{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "82fedb33-961a-4199-a5ab-16340948ed10", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 1, "content": { "json": "# Advanced Threat Detections" }, "name": "text - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let TableMapping = dynamic(\n {\n \"Ttp_Url_CL\" : \"URL Protect\",\n \"Ttp_Attachment_CL\" : \"Attachment Protect\",\n \"Ttp_Impersonation_CL\" : \"Impersonation Protect\"\n });\nunion MimecastTTPUrl, MimecastTTPAttachment, MimecastTTPImpersonation\n| extend Type = tostring(TableMapping[Type])\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Type", "size": 3, "showAnalytics": true, "title": "Detection counts for Attachment Protect, URL Protect and Impersonation Protect", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Type", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Type", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Type", "sourceIdField": "Count", "targetIdField": "Type", "graphOrientation": 3, "showOrientationToggles": false, "staticNodeSize": 100, "hivesMargin": 5 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MimecastTTPUrl", "label": "URL Protect" }, { "seriesName": "MimecastTTPAttachment", "label": "Attachment Protect" }, { "seriesName": "MimecastTTPImpersonation", "label": "Impersonation Protect" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "name": "query - 8" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "0a398a65-91c9-4af5-8a10-c2fd5bdf205a", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "URL Protect", "subTarget": "url", "preText": "", "style": "link" }, { "id": "f3d459a1-2475-4589-95dd-e614960b82f9", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Attachment Protect", "subTarget": "attachment", "style": "link" }, { "id": "323ca7b8-5d5b-41e1-8d0d-a6cdb385f2e3", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Impersonation Protect", "subTarget": "impersonation", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\"\n| make-series Count=count() default=0 on ['Event Time'] step 1d\n", "size": 3, "showAnalytics": true, "title": "Malicious URL Detections", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "graphSettings": { "type": 0 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MimecastTTPUrl", "label": "URL Protect" } ] }, "mapSettings": { "locInfo": "LatLong" } }, "name": "query - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\"\n and ['From User Email Address'] contains \"@\"\n| summarize count() by ['From User Email Address']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Senders of Malicious URLs", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "From User Email Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(Url)\n| summarize count() by Url\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Malicious URLs", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Url", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\"\n and ['User Email Address'] contains \"@\"\n| summarize count() by ['User Email Address']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Targeted Recipients", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "User Email Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "33", "name": "query - 4" } ] }, "name": "dounts group 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['Advanced Phishing Result Credential Theft Brands'])\n| summarize count() by ['Advanced Phishing Result Credential Theft Brands']\n| top 10 by count_\n\n", "size": 3, "showAnalytics": true, "title": "Top 10 Advanced Phishing Results - Credential Theft Brands", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "advancedPhishingResult_CredentialTheftTags_s", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "advancedPhishingResult_CredentialTheftTags_s", "sortOrder": 1 } ], "chartSettings": { "group": "Advanced Phishing Result Credential Theft Brands", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty( ['Advanced Phishing Result Credential Theft Evidence'])\n| summarize count() by ['Advanced Phishing Result Credential Theft Evidence']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Advanced Phishing Results - Credential Theft Evidence", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false }, "chartSettings": { "group": "Advanced Phishing Result Credential Theft Evidence", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['Advanced Phishing Result Credential Theft Tags'])\n| summarize count() by ['Advanced Phishing Result Credential Theft Tags']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Advanced Phishing Result - Credential Theft Tags", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "hierarchySettings": { "treeType": 1, "groupBy": [ "advancedPhishingResult_CredentialTheftTags_s" ] }, "labelSettings": [ { "columnId": "advancedPhishingResult_CredentialTheftTags_s", "label": "Credential Theft Tags" }, { "columnId": "url_s", "label": "URLs" }, { "columnId": "count_", "label": "Occurences" } ] }, "chartSettings": { "group": "Advanced Phishing Result Credential Theft Tags", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 14" } ] }, "name": "dounts group 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['Ttp Definition'])\n| summarize count() by ['Ttp Definition']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 URL Protect Definitions", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Ttp Definition", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['Admin Override'])\n| summarize count() by ['Admin Override']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Admin Over-rides", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Admin Override", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(Action)\n| summarize count() by Action\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 URL Protect Actions", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Action", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 18" } ] }, "name": "dounts group 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['User Override'])\n| summarize count() by ['User Override']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 User Over-rides", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "User Override", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 22" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['Sending IP'])\n| summarize count() by ['Sending IP']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Sending IP Addresses", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Sending IP", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(Category)\n| summarize count() by Category\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Categories", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Category", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 24" } ] }, "name": "dounts group 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(['User Awareness Action'])\n| summarize count() by ['User Awareness Action']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 User Awareness Action", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "User Awareness Action", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 27" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(Subject)\n| summarize count() by Subject\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Email Subjects Related To Malicious URLs", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Subject", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 31" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPUrl\n| where ['Scan Result'] == \"malicious\" and isnotempty(Actions)\n| summarize count() by tostring(Actions)\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Internal Email Protect Mitigations by Actions", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Actions", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 30" } ] }, "name": "dounts group 5" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 6" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "url" }, "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment \n| where Result != \"safe\"\n| make-series Count=count() default=0 on ['Event Time'] step 1d\n", "size": 3, "showAnalytics": true, "title": "Malicious Attachment Detections", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MimecastTTPAttachment", "label": "Attachment Protect" } ] } }, "name": "query - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\"\n and ['Recipient Address'] contains \"@\"\n| summarize count() by ['Recipient Address']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Recipients of Malicious Attachments", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Recipient Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\" and isnotempty(['Action Triggered'])\n| summarize count() by ['Action Triggered']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Protection Actions Triggered", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Action Triggered", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\"\n and ['Sender Address'] contains \"@\"\n| summarize count() by ['Sender Address']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Senders of Malicious Attachments", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Sender Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 6" } ] }, "name": "dounts group 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\" and isnotempty(['File Type'])\n| summarize count() by ['File Type']\n| top 10 by count_\n\n\n\n\n\n\n\n", "size": 3, "showAnalytics": true, "title": "Top 10 Malicious Attachment File Types", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "File Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\" and isnotempty(Details)\n| summarize count() by Details\n| top 10 by count_\n\n\n\n\n\n\n\n", "size": 3, "showAnalytics": true, "title": "Top 10 Attachment Protect Event Details", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Details", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where isnotempty(Result)\n| summarize count() by Result\n\n\n\n\n\n\n\n\n", "size": 3, "showAnalytics": true, "title": "Attachment Event Results", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Result", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 12" } ] }, "name": "dounts group 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\" and isnotempty(Subject)\n| summarize count() by Subject\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Subjects for Emails Containing Malicious Attachments", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Subject", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPAttachment\n| where Result != \"safe\" and isnotempty(['File Hash'])\n| summarize count() by ['File Hash']\n| top 10 by count_\n\n", "size": 3, "showAnalytics": true, "title": "Top 10 Malicious Sha256 File Hashes", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "File Hash", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 18" } ] }, "name": "dounts group 3" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 4" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "attachment" }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPImpersonation\n| where ['Tagged Malicious'] == true\n| make-series Count=count() default=0 on ['Event Time'] step 1d\n", "size": 3, "showAnalytics": true, "title": "Malicious Impersonation Detections", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "count_", "label": "Impersonation Protect" } ] } }, "name": "query - 12" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPImpersonation\n| where ['Tagged Malicious'] == true\n and ['Recipient Address'] contains \"@\"\n| summarize count() by ['Recipient Address']\n| top 10 by count_", "size": 3, "showAnalytics": true, "title": "Top 10 Recipients of Impersonation Emails", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Recipient Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPImpersonation\n| where ['Tagged Malicious'] == true\n and ['Sender Address'] contains \"@\"\n| summarize count() by ['Sender Address']\n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Top 10 Senders of Impersonation Emails", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Sender Address", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "maxWidth": "50" } } ] }, "name": "donuts group 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Top 10 Impersonation Events\n" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPImpersonation\n| where ['Tagged Malicious'] == true and isnotempty(['Impersonation Results'])\n| summarize count() by ['Impersonation Results']\n|extend ['Impersonation Results'] = trim(@\"[\\[\\]]\",['Impersonation Results'])\n|extend ['Impersonation Results'] = trim(@\"[\\{\\}]\",['Impersonation Results'])\n| extend ['Impersonation Results'] = replace_string(['Impersonation Results'],',',', ') \n| extend ['Impersonation Results'] = replace_string(['Impersonation Results'],'\"','') \n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Grouped by Impersonation Result", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "recipientAddress_s", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "TenantId", "formatter": 1 }, "centerContent": { "columnMatch": "hits_d", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "yAxis": [ "count_" ], "group": "Impersonation Results", "createOtherGroup": 10, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastTTPImpersonation\n| where ['Tagged Malicious'] == true and isnotempty(Identifiers)\n| summarize count() by tostring(Identifiers)\n|extend Identifiers = trim(@\"[\\[\\]]\",Identifiers)\n| extend Identifiers = replace_string(Identifiers,'\"','') \n| top 10 by count_\n", "size": 3, "showAnalytics": true, "title": "Grouped by Impersonation Identifiers", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Identifiers", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 10" } ] }, "name": "dounts group 2" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 3" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "impersonation" }, "name": "group - 6" } ], "fromTemplateId": "Sentinel-Mimecast-Targeted-Threat-Protection-Workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }