter": 3, "formatOptions": { "palette": "whiteBlack" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "Action", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Review", "representation": "gray", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Investigate", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "HealthFlag", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Alerts_7d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Alerts_90d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "name": "query - alerts - Copy" }, { "type": 1, "content": { "json": "This report lists the top 10 billable data tables by 7-day GB and compares each to the previous 7-day window, flagging large increases as Warning or Critical (thresholds use both % and absolute GB). It helps quickly identify noisy or newly onboarded billable sources driving cost so you can validate changes and tune collection." }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelHealth\r\n | where TimeGenerated between (ago(7d) .. now())\r\n | where tostring(SentinelResourceType) has \"Analytics\"\r\n | where Status in (\"Failure\",\"Failed\",\"Warning\",\"Partial Success\",\"PartialSuccess\")\r\n | summarize\r\n LastEvent=max(TimeGenerated),\r\n Failures=countif(Status in (\"Failure\",\"Failed\")),\r\n Warnings=countif(Status == \"Warning\"),\r\n Partial=countif(Status in (\"Partial Success\",\"PartialSuccess\")),\r\n SampleReason=any(Reason),\r\n SampleDescription=any(Description)\r\n by RuleName=tostring(SentinelResourceName), RuleKind=tostring(SentinelResourceKind), Operation=tostring(OperationName)\r\n | extend Status = case(Failures>0, \"Failure\", Partial>0, \"Partial\", Warnings>0, \"Warning\", \"OK\")\r\n | extend Severity = case(Status==\"Failure\",\"High\", Status in (\"Partial\",\"Warning\"),\"Medium\", \"Low\")\r\n | project\r\n // Category=\"Analytics\",\r\n // Check=\"Rule execution health (SentinelHealth)\",\r\n Resource=strcat(RuleName, iff(isempty(RuleKind), \"\", strcat(\" [\", RuleKind, \"]\"))),\r\n Status,\r\n Severity,\r\n When=LastEvent,\r\n Metric=strcat(\"Failures=\", Failures, \"; Partial=\", Partial, \"; Warnings=\", Warnings, \"; Op=\", Operation),\r\n Details=strcat(\"Reason=\", tostring(SampleReason), \"; Desc=\", substring(tostring(SampleDescription), 0, 220)),\r\n Action=case(\r\n Status==\"Failure\", \"Open the health event; validate dependent tables, schema changes, query timeouts, thresholds; use rule insights/manual rerun.\",\r\n Status==\"Partial\", \"Confirm ingestion delay/partial data and rule settings; validate impacted connector(s).\",\r\n \"Review warning details; confirm rule remains effective.\"\r\n )", "size": 0, "title": "Rule firing health check (required SentinelHealth Table), count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Partial", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Failure", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Action", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Review", "representation": "gray", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Investigate", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Capacity", "formatter": 3, "formatOptions": { "palette": "whiteBlack" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "HealthFlag", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Critical", "representation": "4", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Warning", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Alerts_7d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Alerts_90d", "formatter": 20, "formatOptions": { "palette": "whiteBlack" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "name": "query - rule firing " }, { "type": 1, "content": { "json": "This report highlights Analytics rules with execution Failures, Partial runs, or Warnings in the last 7 days using SentinelHealth data. Each rule is assigned a severity and includes counts, last event time, and a sample reason/description. Use it to quickly detect and remediate rule execution issues before detection coverage is impacted." }, "name": "text - 13" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "connectors" }, "name": "group - connectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Agents", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat\r\n| summarize count_ = dcount(Computer) by bin(TimeGenerated, 7d)\r\n| order by TimeGenerated asc\r\n| serialize \r\n| extend changeInCount = count_ - prev(count_,1)\r\n| extend changeInPct = (changeInCount * 100) / prev(count_,1)\r\n\r\n", "size": 1, "title": "1. Weekly: Log Analytics Agent count change summary (7 days)", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "changeInCount", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "changeInPct", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "changePct", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5, "formatOptions": {} }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Environment", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Azure", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "magenta", "text": "{0}{1}" } ] } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5, "formatOptions": {} }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "labelSettings": [ { "columnId": "count_", "label": "Computer Count" }, { "columnId": "changeInCount", "label": "Change count " }, { "columnId": "changeInPct", "label": "Change (%)" } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - heartbeat" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat\r\n| summarize count_ = dcount(Computer) by bin(TimeGenerated, 7d)\r\n| order by TimeGenerated asc\r\n\r\n", "size": 1, "title": "1. Weekly: Log Analytics Agent count change summary", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "changeInCount", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "changePct", "formatter": 0, "formatOptions": {}, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5, "formatOptions": {} }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Environment", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Azure", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "magenta", "text": "{0}{1}" } ] } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5, "formatOptions": {} }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "name": "query - heartbeat 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "281e8743-964f-4e81-9683-7ad7af4504e7", "version": "KqlParameterItem/1.0", "name": "UnhealthyCriteria", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n { \"value\":\"1m\", \"label\":\"1 minute without heartbeat\", \"selected\":false },\r\n { \"value\":\"5m\", \"label\":\"5 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"30m\", \"label\":\"30 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"1h\", \"label\":\"1 hour without heartbeat\", \"selected\":true },\r\n { \"value\":\"2h\", \"label\":\"2 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"8h\", \"label\":\"8 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"1d\", \"label\":\"1 day without heartbeat\", \"selected\":false },\r\n { \"value\":\"2d\", \"label\":\"2 days without heartbeat\", \"selected\":false },\r\n { \"value\":\"7d\", \"label\":\"7 days without heartbeat\", \"selected\":false }\r\n]", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "EPStimerange", "value": "8h" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 42" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\r\n| extend State = iff(LastHeartbeat < ago({UnhealthyCriteria}), 'Unhealthy', 'Healthy')\r\n| extend TimeFromNow = now() - LastHeartbeat\r\n| extend [\"TimeAgo\"] = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Packed = pack_all()\r\n) on Computer\r\n| where TimeGenerated == LastHeartbeat\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| make-series InternalTrend=iff(count() > 0, 1, 0) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {UnhealthyCriteria} by Computer\r\n| extend Trend=array_slice(InternalTrend, array_length(InternalTrend) - 30, array_length(InternalTrend)-1)\r\n| extend (s_min, s_minId, s_max, s_maxId, s_avg, s_var, s_stdev) = series_stats(Trend)\r\n| project Computer, Trend, s_avg\r\n) on Computer\r\n| order by State, s_avg asc, TimeAgo\r\n| project [\"_ComputerName_\"] = Computer, [\"Computer\"]=strcat('πŸ–₯️ ', Computer), State, [\"Environment\"] = iff(ComputerEnvironment == \"Azure\", ComputerEnvironment, Category), [\"OS\"]=iff(isempty(OSName), OSType, OSName), [\"Azure Resource\"]=ResourceId, [\"Time\"]=strcat('πŸ•’ ', TimeAgo), [\"Heartbeat Trend\"]=Trend, [\"Details\"]=Packed\r\n\r\n", "size": 2, "title": "1. Weekly: Log Analytics Agent check", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "_ComputerName_", "formatter": 5, "formatOptions": {} }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Environment", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Azure", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "magenta", "text": "{0}{1}" } ] } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5, "formatOptions": {} }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "sortBy": [ { "itemKey": "Computer", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "Time", "label": "Last Heartbeat" } ] }, "sortBy": [ { "itemKey": "Computer", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "name": "query - Heartbeat agent check " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where \"{Subscription:Id}\" has subscriptionId or \"{Subscription}\" == \"\"\r\n//| where \"{resourceGroup:label}\" contains resourceGroup or \"{resourceGroup}\" == \"\"\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' \r\n| extend Computer = extract('virtualMachines/(.*)/extensions',1,id) \r\n| summarize count()", "size": 4, "title": "Machines with MMA", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - MMA" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where \"{Subscription:Id}\" has subscriptionId or \"{Subscription}\" == \"\"\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'AzureMonitorWindowsAgent' or name has 'AzureMonitorLinuxAgent' \r\n| extend AzureVM = extract('virtualMachines/(.*)/extensions',1,id), ArcVM = extract('machines/(.*)/extensions',1,id) \r\n| summarize count() by AzureVM, ArcVM, subscriptionId, resourceGroup \r\n| project AzureVM, ArcVM, resourceGroup\r\n| summarize count()", "size": 4, "title": "Machines with AMA", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - AMA" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where \"{Subscription:Id}\" has subscriptionId or \"{Subscription}\" == \"\"\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' or name has 'AzureMonitorWindowsAgent' or name has 'AzureMonitorLinuxAgent'\r\n| extend AzureVM = extract('virtualMachines/(.*)/extensions',1,id), ArcVM = extract('machines/(.*)/extensions',1,id)\r\n| summarize count() by AzureVM=tolower(AzureVM), ArcVM=tolower(ArcVM), subscriptionId, resourceGroup \r\n| extend hasBoth = iff(count_ > 1, 'Yes', 'No') | where count_ > 1 \r\n| join (resources | where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' \r\n| extend AzureVM = extract('virtualMachines/(.*)/extensions',1,id)) on AzureVM \r\n| summarize count()", "size": 4, "title": "Machines with Both Agents", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - both AMA & MMA" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where \"{Subscription:Id}\" has subscriptionId or \"{Subscription}\" == \"\"\r\n| where type has 'microsoft.compute/virtualmachines/extensions' or type has 'microsoft.hybridcompute/machines/extensions'\r\n| where name has 'MicrosoftMonitoringAgent' or name has 'OmsAgentForLinux' or name has 'AzureMonitorWindowsAgent' or name has 'AzureMonitorLinuxAgent'\r\n| extend AzureVM = extract('virtualMachines/(.*)/extensions',1,id), ArcVM = extract('machines/(.*)/extensions',1,id)\r\n| summarize count() by AzureVM=tolower(AzureVM), ArcVM=tolower(ArcVM), subscriptionId, resourceGroup, AgentType=name\r\n| extend hasBoth = iff(count_ > 1, 'Yes', 'No') //| where count_ > 1 \r\n\r\n", "size": 1, "title": "Machines with Both Agents, count: {$rowCount}", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "hasBoth", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "hasBoth", "sortOrder": 2 } ], "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "name": "query - both AMA & MMA - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "agents" }, "name": "group - Agents" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Workbooks", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/contentProductTemplates ?$filter=properties/contentKind eq 'Workbook'\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-09-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.packageId\",\"columnid\":\"packageId\"},{\"path\":\"properties.version\",\"columnid\":\"Installedversion\"},{\"path\":\"properties.packageVersion\",\"columnid\":\"packageVersion\"},{\"path\":\"properties.contentSchemaVersion\",\"columnid\":\"contentSchemaVersion\"},{\"path\":\"properties.author\",\"columnid\":\"author\"},{\"path\":\"properties.support\",\"columnid\":\"support\"},{\"path\":\"properties.categories\",\"columnid\":\"categories\"},{\"path\":\"properties.contentKind\",\"columnid\":\"contentKind\"},{\"path\":\"properties.isNew\",\"columnid\":\"isNew\"},{\"path\":\"properties.isPreview\",\"columnid\":\"isPreview\"},{\"path\":\"properties.isFeatured\",\"columnid\":\"isFeatured\"},{\"path\":\"properties.isDeprecated\",\"columnid\":\"isDeprecated\"},{\"path\":\"properties\",\"columnid\":\"properties\"},{\"path\":\"properties.contentId\",\"columnid\":\"contentId\"},{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"id\",\"columnid\":\"id\",\"columnType\":\"string\"}]}}]}", "size": 1, "title": "Workbook contentProductTemplates via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "id", "formatter": 1 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "name": "query - content product templates" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n | where type == \"microsoft.insights/workbooks\"\r\n | project properties.displayName, properties.timeModified, location, kind,\r\n resourceGroup, properties.category, properties.serializedData, properties.version, properties.tags[0] , properties.tags[1] , properties.userId, properties.sourceId, properties, id, name, tags\r\n| order by tostring(properties_timeModified) asc\r\n\r\n", "size": 1, "title": "Workbook Check with keyword search (ARG) πŸ”, count: {$rowCount}", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "properties_displayName", "formatter": 1 }, { "columnMatch": "kind", "formatter": 5 }, { "columnMatch": "properties_serializedData", "formatter": 5 }, { "columnMatch": "id", "formatter": 1 } ], "filter": true }, "sortBy": [] }, "name": "query - workbook - Private" }, { "type": 1, "content": { "json": "Matcching is basic, so may NOT always find a exact match " }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"99796294-0a70-4a31-8aae-d13948158155\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - content product templates\",\"rightTable\":\"query - workbook - Private\",\"leftColumn\":\"packageId\",\"rightColumn\":\"properties_tags_0\"}],\"projectRename\":[{\"originalName\":\"[query - content product templates].displayName\",\"mergedName\":\"displayName\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].packageId\",\"mergedName\":\"packageId\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].Installedversion\",\"mergedName\":\"Installedversion\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].packageVersion\",\"mergedName\":\"packageVersion\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].contentSchemaVersion\",\"mergedName\":\"contentSchemaVersion\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].author\",\"mergedName\":\"author\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].support\",\"mergedName\":\"support\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].categories\",\"mergedName\":\"categories\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].contentKind\",\"mergedName\":\"contentKind\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].isNew\",\"mergedName\":\"isNew\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].isPreview\",\"mergedName\":\"isPreview\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].isFeatured\",\"mergedName\":\"isFeatured\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].isDeprecated\",\"mergedName\":\"isDeprecated\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].properties\",\"mergedName\":\"properties\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].contentId\",\"mergedName\":\"contentId\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].name\",\"mergedName\":\"name\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - content product templates].id\",\"mergedName\":\"id\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_displayName\",\"mergedName\":\"properties_displayName\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_timeModified\",\"mergedName\":\"properties_timeModified\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].location\",\"mergedName\":\"location\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].kind\",\"mergedName\":\"kind\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_category\",\"mergedName\":\"properties_category\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_serializedData\",\"mergedName\":\"properties_serializedData\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_version\",\"mergedName\":\"properties_version\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_tags_0\",\"mergedName\":\"properties_tags_0\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_tags_1\",\"mergedName\":\"properties_tags_1\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_userId\",\"mergedName\":\"properties_userId\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties_sourceId\",\"mergedName\":\"properties_sourceId\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].properties\",\"mergedName\":\"properties1\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].id\",\"mergedName\":\"id1\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].name\",\"mergedName\":\"name1\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"},{\"originalName\":\"[query - workbook - Private].tags\",\"mergedName\":\"tags\",\"fromId\":\"99796294-0a70-4a31-8aae-d13948158155\"}]}", "size": 0, "title": "(preview) Check installed vs Content hub and enrich, Count: {$rowCount}", "queryType": 7, "sortBy": [] }, "showPin": false, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/ContentPackages\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-09-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.description\",\"columnid\":\"description\"},{\"path\":\"properties.id\",\"columnid\":\"id\"},{\"path\":\"properties.version\",\"columnid\":\"version\"},{\"path\":\"properties.source\",\"columnid\":\"source\"},{\"path\":\"properties.contentSchemaVersion\",\"columnid\":\"contentSchemaVersion\"},{\"path\":\"properties.author\",\"columnid\":\"author\"},{\"path\":\"properties.support\",\"columnid\":\"support\"},{\"path\":\"properties.categories\",\"columnid\":\"categories\"},{\"path\":\"properties.contentKind\",\"columnid\":\"contentKind\"}]}}]}", "size": 1, "title": "Content Packages via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 21 - Rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/ContentTemplates?$filter=properties/contentKind eq 'Workbook'\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-09-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.description\",\"columnid\":\"description\"},{\"path\":\"properties.id\",\"columnid\":\"id\"},{\"path\":\"properties.version\",\"columnid\":\"version\"},{\"path\":\"properties.source\",\"columnid\":\"source\"},{\"path\":\"properties.contentSchemaVersion\",\"columnid\":\"contentSchemaVersion\"},{\"path\":\"properties.author\",\"columnid\":\"author\"},{\"path\":\"properties.support\",\"columnid\":\"support\"},{\"path\":\"properties.categories\",\"columnid\":\"categories\"},{\"path\":\"properties.contentKind\",\"columnid\":\"contentKind\"}]}}]}", "size": 1, "title": "Content Templates via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 21 - Rules - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.Insights/workbooks\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2023-06-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}", "size": 1, "title": "Workbooks via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 21 - Rules - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "workbooks" }, "name": "group - workbooks" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Rules", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "fe3a12f8-7dcf-4cd3-93b8-e2cc504839eb", "version": "KqlParameterItem/1.0", "name": "countRuleTemplates", "type": 1, "description": "used in a Tile later - hidden", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"name\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "6905ed27-7271-4d75-9402-adf21383f002", "version": "KqlParameterItem/1.0", "name": "countActiveRules", "type": 1, "description": "used in a Tile later - hidden", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"name\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "6036245c-70ea-448d-9643-8d1c99b97742", "version": "KqlParameterItem/1.0", "name": "huntingQueries", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Workspace}/SavedSearches\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value..properties[?(@ == \\\"Hunting Queries\\\")]\",\"columns\":[]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 12 }, { "id": "3e824f1e-1817-448e-aacd-4abd357a2fad", "version": "KqlParameterItem/1.0", "name": "activeRulesUpdatedDate", "type": 1, "description": "used in a Tile later - hidden", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.lastModifiedUtc\",\"columnid\":\"lastMod\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "91c045fb-d5a1-406c-93d3-dbc92014bec8", "version": "KqlParameterItem/1.0", "name": "countbyCategory", "type": 1, "description": "used in a Tile later - hidden", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"kind\",\"columnid\":\"kind\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "b7fa83fb-adc9-4be0-b06e-9f61c41c649e", "version": "KqlParameterItem/1.0", "name": "countByActiveCategory", "type": 1, "description": "used in a Tile later - hidden", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"kind\",\"columnid\":\"kind\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "above", "queryType": 12 }, "name": "parameters - 27" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e437111e-7cb9-4295-bd47-522e5b924f6c", "version": "KqlParameterItem/1.0", "name": "RuleByDate", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup:name}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.createdDateUTC\",\"columnid\":\"createdDateUTC\"}]}}]}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "pills", "queryType": 12 }, "name": "parameters - 28" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Use Usage as a common Table that always exists - its data isnt required. \r\nunion isfuzzy=true \r\n(\r\n Usage\r\n | project a = '{countRuleTemplates:value}'\r\n | limit 1\r\n | extend a = split(a,\",\"), name_= \"Available Rule Templates\"\r\n | mv-expand a\r\n | summarize count(), rt=count() by name_\r\n),\r\n(\r\n Usage\r\n | project c = '{countActiveRules:value}', utw = '{activeRulesUpdatedDate:value}'\r\n | limit 1\r\n | extend c = split(c,\",\"), name_= \"Active Rules\", utw = split(utw,\",\")\r\n | mv-expand c, utw\r\n | summarize count(), updateThisWeek = countif(todatetime(utw) between (ago(7d) .. now())), ar=count() by name_\r\n),\r\n(\r\n Usage\r\n | project d = '{huntingQueries:value}'\r\n | limit 1\r\n | extend d = split(trim(@\"[^\\w]+\",d),\",\"), name_= \"Hunting Queries\"\r\n | mv-expand d to typeof(string)\r\n | summarize count() by name_\r\n)\r\n| order by name_ asc\r\n\r\n\r\n\r\n", "size": 4, "title": "3. Rule Statistics", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "subtitleContent": { "columnMatch": "name_" }, "leftContent": { "columnMatch": "updateThisWeek", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "up", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Updates in last 7days" } }, "showBorder": false } }, "customWidth": "50", "name": "query - Rule Statistics" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// use a table that exists - Usage was picked but isnt used.\r\nUsage\r\n| project a = split('{RuleByDate}',\",\")\r\n| limit 1\r\n| mv-expand todynamic(a)\r\n| project b= split(trim(@\"[^\\w]+\",tostring(a)),\"T\").[0]\r\n| summarize count() by todatetime(b)\r\n| order by b asc\r\n| top 10 by b ", "size": 1, "title": "Rule templates vs. created by Date", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "categoricalbar" }, "customWidth": "50", "name": "query - Rule template bar chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " Usage\r\n | project a = '{countbyCategory:value}'\r\n | limit 1\r\n | extend a = split(trim(@\"[^\\w]+\",a),\",\") \r\n | mv-expand a\r\n | summarize count() by trim(\" \", tostring(a))\r\n | order by count_ desc", "size": 0, "title": "Rule Templates by Type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "coldHot" } } ], "labelSettings": [ { "columnId": "Column1", "label": "Rule Type" } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "subtitleContent": { "columnMatch": "name_" }, "leftContent": { "columnMatch": "updateThisWeek", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "up", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Updates in last 7days" } }, "showBorder": false } }, "customWidth": "50", "name": "query - Rule templates by Type" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " Usage\r\n | project a = '{countByActiveCategory:value}'\r\n | limit 1\r\n | extend a = split(trim(@\"[^\\w]+\",a),\",\") \r\n | mv-expand a\r\n | summarize count() by trim(\" \", tostring(a))\r\n | order by count_ desc", "size": 0, "title": "3.Active Rules by Type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "coldHot" } } ], "sortBy": [ { "itemKey": "Column1", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "Column1", "label": "Rule type" }, { "columnId": "count_", "label": "Count" } ] }, "sortBy": [ { "itemKey": "Column1", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "subtitleContent": { "columnMatch": "name_" }, "leftContent": { "columnMatch": "updateThisWeek", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "up", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Updates in last 7days" } }, "showBorder": false } }, "customWidth": "50", "name": "query - 28 - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e3d05f38-33a6-4718-9a3a-d16b2629b094", "version": "KqlParameterItem/1.0", "name": "showRules", "label": "Show Rules", "type": 10, "description": "Enables you to see ALL or SelectRule Types to show", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"all\", \"label\": \"Show All\", \"selected\":true },\r\n { \"value\": \"filter\", \"label\": \"Filtered View\" }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 15" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Filtered View", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "3d9b40a8-fd74-482c-b482-0d90c89abd28", "version": "KqlParameterItem/1.0", "name": "selectRuleType", "type": 2, "description": "Select the Rule Type ", "isRequired": true, "query": " Usage\r\n | project a = '{countbyCategory:value}'\r\n | limit 1\r\n | extend a = split(trim(@\"[^\\w]+\",a),\",\") \r\n | mv-expand a\r\n | distinct tostring(a)\r\n | project a = trim(\" \",a)\r\n | distinct a\r\n | project value=strcat(\"@.kind=='\",a,\"'\") ,display=a, selected=iif(a=='Scheduled',true,false)\r\n | order by display asc\r\n", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 38" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?({selectRuleType})]\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"properties.status\",\"columnid\":\"status\"},{\"path\":\"properties.createdDateUTC\",\"columnid\":\"createdDateUTC\"},{\"path\":\"properties.lastUpdatedDateUTC\",\"columnid\":\"lastUpdatedDateUTC\"},{\"path\":\"properties.requiredDataConnectors\",\"columnid\":\"requiredDataConnectors\"},{\"path\":\"properties.productFilter\",\"columnid\":\"productFilter\"},{\"path\":\"properties.requiredDataConnectors[:1].connectorId\",\"columnid\":\"connectorName\"},{\"path\":\"properties.requiredDataConnectors[*].dataTypes[0]\",\"columnid\":\"connectorTable\"},{\"path\":\"properties.query\",\"columnid\":\"queryText\"}]}}]}", "size": 1, "title": "3. Rule Templates via Rest API. {selectRuleType}, count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "showPin": false, "name": "query - 21 - Rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?({selectRuleType})]\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"properties.enabled\",\"columnid\":\"status\"},{\"path\":\"properties.lastModifiedUtc\",\"columnid\":\"lastModifiedUtc\"},{\"path\":\"properties.queryFrequency\",\"columnid\":\"queryFrequency\"},{\"path\":\"properties.queryPeriod\",\"columnid\":\"queryPeriod\"},{\"path\":\"properties.productFilter\",\"columnid\":\"productFilter\"},{\"path\":\"properties.tactics\",\"columnid\":\"tactics\"},{\"path\":\"properties.techniques\",\"columnid\":\"techniques\"},{\"path\":\"properties.query\",\"columnid\":\"queryText\"},{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"properties\",\"columnid\":\"propertiesAll\"}]}}]}", "size": 1, "title": "3a. Active Rules via Rest API. {selectRuleType}, count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Enabled" } ] } }, { "columnMatch": "tactics", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "queryFrequency", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "queryFrequency", "sortOrder": 2 } ] }, "showPin": false, "name": "query - 21 - Rules in use " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"8c021a32-814f-445a-8f20-55847f6750c2\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - 21 - Rules\",\"rightTable\":\"query - 21 - Rules in use \",\"leftColumn\":\"displayName\",\"rightColumn\":\"displayName\"}],\"projectRename\":[{\"originalName\":\"[query - 21 - Rules].displayName\",\"mergedName\":\"displayName\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].kind\",\"mergedName\":\"kind\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].status\",\"mergedName\":\"status\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].createdDateUTC\",\"mergedName\":\"createdDateUTC\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].lastUpdatedDateUTC\",\"mergedName\":\"lastUpdatedDateUTC\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].queryText\",\"mergedName\":\"queryText\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules in use ].lastModifiedUtc\",\"mergedName\":\"lastModifiedUtc\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules in use ].queryText\",\"mergedName\":\"queryText1\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"MismatchedQuery\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"queryText\",\"operator\":\"!=\",\"rightValType\":\"column\",\"rightVal\":\"queryText1\",\"resultValType\":\"static\",\"resultVal\":\"Query Text is different\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[query - 21 - Rules in use ].name\",\"mergedName\":\"name\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].techniques\",\"mergedName\":\"techniques\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].queryFrequency\",\"mergedName\":\"queryFrequency\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].queryPeriod\",\"mergedName\":\"queryPeriod\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].propertiesAll\",\"mergedName\":\"propertiesAll\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].displayName\"},{\"originalName\":\"[query - 21 - Rules in use ].kind\"},{\"originalName\":\"[query - 21 - Rules in use ].status\"},{\"originalName\":\"[query - 21 - Rules in use ].productFilter\"},{\"originalName\":\"[query - 21 - Rules in use ].tactics\"},{\"originalName\":\"[query - 21 - Rules].requiredDataConnectors\"},{\"originalName\":\"[query - 21 - Rules].productFilter\"},{\"originalName\":\"[query - 21 - Rules].connectorName\"},{\"originalName\":\"[query - 21 - Rules].connectorTable\"}]}", "size": 0, "title": "3a. Compare Deployed Rules to Rules api. Count: {$rowCount}", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "queryText1", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "MismatchedQuery", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Query", "representation": "pink", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "lastModifiedUtc", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "lastModifiedUtc", "label": "Rule in Use - LastModifiedUTC" }, { "columnId": "queryText1", "label": "Rule in Use - QueryText" } ] }, "sortBy": [ { "itemKey": "lastModifiedUtc", "sortOrder": 2 } ] }, "showPin": false, "name": "query - 30 merge Rules" } ] }, "conditionalVisibility": { "parameterName": "showRules", "comparison": "isEqualTo", "value": "filter" }, "name": "group - Filtered Rules" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "View All Rules", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"properties.status\",\"columnid\":\"status\"},{\"path\":\"properties.createdDateUTC\",\"columnid\":\"createdDateUTC\"},{\"path\":\"properties.lastUpdatedDateUTC\",\"columnid\":\"lastUpdatedDateUTC\"},{\"path\":\"properties.requiredDataConnectors\",\"columnid\":\"requiredDataConnectors\"},{\"path\":\"properties.productFilter\",\"columnid\":\"productFilter\"},{\"path\":\"properties.requiredDataConnectors[:1].connectorId\",\"columnid\":\"connectorName\"},{\"path\":\"properties.requiredDataConnectors[*].dataTypes[0]\",\"columnid\":\"connectorTable\"},{\"path\":\"properties.query\",\"columnid\":\"queryText\"}]}}]}", "size": 1, "title": "3. Rule Templates via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "showPin": false, "name": "query - 21 - Rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"properties.enabled\",\"columnid\":\"status\"},{\"path\":\"properties.lastModifiedUtc\",\"columnid\":\"lastModifiedUtc\"},{\"path\":\"properties.queryFrequency\",\"columnid\":\"queryFrequency\"},{\"path\":\"properties.queryPeriod\",\"columnid\":\"queryPeriod\"},{\"path\":\"properties.productFilter\",\"columnid\":\"productFilter\"},{\"path\":\"properties.tactics\",\"columnid\":\"tactics\"},{\"path\":\"properties.techniques\",\"columnid\":\"techniques\"},{\"path\":\"properties.query\",\"columnid\":\"queryText\"},{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"properties.alertRuleTemplateName\",\"columnid\":\"templateId\"}]}}]}", "size": 1, "title": "3a. Active Rules via Rest API. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Enabled" } ] } }, { "columnMatch": "tactics", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "productFilter", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "productFilter", "sortOrder": 1 } ] }, "showPin": false, "name": "query - 21 - Rules in use " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"8c021a32-814f-445a-8f20-55847f6750c2\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - 21 - Rules\",\"rightTable\":\"query - 21 - Rules in use \",\"leftColumn\":\"displayName\",\"rightColumn\":\"displayName\"}],\"projectRename\":[{\"originalName\":\"[query - 21 - Rules].displayName\",\"mergedName\":\"displayName\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].kind\",\"mergedName\":\"kind\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].status\",\"mergedName\":\"status\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"MismatchedQuery\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"queryText\",\"operator\":\"!=\",\"rightValType\":\"column\",\"rightVal\":\"queryText1\",\"resultValType\":\"static\",\"resultVal\":\"Query Text is different\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[query - 21 - Rules].createdDateUTC\",\"mergedName\":\"createdDateUTC\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].lastUpdatedDateUTC\",\"mergedName\":\"lastUpdatedDateUTC\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules].queryText\",\"mergedName\":\"queryText\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules in use ].lastModifiedUtc\",\"mergedName\":\"lastModifiedUtc\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules in use ].queryText\",\"mergedName\":\"queryText1\",\"fromId\":\"8c021a32-814f-445a-8f20-55847f6750c2\"},{\"originalName\":\"[query - 21 - Rules in use ].name\",\"mergedName\":\"name\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].techniques\",\"mergedName\":\"techniques\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].queryFrequency\",\"mergedName\":\"queryFrequency\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].queryPeriod\",\"mergedName\":\"queryPeriod\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].id\",\"mergedName\":\"id\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].templateId\",\"mergedName\":\"templateId\",\"fromId\":\"unknown\"},{\"originalName\":\"[query - 21 - Rules in use ].displayName\"},{\"originalName\":\"[query - 21 - Rules in use ].kind\"},{\"originalName\":\"[query - 21 - Rules in use ].status\"},{\"originalName\":\"[query - 21 - Rules in use ].productFilter\"},{\"originalName\":\"[query - 21 - Rules in use ].tactics\"},{\"originalName\":\"[query - 21 - Rules].requiredDataConnectors\"},{\"originalName\":\"[query - 21 - Rules].productFilter\"},{\"originalName\":\"[query - 21 - Rules].connectorName\"},{\"originalName\":\"[query - 21 - Rules].connectorTable\"}]}", "size": 0, "title": "3a. Compare the deployed Rule to the original Rules from the Sentinel Github. Look for \"mismatched Query\" if the query text differs. Count: {$rowCount}", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "queryText1", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "MismatchedQuery", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Query", "representation": "pink", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "lastModifiedUtc", "label": "Rule in Use - LastModifiedUTC" }, { "columnId": "queryText1", "label": "Rule in Use - QueryText" } ] }, "sortBy": [] }, "showPin": false, "name": "query - 30 merge Rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.description\",\"columnid\":\"description\"},{\"path\":\"properties.queryFrequency\",\"columnid\":\"queryFrequency\"},{\"path\":\"properties.queryPeriod\",\"columnid\":\"queryPeriod\"},{\"path\":\"properties.triggerOperator\",\"columnid\":\"triggerOperator\"},{\"path\":\"properties.triggerThreshold\",\"columnid\":\"triggerThreshold\"},{\"path\":\"properties.eventGroupingSettings.aggregationKind\",\"columnid\":\"eventGroupingSettings\"},{\"path\":\"properties.severity\",\"columnid\":\"severity\"},{\"path\":\"properties.query\",\"columnid\":\"query\"},{\"path\":\"properties.suppresionDuration\",\"columnid\":\"suppresionDuration\"},{\"path\":\"properties.suppresionEnabled\",\"columnid\":\"suppresionEnabled\"},{\"path\":\"properties.incidentConfiguration\",\"columnid\":\"incidentConfiguration\"},{\"path\":\"properties.entityMappings\",\"columnid\":\"entityMappings\"},{\"path\":\"properties.tactics\",\"columnid\":\"tactics\"},{\"path\":\"properties.techniques\",\"columnid\":\"techniques\"},{\"path\":\"properties.enabled\",\"columnid\":\"enabled\"}]}}]}", "size": 1, "title": "Active Rules - showing Frequency, Triggers and Grouping. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "triggerThreshold", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "eventGroupingSettings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Medium", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "Sev4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "entityMappings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "tactics", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Enabled" } ] } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } } ], "filter": true, "sortBy": [ { "itemKey": "techniques", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "techniques", "sortOrder": 2 } ] }, "showPin": false, "name": "query - 21 - Rules in use - by settings" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Workspace}/SavedSearches\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"},{\"key\":\"$orderby\",\"value\":\"properties/createdDateUTC desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.category == \\\"Hunting Queries\\\")]\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.query\",\"columnid\":\"query\"},{\"path\":\"properties.tags\",\"columnid\":\"tags\"},{\"path\":\"properties.version\",\"columnid\":\"version\"},{\"path\":\"id\",\"columnid\":\"id_\"},{\"path\":\"etag\",\"columnid\":\"etag\"}]}}]}", "size": 1, "title": "Active Hunting Rules - showing all Data. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "tags", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "triggerThreshold", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "eventGroupingSettings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Medium", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "Sev4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "entityMappings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "tactics", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Enabled" } ] } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } } ], "filter": true }, "sortBy": [] }, "showPin": false, "name": "query - 21 - Rules in use - Hunting " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity \r\n| where OperationNameValue startswith \"MICROSOFT.SECURITYINSIGHTS/ALERTRULES\" or OperationNameValue startswith 'Microsoft.SecurityInsights/automationRules'\r\n| summarize count(), arg_max(TimeGenerated, OperationName, Caller, CallerIpAddress, Category, Level, Resource) by OperationName, Caller, CallerIpAddress, Category, Level, Resource, Properties\r\n| order by TimeGenerated desc\r\n", "size": 1, "title": "3a. Audit of Rules in AzureActivity - Detailed, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "exportFieldName": "Resource", "exportParameterName": "exportResource", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Update", "representation": "orange", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Delete", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Properties", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "query - 31 - AuditRules All" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\",\"mergeType\":\"innerunique\",\"leftTable\":\"query - 21 - Rules in use \",\"rightTable\":\"query - 31 - AuditRules All\",\"leftColumn\":\"name\",\"rightColumn\":\"Resource\"}],\"projectRename\":[{\"originalName\":\"[query - 21 - Rules in use ].displayName\",\"mergedName\":\"displayName\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].kind\",\"mergedName\":\"kind\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].OperationName\",\"mergedName\":\"OperationName\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Caller\",\"mergedName\":\"Caller\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].lastModifiedUtc\",\"mergedName\":\"lastModifiedUtc\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].queryFrequency\",\"mergedName\":\"queryFrequency\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].queryPeriod\",\"mergedName\":\"queryPeriod\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].productFilter\",\"mergedName\":\"productFilter\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].tactics\",\"mergedName\":\"tactics\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].status\",\"mergedName\":\"status\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].techniques\",\"mergedName\":\"techniques\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].queryText\",\"mergedName\":\"queryText\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].name\",\"mergedName\":\"name\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 21 - Rules in use ].templateId\",\"mergedName\":\"templateId\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].CallerIpAddress\",\"mergedName\":\"CallerIpAddress\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Category\",\"mergedName\":\"Category\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Level\",\"mergedName\":\"Level\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Resource\",\"mergedName\":\"Resource\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Properties\",\"mergedName\":\"Properties\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].count_\",\"mergedName\":\"count_\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].TimeGenerated\",\"mergedName\":\"TimeGenerated\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].Resource1\",\"mergedName\":\"Resource1\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c7da\"},{\"originalName\":\"[query - 31 - AuditRules All].OperationName1\"},{\"originalName\":\"[query - 31 - AuditRules All].Caller1\"},{\"originalName\":\"[query - 31 - AuditRules All].CallerIpAddress1\"},{\"originalName\":\"[query - 31 - AuditRules All].Category1\"},{\"originalName\":\"[query - 31 - AuditRules All].Level1\"}]}", "size": 0, "title": "Audit of Active Rules vs. AzureActivity Table activity, count: {$rowCount}", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "Properties", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ], "filter": true } }, "showPin": false, "name": "query - active rules vs activity table" } ] }, "conditionalVisibility": { "parameterName": "showRules", "comparison": "isEqualTo", "value": "all" }, "name": "group -All Rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity \r\n| where OperationNameValue startswith \"MICROSOFT.SECURITYINSIGHTS/ALERTRULES\" or OperationNameValue startswith 'Microsoft.SecurityInsights/automationRules'\r\n| summarize count(), arg_max(TimeGenerated, OperationName, Caller, CallerIpAddress, Category, Level, Resource) by OperationName//, Caller, CallerIpAddress, Category, Level, Resource\r\n| order by TimeGenerated desc\r\n", "size": 4, "title": "3a. Audit of Rules in AzureActivity, count: {$rowCount}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Update", "representation": "orange", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Delete", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ], "filter": true } }, "name": "query - 31" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/automationRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-01-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.triggeringLogic.isEnabled\",\"columnid\":\"IsEnabled\"},{\"path\":\"name\",\"columnid\":\"nameGUID\"},{\"path\":\"properties.order\",\"columnid\":\"order\"},{\"path\":\"properties.createdTimeUtc\",\"columnid\":\"createdTimeUtc\"},{\"path\":\"properties.lastModifiedTimeUtc\",\"columnid\":\"lastlastModifiedTimeUtc\"},{\"path\":\"properties.createdBy.userPrincipalName\",\"columnid\":\"createdBy\"},{\"path\":\"properties.lastModifiedBy.name\",\"columnid\":\"lastModifiedBy\"},{\"path\":\"properties.triggeringLogic\",\"columnid\":\"triggeringLogic\"},{\"path\":\"properties.createdBy\",\"columnid\":\"propertiesCreatedBy\"},{\"path\":\"properties.lastModifiedBy\",\"columnid\":\"propertiesLastModifiedBy\"}]}}]}", "size": 1, "title": "3. automationRules via Rest API", "exportFieldName": "nameGUID", "exportParameterName": "exportNameGUID", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "IsEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "true", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "true{1}" } ] } }, { "columnMatch": "requiredDataConnectors", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "Data Connectors", "linkIsContextBlade": true } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true }, "sortBy": [] }, "name": "query - 21 - automationRules" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "c1f77487-5aee-4f0d-a16b-4ca6de161272", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Detections", "linkTarget": "Url", "linkLabel": "https://github.com/Azure/Azure-Sentinel/tree/master/", "preText": "3. GitHub Alert Rules, Workbooks, Hunting queries, and Playbooks", "style": "link" } ] }, "name": "links - 47 - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "rules" }, "name": "group - rules" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.Logic/workflows/\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2019-05-01\"},{\"key\":\"$orderby\",\"value\":\"createdTime desc\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"location\",\"columnid\":\"location\"},{\"path\":\"properties.provisioningState\",\"columnid\":\"provisioningState\"},{\"path\":\"properties.createdTime\",\"columnid\":\"createdTimeUTC\"},{\"path\":\"properties.changedTime\",\"columnid\":\"changedTimeUTC\"},{\"path\":\"properties\",\"columnid\":\"properties\"},{\"path\":\"properties.state\",\"columnid\":\"Enabled\"}]}}]}", "size": 0, "title": "3b. Playbooks via Rest API, count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Disabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "state", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Succeeded", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "name", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "name", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "playbooks" }, "name": "query - Playbooks" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 30d;\r\n\r\nAzureDiagnostics\r\n| where ResourceProvider == \"MICROSOFT.LOGIC\"\r\n| where Category has \"WorkflowRuntime\"\r\n| where TimeGenerated >= ago(lookback)\r\n// Friendly playbook name from ResourceId\r\n| extend Playbook = extract(@\"/WORKFLOWS/([^/]+)/RUNS/\", 1, toupper(ResourceId))\r\n", "size": 0, "title": "Playbooks Status, count: {$rowCount}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Enabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Disabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "state", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Succeeded", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "playbooks" }, "name": "query - Playbooks - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Content Hub Solutions", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/metadata\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2022-06-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"properties.source.name\",\"columnid\":\"friendlyName\"},{\"path\":\"type\",\"columnid\":\"type\"},{\"path\":\"properties.dependencies.criteria\",\"columnid\":\"dependencies\"},{\"path\":\"properties.firstPublishDate\",\"columnid\":\"firstPublished\"},{\"path\":\"properties.lastPublishDate\",\"columnid\":\"lastPublished\"},{\"path\":\"systemData.createdAt\",\"columnid\":\"createdAt\"},{\"path\":\"systemData.createdBy\",\"columnid\":\"createdBy\"},{\"path\":\"systemData.lastModifiedAt\",\"columnid\":\"lastModifiedAt\"},{\"path\":\"systemData.lastModifiedBy\",\"columnid\":\"lastModifiedBy\"},{\"path\":\"systemData\",\"columnid\":\"systemData\"},{\"path\":\"properties\",\"columnid\":\"properties\"},{\"path\":\"name\",\"columnid\":\"name\"}]}}]}", "size": 1, "title": "Content Hub, Solutions deployed. count: {$rowCount}", "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "dependencies", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "triggerThreshold", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "eventGroupingSettings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Medium", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "Sev4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "entityMappings", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "tactics", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "kind", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Enabled" } ] } }, { "columnMatch": "queryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "resourcegroup", "formatter": 14, "formatOptions": { "linkTarget": null, "showIcon": true } } ], "filter": true }, "sortBy": [] }, "showPin": false, "name": "query - Solutions" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "content" }, "name": "group - content hub" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "SubGroup: Retention", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/tables?api-version=2025-07-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 4, "title": "Retention settings for All Tables", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "rowLimit": 1000, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "ShowHiddenObjects", "comparison": "isEqualTo", "value": "Yes" }, "name": "TableRetentionQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Size'] = size,\r\n IsBillable\r\n| order by Table asc", "size": 0, "title": "Tables Found in the {WorkspaceName} workspace", "timeContextFromParameter": "TimeRange", "exportFieldName": "DataType", "exportParameterName": "DataType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Table Size", "formatter": 0, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } } ], "sortBy": [ { "itemKey": "IsBillable", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IsBillable", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "ShowHiddenObjects", "comparison": "isEqualTo", "value": "Yes" }, "name": "LAWTableQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"LAW Table Size\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Is Archived\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"ArchiveRetention\",\"operator\":\">\",\"rightValType\":\"static\",\"rightVal\":\"0\",\"resultValType\":\"static\",\"resultVal\":\"Yes\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"No\"}}]},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"unknown\"},{\"originalName\":\"[LAWTableQuery].DataType\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].size\"},{\"originalName\":\"[LAWTableQuery].Estimated Data Archive Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Ingestion Cost\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"}]}", "size": 1, "title": "Table details, count: {$rowCount}", "noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TableName", "parameterName": "TableName", "parameterType": 1 }, { "fieldName": "TablePlan", "parameterName": "TablePlan", "parameterType": 1 }, { "fieldName": "InteractiveRetention", "parameterName": "InteractiveRetention", "parameterType": 1 }, { "fieldName": "ArchiveRetention", "parameterName": "ArchiveRetention", "parameterType": 1 }, { "fieldName": "TotalRetention", "parameterName": "TotalRetention", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "TableName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35.2857ch" } }, { "columnMatch": "TableType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15.8571ch" } }, { "columnMatch": "TablePlan", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Auxiliary", "text": "Auxiliary/data lake" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ], "customColumnWidthSetting": "20ch" } }, { "columnMatch": "InteractiveRetention", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "ArchiveRetention", "formatter": 4, "formatOptions": { "min": 0, "max": 2555, "palette": "blue", "customColumnWidthSetting": "20.8571ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetention", "formatter": 4, "formatOptions": { "min": 90, "max": 2555, "palette": "turquoise", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Is Archived", "color": "blue" } ] }, "customColumnWidthSetting": "18.2857ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "LAW Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "lastPlanModifiedDate", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "33.1429ch" } }, { "columnMatch": "Is Archived", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Yes", "representation": "Clock", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "IsBillable", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "TableInteractivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26.5714ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TableArchivePeriod", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "TotalRetentionPeriod", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "{workspaceRetention}", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ], "customColumnWidthSetting": "23.4286ch" }, "numberFormat": { "unit": 27, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 39, "options": { "style": "decimal" } } }, { "columnMatch": "Estimated Ingestion Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Esitmated Workspace Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "Estimated Data Archive Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency" } } }, { "columnMatch": "TableSize", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "SizeUnit", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Last Updated Time", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "26ch" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_TablePlan_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_TablePlan_2", "sortOrder": 2 } ] }, "name": "query -Table Details " } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "retention" }, "name": "Retention" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Weekly" }, "name": "group - weekly", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Monthly", "items": [ { "type": 1, "content": { "json": "Monthly Operational Tasks\t\r\n1. Log Analytics Agent\r\nEnsure the agent is up-to-date and auto-upgrades are working. For those not auto upgraded, perform a manual update.\r\n2. Log Analytics Workspace\t\r\nReview that your Log Analytics Workspace retention policy still aligns with your current configuration. Run the Data Usage queries to help maintain costs and retention determinations.\r\n3. Ad-hoc: \tAccess review\r\nHas your SOC team changed? Review RBAC and IAM to verify those that need access have proper access – and those accounts no longer needing access are removed.\r\n4. Ad-hoc: \tReview workspace locations\r\nAre your workspaces in the right Regions, or are there any new ones?\t\r\n\t", "style": "success" }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "text - 46 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/providers/microsoft.insights/myworkbooks\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-02-12\"},{\"key\":\"$orderby\",\"value\":\"properties/timeModified desc\"},{\"key\":\"$top\",\"value\":\"10\"},{\"key\":\"\",\"value\":\"\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"WorkbookName\"},{\"path\":\"properties.timeModified\",\"columnid\":\"TimeModified\"},{\"path\":\"location\",\"columnid\":\"Location\"},{\"path\":\"id\",\"columnid\":\"resourceGroup\"}]}}]}", "size": 4, "title": "Top 10: Shared and Private Workbooks", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "resourceGroup", "formatter": 14, "formatOptions": { "linkTarget": null } } ], "sortBy": [ { "itemKey": "TimeModified", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeModified", "sortOrder": 2 } ] }, "conditionalVisibilities": [ { "parameterName": "SelectedTab1", "comparison": "isEqualTo", "value": "Weekly" }, { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "query - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let window = 30d;\r\nlet end0 = now();\r\nlet start0 = end0 - window;\r\nlet end1 = start0;\r\nlet start1 = end1 - window;\r\n\r\nlet curGB =\r\ntoscalar(\r\n Usage\r\n | where TimeGenerated between (start0 .. end0)\r\n | summarize GB = sum(Quantity)/1024\r\n);\r\n\r\nlet prevGB =\r\ntoscalar(\r\n Usage\r\n | where TimeGenerated between (start1 .. end1)\r\n | summarize GB = sum(Quantity)/1024\r\n);\r\n\r\nlet changePct = iff(prevGB == 0.0, real(0), 100.0 * (curGB - prevGB) / prevGB);\r\n\r\nprint\r\n Current30d_GB = round(curGB,2),\r\n Prev30d_GB = round(prevGB,2),\r\n ChangePct = round(changePct,1),\r\n RAG = case(changePct >= 25.0, \"πŸ”΄ Red\", changePct >= 10.0, \"🟠 Amber\", \"🟒 Green\")", "size": 4, "title": "KPI: Ingestion GB this month", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "tileSettings": { "showBorder": false } }, "customWidth": "33", "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let window = 30d;\r\nlet end0 = now();\r\nlet start0 = end0 - window;\r\nlet end1 = start0;\r\nlet start1 = end1 - window;\r\n\r\nlet cur =\r\ntoscalar(SecurityIncident | where CreatedTime between (start0 .. end0) | summarize c=count());\r\n\r\nlet prev =\r\ntoscalar(SecurityIncident | where CreatedTime between (start1 .. end1) | summarize c=count());\r\n\r\nlet changePct = iff(prev == 0, real(0), 100.0 * (cur - prev) / prev);\r\n\r\nprint\r\n Current30d_Incidents = cur,\r\n Prev30d_Incidents = prev,\r\n ChangePct = round(changePct,1),\r\n RAG = case(changePct >= 25.0, \"πŸ”΄ Red\", changePct >= 10.0, \"🟠 Amber\", \"🟒 Green\")", "size": 4, "title": "KPI: Incidents created this month", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "33", "name": "query - 12 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let window = 30d;\r\nlet end0 = now();\r\nlet start0 = end0 - window;\r\nlet end1 = start0;\r\nlet start1 = end1 - window;\r\nlet end2 = start1;\r\nlet start2 = end2 - window;\r\n\r\nlet data =\r\nSecurityIncident\r\n| where tostring(Status) == \"Closed\"\r\n| extend MTTC_Min = datetime_diff('minute', LastModifiedTime, CreatedTime)\r\n| extend Period = case(\r\n CreatedTime between (start0 .. end0), \"Last 30d\",\r\n CreatedTime between (start1 .. end1), \"Prev 30d\",\r\n CreatedTime between (start2 .. end2), \"Prev2 30d\",\r\n \"\"\r\n)\r\n| where Period != \"\"\r\n| summarize P90_MTTC_Min = round(percentile(MTTC_Min, 90), 0) by Period;\r\n\r\nlet pivoted =\r\ndata\r\n| evaluate pivot(Period, max(P90_MTTC_Min))\r\n| extend Prev2 = coalesce(['Prev2 30d'], real(0))\r\n| extend Prev1 = coalesce(['Prev 30d'], real(0))\r\n| extend Cur = coalesce(['Last 30d'], real(0));\r\n\r\npivoted\r\n| extend ChangeVsPrevPct =\r\n iff(Prev1 == 0.0, real(0), round(100.0 * (Cur - Prev1) / Prev1, 1))\r\n| extend RAG = case(\r\n Cur > 10080, \"πŸ”΄ Red\",\r\n Cur > 4320, \"🟠 Amber\",\r\n \"🟒 Green\"\r\n )\r\n| project\r\n Prev2_30d_Min = Prev2,\r\n Prev1_30d_Min = Prev1,\r\n Current_30d_Min = Cur,\r\n ChangeVsPrevPct,\r\n RAG", "size": 4, "title": "KPI: P90 time-to-close (minutes for worst 10%) rolling average", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "33", "name": "query - 12 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let window = 30d;\r\nlet end0 = now();\r\nlet start0 = end0 - window;\r\nlet end1 = start0;\r\nlet start1 = end1 - window;\r\n\r\nlet base =\r\nAzureDiagnostics\r\n| where ResourceProvider == \"MICROSOFT.LOGIC\"\r\n| where Category has \"WorkflowRuntime\"\r\n| where TimeGenerated between (start1 .. end0)\r\n| extend Period = case(\r\n TimeGenerated between (start0 .. end0), \"Current30d\",\r\n TimeGenerated between (start1 .. end1), \"Prev30d\",\r\n \"\"\r\n)\r\n| where Period != \"\"\r\n| extend Playbook = extract(@\"/WORKFLOWS/([^/]+)/RUNS/\", 1, toupper(ResourceId))\r\n| extend StatusRaw = coalesce(\r\n column_ifexists(\"status_s\", \"\"),\r\n column_ifexists(\"Status_s\", \"\"),\r\n column_ifexists(\"resultType_s\", \"\"),\r\n column_ifexists(\"ResultType\", \"\"),\r\n \"\"\r\n)\r\n| extend Status = tolower(tostring(StatusRaw))\r\n| extend Outcome = case(\r\n Status in (\"succeeded\",\"success\"), \"Success\",\r\n Status in (\"failed\",\"failure\",\"timedout\",\"timeout\",\"cancelled\",\"canceled\"), \"Failure\",\r\n isempty(Status), \"Unknown\",\r\n \"Other\"\r\n);\r\n\r\nbase\r\n| summarize\r\n Total = count(),\r\n Success = countif(Outcome == \"Success\"),\r\n Failure = countif(Outcome == \"Failure\"),\r\n Other = countif(Outcome == \"Other\"),\r\n Unknown = countif(Outcome == \"Unknown\"),\r\n FailedPlaybooksArr = make_set_if(Playbook, Outcome == \"Failure\" and isnotempty(Playbook), 50)\r\n by Period\r\n| extend EffectiveTotal = Success + Failure + Unknown // excludes \"Other\"\r\n| extend SuccessRatePct = round(\r\n 100.0 * todouble(Success) / todouble(max_of(1, EffectiveTotal)),\r\n 1\r\n)\r\n| extend RAG = case(\r\n SuccessRatePct < 90.0, \"πŸ”΄ Red\",\r\n SuccessRatePct < 97.0, \"🟠 Amber\",\r\n \"🟒 Green\"\r\n)\r\n| extend FailedPlaybooks = strcat_array(FailedPlaybooksArr, \", \")\r\n| project Period, Total, Success, Failure, Unknown, Other, SuccessRatePct, RAG, FailedPlaybooks\r\n| order by Period asc", "size": 4, "title": "KPI: Playbook failures per day (rolling 30d + prev 30d)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "query - 12 - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data =\r\n Usage\r\n | where TimeGenerated >= startofday(ago(90d))\r\n | extend Period = iff(TimeGenerated < ago(45d), \"Previous 45 Days\", \"Last 45 Days\")\r\n | summarize GB = sum(Quantity)/1024 by DataType, Period;\r\n\r\nlet pivoted =\r\n data\r\n | summarize GB=sum(GB) by DataType, Period\r\n | evaluate pivot(Period, sum(GB))\r\n | extend Previous = coalesce(['Previous 45 Days'], 0.0)\r\n | extend Recent = coalesce(['Last 45 Days'], 0.0);\r\n\r\nlet totalRecent = toscalar(pivoted | summarize sum(Recent));\r\n\r\npivoted\r\n| extend GrowthGB = round(Recent - Previous, 2)\r\n| extend GrowthPct = iff(Previous == 0.0, real(0), round(100.0 * (Recent - Previous) / Previous, 1))\r\n| extend ShareOfRecentPct = iff(totalRecent == 0.0, real(0), round(100.0 * Recent / totalRecent, 1))\r\n| extend Direction = case(GrowthGB > 0, \"Increase\", GrowthGB < 0, \"Decrease\", \"Stable\")\r\n| extend RAG = case(\r\n GrowthPct >= 25.0, \"πŸ”΄ Red\",\r\n GrowthPct >= 10.0, \"🟠 Amber\",\r\n \"🟒 Green\"\r\n )\r\n| where abs(GrowthGB) > 1\r\n| project\r\n DataType,\r\n Previous45DaysGB = round(Previous,2),\r\n Last45DaysGB = round(Recent,2),\r\n GrowthGB,\r\n GrowthPct,\r\n ShareOfRecentPct,\r\n Direction,\r\n RAG\r\n| order by GrowthGB desc", "size": 0, "title": "Cost drivers, Which data sources are driving our Sentinel cost increase, and how significant is the impact?", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "GrowthGB", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "GrowthPct", "formatter": 8, "formatOptions": { "palette": "whiteBlack" } }, { "columnMatch": "Direction", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Increase", "representation": "trendup", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Decrease", "representation": "trenddown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "right", "text": "{0}{1}" } ] } } ] }, "sortBy": [] }, "customWidth": "75", "name": "query - 10" }, { "type": 1, "content": { "json": "| Column | Meaning |\r\n| ---------------- | ---------------------------------- |\r\n| Previous45DaysGB | Baseline usage |\r\n| Last45DaysGB | Current usage |\r\n| GrowthGB | Absolute change |\r\n| GrowthPct | % change |\r\n| ShareOfRecentPct | Portion of total current ingestion |\r\n| Direction | Increase / Decrease / Stable |\r\n| RAG | Materiality indicator |\r\n\r\n\r\n## Suggested RAG Meaning\r\n\r\n- πŸ”΄ **Red** β†’ Material cost driver (>25% growth) \r\n- 🟠 **Amber** β†’ Moderate upward drift (10–25%) \r\n- 🟒 **Green** β†’ Stable / controlled \r\n\r\n" }, "customWidth": "25", "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat\r\n| summarize dcount(Computer) by Version", "size": 1, "title": "1. Monthly: Agent Check by version", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "id", "formatter": 14, "formatOptions": { "linkTarget": null } }, { "columnMatch": "resourceGroup", "formatter": 14, "formatOptions": { "linkTarget": null } }, { "columnMatch": "Status", "formatter": 1, "formatOptions": { "linkColumn": "Status", "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5 }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5 }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "MonthlyAgentCheck" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat\r\n| summarize make_set(Version) by Computer\r\n| extend a = array_length(set_Version)\r\n| where a > 1\r\n| order by a desc, Computer asc\r\n\r\n", "size": 1, "title": "1. Monthly: Agent Check - version change detected", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "a", "formatter": 5 }, { "columnMatch": "dcount_Version", "formatter": 10, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "id", "formatter": 14, "formatOptions": { "linkTarget": null } }, { "columnMatch": "resourceGroup", "formatter": 14, "formatOptions": { "linkTarget": null } }, { "columnMatch": "Status", "formatter": 1, "formatOptions": { "linkColumn": "Status", "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5 }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5 }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ], "filter": true, "sortBy": [ { "itemKey": "set_Version", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "set_Version", "label": "Agent version" } ] }, "sortBy": [ { "itemKey": "set_Version", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "MonthlyAgentCheck - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "916bd214-247c-4204-9e72-6e456e5c1049", "cellValue": "\"\"", "linkTarget": "GenericDetails", "linkLabel": "{Workspace:label}", "preText": "2. Log Analytics Workspace", "postText": "please check the [Workspace Info] tab in this Workbook", "style": "link", "linkIsContextBlade": true }, { "id": "6ff3da41-03ac-42dc-a534-6f2395409e6b", "cellValue": "\"\"", "linkTarget": "GenericDetails", "linkLabel": "{Workspace:label}", "preText": "3. Ad-hoc: Access review", "postText": "check ", "style": "link" } ] }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "links - 47 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| summarize count() by location", "size": 0, "title": "4. Monthly: Ad-hoc Workspace location check 1 of 2", "exportFieldName": "", "exportParameterName": "exportMap", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 1, "formatOptions": { "linkColumn": "Status", "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5, "formatOptions": {} }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5, "formatOptions": {} }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 }, "mapSettings": { "locInfo": "AzureLoc", "locInfoColumn": "location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "66", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "MonthlyAgentCheck - Copy", "styleSettings": { "margin": "66" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "project details = '{exportMap}'\r\n| limit 1\r\n| mv-expand todynamic(details)\r\n", "size": 3, "title": "4. Monthly: Ad-hoc Workspace location check 1 of 2 drill-in details", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 1, "formatOptions": { "linkColumn": "Status", "linkTarget": "CellDetails", "linkIsContextBlade": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ComputerName_", "formatter": 5 }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] }, "tooltipFormat": { "tooltip": "Click to see details of the last event sent by this computer." } }, { "columnMatch": "Heartbeat Trend", "formatter": 10, "formatOptions": { "palette": "redGreen" }, "tooltipFormat": { "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." } }, { "columnMatch": "Details", "formatter": 5 }, { "columnMatch": "Last Record Received", "formatter": 3, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 }, "mapSettings": { "locInfo": "AzureLoc", "locInfoColumn": "location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "MonthlyAgentCheck - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| project\r\n WorkspaceResourceId = id,\r\n WorkspaceName = name,\r\n SubscriptionId = subscriptionId,\r\n ResourceGroup = resourceGroup,\r\n Location = location,\r\n State = tostring(properties.provisioningState),\r\n WorkspaceSkuRaw = tostring(properties.sku.name),\r\n WorkspaceSkuLastUpdate = tostring(properties.sku.lastSkuUpdate),\r\n RetentionDays = toint(properties.retentionInDays),\r\n DailyQuotaGbRaw = toreal(properties.workspaceCapping.dailyQuotaGb),\r\n Tags = tags\r\n| extend WorkspaceResourceId_lc = tolower(WorkspaceResourceId)\r\n// Friendly SKU formatting\r\n| extend WorkspaceSku = case(\r\n tolower(WorkspaceSkuRaw) == \"pergb\", \"Pay-as-you-go\",\r\n isempty(WorkspaceSkuRaw), \"Unknown\",\r\n WorkspaceSkuRaw\r\n)\r\n// Daily cap formatting\r\n| extend DailyDataCap = case(\r\n isnull(DailyQuotaGbRaw), \"Not set\",\r\n DailyQuotaGbRaw == -1, \"Not set\",\r\n tostring(DailyQuotaGbRaw)\r\n)\r\n// Governance indicators\r\n| extend RetentionStatus = case(\r\n isnull(RetentionDays), \"Unknown\",\r\n RetentionDays < 90, \"Below 90 days\",\r\n \"OK (>= 90 days)\"\r\n)\r\n| extend CapStatus = case(DailyDataCap == \"Not set\", \"Not set\", \"Set\")\r\n| extend SkuLastUpdate = iif(isempty(WorkspaceSkuLastUpdate), \"Unknown\", WorkspaceSkuLastUpdate)\r\n| extend SkuUpdateAgeDays = iif(isempty(WorkspaceSkuLastUpdate), int(null), datetime_diff(\"day\", now(), todatetime(WorkspaceSkuLastUpdate)))\r\n| extend ChangesLikelyRAG = case(\r\n isnull(SkuUpdateAgeDays), \"🟠 Unknown\",\r\n SkuUpdateAgeDays < 30, \"πŸ”΄ Changes likely\",\r\n \"🟒 Stable\"\r\n)\r\n// Join Sentinel solution by workspaceResourceId (normalized)\r\n| join kind=leftouter (\r\n Resources\r\n | where type =~ \"microsoft.operationsmanagement/solutions\"\r\n | where name startswith \"SecurityInsights(\"\r\n | project\r\n workspaceResourceId = tostring(properties.workspaceResourceId),\r\n workspaceResourceId_lc = tolower(tostring(properties.workspaceResourceId)),\r\n SentinelSolutionName = name,\r\n SentinelSolutionSkuRaw = tostring(properties.sku.name),\r\n SentinelSolutionState = tostring(properties.provisioningState),\r\n SentinelSolutionLastModified = tostring(properties.lastModifiedTime)\r\n) on $left.WorkspaceResourceId_lc == $right.workspaceResourceId_lc\r\n// Sentinel state logic\r\n| extend SentinelEnabled = case(\r\n SentinelSolutionState =~ \"Succeeded\", \"Yes\",\r\n isnotempty(SentinelSolutionName) and isempty(SentinelSolutionState), \"Provisioning / Unknown\",\r\n isempty(SentinelSolutionName), \"No\",\r\n \"Provisioning / Unknown\"\r\n)\r\n| extend SentinelSolutionSku = case(\r\n tolower(SentinelSolutionSkuRaw) == \"pergb\", \"Pay-as-you-go\",\r\n isempty(SentinelSolutionSkuRaw), \"\",\r\n SentinelSolutionSkuRaw\r\n)\r\n// Notes\r\n| extend Notes = case(\r\n SentinelEnabled == \"Yes\" and RetentionDays < 90, \"Sentinel detected: consider raising retention to 90 days (free) if applicable\",\r\n SentinelEnabled == \"Yes\" and RetentionDays >= 90, \"Sentinel detected\",\r\n SentinelEnabled != \"Yes\" and RetentionDays < 90, \"Retention < 90 days\",\r\n \"\"\r\n)\r\n| project\r\n WorkspaceName,\r\n WorkspaceResourceId,\r\n ResourceGroup,\r\n Location,\r\n State,\r\n SentinelEnabled,\r\n RetentionDays,\r\n RetentionStatus,\r\n DailyDataCap,\r\n CapStatus,\r\n WorkspaceSku,\r\n SkuLastUpdate,\r\n SkuUpdateAgeDays,\r\n ChangesLikelyRAG,\r\n SentinelSolutionState,\r\n SentinelSolutionSku,\r\n Notes,\r\n Tags\r\n// --- Debug (uncomment if you want to validate joins) ---\r\n// | project WorkspaceName, WorkspaceResourceId, WorkspaceResourceId_lc, workspaceResourceId, workspaceResourceId_lc, SentinelSolutionName, SentinelSolutionState\r\n| order by WorkspaceName asc", "size": 2, "title": "4. Monthly: Ad-hoc Workspace check 2 of 2, count: {$rowCount}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SentinelEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Yes", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "SkuUpdateAgeDays", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_SentinelEnabled_5", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_SentinelEnabled_5", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "State", "formatter": 1, "formatOptions": {} }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": {}, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unhealthy", "representation": "4", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false, "rowLimit": 100 }, "mapSettings": { "locInfo": "AzureLoc", "locInfoColumn": "location", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "location", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" } ], "name": "MonthlyAgentCheck - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab1", "comparison": "isEqualTo", "value": "Monthly" }, "name": "group - Monthly", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Checks" }, "name": "group - checks" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: ADX", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "bullets", "links": [ { "id": "6183148c-62b0-47aa-bf7b-697cba09d6b5", "cellValue": "community-Workbooks/ADXCluster/AtScale", "linkTarget": "WorkbookTemplate", "linkLabel": "Azure Data Explorer Insights", "preText": "Open", "style": "link", "linkIsContextBlade": true } ] }, "name": "links - 0" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "ADX" }, "name": "group - ADX" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Data Collection Rules and Transformations", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "dd1b7dbf-83b7-42ca-8589-f91a7a4504d9", "version": "KqlParameterItem/1.0", "name": "countDCR", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/providers/Microsoft.Insights/dataCollectionRules?api-version=2024-03-11\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value\",\"columns\":[{\"path\":\"kind\",\"columnid\":\"kind\"}]}}]}", "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "pills", "queryType": 12 }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage // use a known table \r\n| limit 1\r\n| project a= split(trim(@\"[^\\w]+\",tostring('{countDCR:value}')),\",\")\r\n| mv-expand a to typeof(string)\r\n| where isnotempty(a)\r\n| summarize count() by DCRkind=a", "size": 4, "title": "DCR by kind", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/providers/Microsoft.Insights/dataCollectionRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-04-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"Name\"},{\"path\":\"$..workspaceResourceId\",\"columnid\":\"Workspace\"},{\"path\":\"kind\",\"columnid\":\"OS\"},{\"path\":\"properties.dataFlows[*].streams[0]\",\"columnid\":\"Streams\",\"substringRegexMatch\":\"(Microsoft-Table-)*(\\\\w+)\",\"substringReplace\":\"$2\"},{\"path\":\"$..xPathQueries\",\"columnid\":\"xPath\"},{\"path\":\"location\",\"columnid\":\"Location\"},{\"path\":\"$..facilityNames\",\"columnid\":\"SyslogFacilities\"}]}}]}", "size": 0, "title": "Get all DCRs under: {Subscription:label}, count: {$rowCount}", "exportFieldName": "Name", "exportParameterName": "DCR", "showExportToExcel": true, "queryType": 12, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "workspace2", "formatter": 5 } ], "rowLimit": 500, "filter": true } }, "name": "Get DCRs and associations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/resourceGroups/{resourceGroup}/providers/Microsoft.Insights/dataCollectionRules/{DCR}/associations\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-04-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"id\",\"columnid\":\"VMs\",\"columnType\":\"string\",\"substringRegexMatch\":\"(\\\\/subscriptions.*)(\\\\/providers.*|Providers.*)\",\"substringReplace\":\"$1\"}]}}]}", "size": 4, "title": "VMs associated to the selected DCR", "noDataMessage": "No VMs found or no DCR selected above", "showExportToExcel": true, "queryType": 12 }, "conditionalVisibility": { "parameterName": "DCR", "comparison": "isNotEqualTo", "value": "" }, "name": "query - DCR VMs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:Id}/providers/Microsoft.Insights/dataCollectionRules?api-version=2021-04-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value[?(@.kind=='WorkspaceTransforms')]\",\"columns\":[{\"path\":\"id\",\"columnid\":\"Name\"},{\"path\":\"properties.dataFlows[*].streams[0]\",\"columnid\":\"Tables\",\"substringRegexMatch\":\"(Microsoft-Table-)*(\\\\w+)\",\"substringReplace\":\"$2\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"location\",\"columnid\":\"location\"},{\"path\":\"type\",\"columnid\":\"type\"},{\"path\":\"tags\",\"columnid\":\"tags\"},{\"path\":\"systemData.createdBy\",\"columnid\":\"createdby\"},{\"path\":\"systemData.createdAt\",\"columnid\":\"createdAt\"},{\"path\":\"systemData.lastModifiedBy\",\"columnid\":\"lastModifiedBy\"},{\"path\":\"systemData.lastModifiedAt\",\"columnid\":\"lastModifiedAt\"},{\"path\":\"properties.dataFlows\",\"columnid\":\"dataFlows\"},{\"path\":\"properties\",\"columnid\":\"properties\"},{\"path\":\"systemData\",\"columnid\":\"systemData\"}]}}]}", "size": 0, "title": "Transformation DCRs, count: {$rowCount} by Table Name", "showExportToExcel": true, "queryType": 12, "gridSettings": { "rowLimit": 500, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "type", "Tables" ], "expandTopLevel": true } } }, "name": "query - transforms " } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "dcr" }, "name": "group - DCR" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: Function or Parser", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "dd1b7dbf-83b7-42ca-8589-f91a7a4504d9", "version": "KqlParameterItem/1.0", "name": "countFunctions", "type": 1, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Workspace}/SavedSearches\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2025-07-01\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.functionAlias)]\",\"columns\":[{\"path\":\"properties.category\",\"columnid\":\"category\"}]}}]}", "timeContext": { "durationMs": 86400000 }, "queryType": 12 } ], "style": "pills", "queryType": 12 }, "conditionalVisibility": { "parameterName": "hide", "comparison": "isEqualTo", "value": "hide" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage // use a known table \r\n| limit 1\r\n| project a= split(trim(@\"[^\\w]+\",tostring('{countFunctions:value}')),\",\")\r\n| mv-expand a to typeof(string)\r\n| where isnotempty(a)\r\n| summarize count() by FunctionCategory=a", "size": 4, "title": "FunctionAlias by Category", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "name": "query - func by Category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Workspace}/SavedSearches\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.functionAlias)]\",\"columns\":[{\"path\":\"properties.functionAlias\",\"columnid\":\"functionAlias\"},{\"path\":\"properties.displayName\",\"columnid\":\"displayName\"},{\"path\":\"properties.category\",\"columnid\":\"category\"},{\"path\":\"properties.query\",\"columnid\":\"query\"},{\"path\":\"properties.version\",\"columnid\":\"version\"},{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"properties.functionParameters\",\"columnid\":\"parameters\"}]}}]}", "size": 1, "title": "Function Alias in Use (possible Parser detected), count: {$rowCount}, click row to see Query", "noDataMessage": "no saved queries found in {Workspace:name}", "exportedParameters": [ { "fieldName": "query", "parameterName": "query", "parameterType": 1, "defaultValue": " " }, { "fieldName": "displayName", "parameterName": "name", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "functionAlias", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } }, { "columnMatch": "query", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "sortBy": [ { "itemKey": "category", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "category", "sortOrder": 2 } ] }, "name": "functionAlias" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\",\"mergeType\":\"table\",\"leftTable\":\"functionAlias\"}],\"projectRename\":[{\"originalName\":\"[functionAlias].functionAlias\",\"mergedName\":\"functionAlias\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].displayName\",\"mergedName\":\"displayName\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].category\",\"mergedName\":\"category\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].query\",\"mergedName\":\"query\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].version\",\"mergedName\":\"version\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].name\",\"mergedName\":\"name\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[functionAlias].parameters\",\"mergedName\":\"parameters\",\"fromId\":\"9ceef7ea-3c45-4078-9120-9b7bfdc0c9ad\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Added column\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"query\",\"operator\":\"contains\",\"rightValType\":\"column\",\"rightVal\":\"functionAlias\",\"resultValType\":\"static\",\"resultVal\":\"Yes\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]}]}", "size": 0, "queryType": 7, "gridSettings": { "labelSettings": [ { "columnId": "Added column", "label": "Alias used in same Query (Y/N)" } ] } }, "conditionalVisibility": { "parameterName": "0", "comparison": "isEqualTo", "value": "0" }, "showPin": false, "name": "query - 2" }, { "type": 1, "content": { "json": "### KQL Query text:\r\n\r\n{query}" }, "conditionalVisibility": { "parameterName": "query", "comparison": "isNotEqualTo" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n | where TimeGenerated between (ago(7d) .. now())\r\n | summarize\r\n Events=count(),\r\n MissingHost=countif(isempty(Computer) and isempty(HostName)),\r\n MissingProcess=countif(isempty(ProcessName)),\r\n MissingFacility=countif(isempty(Facility)),\r\n MissingSeverity=countif(isempty(SeverityLevel))\r\n by SrcHost = coalesce(HostName, Computer, \"\")\r\n | where Events >= 200\r\n | extend\r\n MissingHostPct = todouble(MissingHost) / todouble(Events),\r\n MissingProcessPct = todouble(MissingProcess) / todouble(Events),\r\n MissingFacilityPct = todouble(MissingFacility) / todouble(Events),\r\n MissingSeverityPct = todouble(MissingSeverity) / todouble(Events)\r\n | extend WorstPct = max_of(MissingHostPct, MissingProcessPct, MissingFacilityPct, MissingSeverityPct)\r\n | extend Status = case(WorstPct >= 0.30, \"Degraded\", WorstPct >= 0.10, \"Watch\", \"OK\")\r\n | extend Severity = case(Status==\"Degraded\",\"High\", Status==\"Watch\",\"Medium\", \"Low\")\r\n | project\r\n Category=\"Parser\",\r\n Check=\"Syslog header completeness\",\r\n Resource=SrcHost,\r\n Status,\r\n Severity,\r\n When=now(),\r\n Metric=strcat(\"Events=\", Events,\r\n \"; MissingHost%=\", round(MissingHostPct*100.0, 1),\r\n \"; MissingProcess%=\", round(MissingProcessPct*100.0, 1),\r\n \"; MissingFacility%=\", round(MissingFacilityPct*100.0, 1),\r\n \"; MissingSeverity%=\", round(MissingSeverityPct*100.0, 1)),\r\n Details=strcat(\"Counts: MissingHost=\", MissingHost,\r\n \", MissingProcess=\", MissingProcess,\r\n \", MissingFacility=\", MissingFacility,\r\n \", MissingSeverity=\", MissingSeverity),\r\n Action=case(\r\n Status==\"Degraded\", \"Check syslog forwarder/agent formatting; ensure RFC headers aren’t truncated and host/process fields are preserved.\",\r\n Status==\"Watch\", \"Spot-check forwarder configs and validate parsing after updates.\",\r\n \"No action.\"\r\n )", "size": 0, "title": "Syslog parser check", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n | where TimeGenerated between (ago(7d) .. now())\r\n | summarize\r\n Events=count(),\r\n MissingVendor=countif(isempty(DeviceVendor)),\r\n MissingProduct=countif(isempty(DeviceProduct)),\r\n MissingIPs=countif(isempty(SourceIP) and isempty(DestinationIP)),\r\n MissingAction=countif(isempty(Activity) and isempty(DeviceAction))\r\n by DeviceVendor, DeviceProduct\r\n | where Events >= 200\r\n | extend\r\n MissingVendorPct = todouble(MissingVendor) / todouble(Events),\r\n MissingProductPct = todouble(MissingProduct) / todouble(Events),\r\n MissingIPsPct = todouble(MissingIPs) / todouble(Events),\r\n MissingActionPct = todouble(MissingAction) / todouble(Events)\r\n | extend WorstPct = max_of(MissingVendorPct, MissingProductPct, MissingIPsPct, MissingActionPct)\r\n | extend Status = case(WorstPct >= 0.30, \"Degraded\", WorstPct >= 0.10, \"Watch\", \"OK\")\r\n | extend Severity = case(Status==\"Degraded\",\"High\", Status==\"Watch\",\"Medium\", \"Low\")\r\n | project\r\n Category=\"Parser\",\r\n Check=\"CEF field completeness (CommonSecurityLog)\",\r\n Resource=strcat(coalesce(DeviceVendor,\"\"), \" / \", coalesce(DeviceProduct,\"\")),\r\n Status,\r\n Severity,\r\n When=now(),\r\n Metric=strcat(\"Events=\", Events,\r\n \"; MissingVendor%=\", round(MissingVendorPct*100.0, 1),\r\n \"; MissingProduct%=\", round(MissingProductPct*100.0, 1),\r\n \"; MissingIPs%=\", round(MissingIPsPct*100.0, 1),\r\n \"; MissingAction%=\", round(MissingActionPct*100.0, 1)),\r\n Details=strcat(\"Counts: MissingVendor=\", MissingVendor,\r\n \", MissingProduct=\", MissingProduct,\r\n \", MissingIPs=\", MissingIPs,\r\n \", MissingAction=\", MissingAction),\r\n Action=case(\r\n Status==\"Degraded\", \"Inspect raw CEF payload + parser mapping; ensure vendor/product/IP/action fields are extracted consistently.\",\r\n Status==\"Watch\", \"Spot-check forwarder/connector drift; validate normalization for vendor/product and IP/action mapping.\",\r\n \"No action.\"\r\n )", "size": 0, "title": "CommonSecurityLog parser check", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "query - 5 - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "function" }, "name": "group - function" } ], "fromTemplateId": "sentinel-WorkspaceUsageWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }