{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "time-range-param", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 604800000 } ] } }, { "id": "topn-param", "version": "KqlParameterItem/1.0", "name": "TopN", "label": "Top N Results", "type": 1, "isRequired": true, "value": "20" } ], "style": "pills" }, "name": "global-parameters", "id": "8cd46114-2312-4d0d-b1fa-417cd4f1e647" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "tab-overview", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "tab-hunting", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Hunting", "subTarget": "hunting", "style": "link" }, { "id": "tab-investigation", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Investigation", "subTarget": "investigation", "style": "link" }, { "id": "tab-resources", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Resources", "subTarget": "resources", "style": "link" } ] }, "name": "workbook-tabs", "id": "6cef1b70-9ea6-48ce-89d6-03e704086de2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Overview\nHigh-level metrics, trends, and MITRE coverage for leadership and SOC managers." }, "name": "overview-header", "id": "b511b43e-6d25-4380-9a57-b4f8356d38c2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| count", "size": 4, "title": "Total Behaviors", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": true } }, "customWidth": "33", "name": "tile-total-behaviors", "id": "e32a4b30-0338-4c79-8a7d-548bc5ca19e9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorEntities\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(EntityType)\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, RemoteIP, LocalIP, ServiceSource, FileName, Application, RemoteUrl, CloudResourceId)\n| where isnotempty(EntityValue)\n| summarize ActiveEntities = dcount(EntityValue)", "size": 4, "title": "Active Entities", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "ActiveEntities", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": true } }, "customWidth": "33", "name": "tile-active-entities", "id": "bb6bee01-78fd-4107-849c-10491a633339" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(Categories)\n| extend CategoriesArray = parse_json(Categories)\n| mv-expand Category = CategoriesArray to typeof(string)\n| summarize UniqueTactics = dcount(Category)", "size": 4, "title": "Unique Tactics", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "UniqueTactics", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": true } }, "customWidth": "33", "name": "tile-unique-tactics", "id": "2fdc3a12-0274-4284-af95-ddc4c6f2193d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| summarize BehaviorCount = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc", "size": 0, "title": "Behavior Timeline Trend", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "BehaviorCount" ], "showLegend": true } }, "name": "chart-timeline-trend", "id": "0a138933-561c-4446-bf0a-275a61a0d4eb" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(Categories)\n| extend CategoriesArray = parse_json(Categories)\n| mv-expand Category = CategoriesArray to typeof(string)\n| summarize BehaviorCount = count(), DistinctBehaviors = dcount(BehaviorId) by Category\n| order by BehaviorCount desc", "size": 0, "title": "MITRE Coverage by Tactic", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Category", "yAxis": [ "BehaviorCount" ], "showLegend": true } }, "customWidth": "50", "name": "chart-mitre-coverage", "id": "b029bbcd-c9f5-49e7-bf17-c526448bb429" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(ActionType)\n| summarize BehaviorCount = count() by ActionType\n| order by BehaviorCount desc\n| take {TopN}", "size": 0, "title": "Top Behavior Types", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "ActionType", "yAxis": [ "BehaviorCount" ], "showLegend": true } }, "customWidth": "50", "name": "chart-behavior-distribution", "id": "9670da3d-6d26-44fd-bfad-b7cf4bb60279" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "group-overview", "id": "9cdc09b1-bb18-4a55-96e0-0ff75c52c31b" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Entities Investigation\nDeep-dive into incidents and entity behaviors. Select an incident to analyze behaviors before, during, and after the event.\n\nPaste below your entities of interest from an incident and choose the time range you would like to investigate." }, "name": "investigation-header", "id": "b9ea8a2e-e956-468f-af2a-368003ad6fa8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "incident-entities-param", "version": "KqlParameterItem/1.0", "name": "IncidentEntities", "label": "Incident Entities", "type": 1, "description": "Comma-separated list of entity values from the selected incident", "isRequired": false, "value": "", "key": "incident-entities-param" }, { "id": "incident-time-param", "version": "KqlParameterItem/1.0", "name": "IncidentTime", "label": "Incident Time", "type": 1, "description": "DateTime of the incident (e.g., 2026-01-08T12:00:00Z)", "isRequired": false, "value": "", "key": "incident-time-param" }, { "id": "window-before-param", "version": "KqlParameterItem/1.0", "name": "WindowBefore", "label": "Hours Before", "type": 1, "isRequired": true, "value": "", "key": "window-before-param" }, { "id": "window-after-param", "version": "KqlParameterItem/1.0", "name": "WindowAfter", "label": "Hours After", "type": 1, "isRequired": true, "value": "", "key": "window-after-param" } ], "style": "formHorizontal" }, "name": "investigation-parameters", "id": "d81db8a3-4dc9-46ff-b8e8-c7302ecb6bd3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let incidentEntities = dynamic([{IncidentEntities}]);\nlet incidentTime = todatetime(\"{IncidentTime}\");\nlet windowBefore = {WindowBefore};\nlet windowAfter = {WindowAfter};\nSentinelBehaviorEntities\n| where TimeGenerated between ((incidentTime - windowBefore) .. (incidentTime + windowAfter))\n| where isnotempty(EntityType)\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, RemoteIP, LocalIP, FileName, Application, RemoteUrl, CloudResourceId)\n| where EntityValue in (incidentEntities)\n| join kind=inner (\n SentinelBehaviorInfo\n | where TimeGenerated between ((incidentTime - windowBefore) .. (incidentTime + windowAfter))\n | project BehaviorId, Title, Description, Categories, AttackTechniques, StartTime, EndTime\n) on BehaviorId\n| extend TimeRelativeToIncident = iff(TimeGenerated < incidentTime, \"Before\", iff(TimeGenerated > incidentTime, \"After\", \"During\"))\n| project TimeGenerated, TimeRelativeToIncident, EntityType, EntityValue, EntityRole, Title, Description, Categories, AttackTechniques\n| order by TimeGenerated asc", "size": 0, "title": "Behavior Timeline (Before/During/After Incident)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] } }, "name": "table-behavior-timeline", "id": "24c7fa12-44b1-4fb9-9f76-600782750c93" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let incidentEntities = dynamic([{IncidentEntities}]);\nSentinelBehaviorEntities\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(EntityType)\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, RemoteIP, LocalIP, FileName, Application, RemoteUrl, CloudResourceId)\n| where EntityValue in (incidentEntities)\n| join kind=inner (\n SentinelBehaviorInfo\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n | project BehaviorId, Title, Categories, AttackTechniques\n) on BehaviorId\n| summarize \n BehaviorCount = dcount(BehaviorId),\n BehaviorTypes = make_set(Title),\n Roles = make_set(EntityRole),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by EntityType, EntityValue\n| extend BehaviorTypeCount = array_length(BehaviorTypes)\n| project EntityType, EntityValue, BehaviorCount, BehaviorTypeCount, Roles, FirstSeen, LastSeen, BehaviorTypes\n| order by BehaviorCount desc", "size": 0, "title": "Entity Behavior Summary", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "table-entity-summary", "id": "9f9343ea-f132-4df4-99ff-1dad18f6bb70" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let incidentEntities = dynamic([{IncidentEntities}]);\nSentinelBehaviorEntities\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n| where isnotempty(EntityType)\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, RemoteIP, LocalIP, FileName, Application, RemoteUrl, CloudResourceId)\n| where EntityValue in (incidentEntities)\n| join kind=inner (\n SentinelBehaviorInfo\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}\n | extend CategoriesArray = parse_json(Categories)\n | extend TechniquesArray = parse_json(AttackTechniques)\n | mv-expand Category = CategoriesArray to typeof(string)\n | mv-expand Technique = TechniquesArray to typeof(string)\n | project BehaviorId, Description, Category, Technique\n) on BehaviorId\n| summarize \n BehaviorCount = dcount(BehaviorId),\n Behaviors = make_set(Description)\n by Category, Technique\n| order by Category asc, BehaviorCount desc", "size": 0, "title": "MITRE Coverage for Incident Entities", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "table-mitre-incident", "id": "6ff212df-9008-4154-9f12-4159df97bcdd" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "investigation" }, "name": "group-investigation", "id": "2152fbdd-a9a9-493a-b897-e7154a95a21d" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Hunting and Discovery\nProactive threat hunting capabilities to discover interesting activity in your environment." }, "name": "hunting-header", "id": "7a6978f5-6a33-4eb1-abff-c82827d8fb7a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorInfo\n| where TimeGenerated > ago(7d)\n| summarize Count = count() by Title\n| order by Count asc\n| take 20", "size": 0, "title": "Rarest Behaviors (7 days lookback)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 1 } ] } }, "customWidth": "50", "name": "table-rarest-behaviors", "id": "e0263526-a715-4848-bf18-3b2e483753a5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SentinelBehaviorEntities\n| where TimeGenerated > ago(24h)\n| where isnotempty(EntityType)\n| where EntityType != \"Ip\"\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, ServiceSource, FileName, Application, RemoteUrl, CloudResourceId)\n| where isnotempty(EntityValue)\n| where EntityValue !startswith \"System.\"\n| join kind=inner (\n SentinelBehaviorInfo \n | where TimeGenerated > ago(24h)\n | extend CategoriesArray = parse_json(Categories)\n | extend TechniquesArray = parse_json(AttackTechniques)\n | extend TitleArray = parse_json(Title)\n | mv-expand Category = CategoriesArray to typeof(string)\n | mv-expand Technique = TechniquesArray to typeof(string)\n | mv-expand Title = TitleArray to typeof(string)\n) on BehaviorId\n| summarize \n DistinctTactics = dcount(Category),\n Tactics = make_set(Category),\n Techniques = make_set(Technique),\n Titles = make_set(Title)\n by EntityType, EntityValue\n| where DistinctTactics >= 3\n| project EntityType, EntityValue, TacticCount = DistinctTactics, Tactics, Techniques, Titles\n| order by TacticCount desc\n//| take 20", "size": 0, "title": "Attack Chain Detector (≥3 Tactics, 24H lookback)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "table-attack-chain", "id": "a81b2cc2-4e75-4270-aad8-5082170da658" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let today = startofday(now());\nlet weekAgo = today - 7d;\nlet todayActivity = SentinelBehaviorEntities\n| where TimeGenerated >= today\n| where isnotempty(EntityType)\n| where EntityType != \"Ip\"\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, FileName, Application, RemoteUrl, CloudResourceId)\n| where isnotempty(EntityValue)\n| where EntityValue !startswith \"System.\"\n| summarize TodayCount = count() by EntityType, EntityValue;\nlet historicalActivity = SentinelBehaviorEntities\n| where TimeGenerated >= weekAgo and TimeGenerated < today\n| where isnotempty(EntityType)\n| where EntityType != \"Ip\"\n| extend EntityValue = coalesce(AccountUpn, AccountName, DeviceId, DeviceName, FileName, Application, RemoteUrl, CloudResourceId)\n| where isnotempty(EntityValue)\n| summarize TotalHistorical = count() by EntityType, EntityValue\n| extend DailyAverage = TotalHistorical / 7.0;\ntodayActivity\n| join kind=inner historicalActivity on EntityType, EntityValue\n| extend VelocityRatio = TodayCount / DailyAverage\n//| where VelocityRatio > 2.0\n| project EntityType, EntityValue, TodayCount, DailyAverage = round(DailyAverage, 2), VelocityRatio = round(VelocityRatio, 2)\n| order by VelocityRatio desc\n| take 20", "size": 0, "title": "Entity Velocity Tracker (>200% Increase, 7 days)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "table-entity-velocity", "id": "b9e68647-2706-45f0-a29c-bd817ff1a97b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let today = startofday(now());\nlet weekAgo = today - 7d;\nlet todayActivity = SentinelBehaviorInfo\n| where TimeGenerated >= today\n| where isnotempty(Description)\n| summarize TodayCount = count() by Description;\nlet historicalActivity = SentinelBehaviorInfo\n| where TimeGenerated >= weekAgo and TimeGenerated < today\n| where isnotempty(Description)\n| summarize TotalHistorical = count() by Description\n| extend DailyAverage = TotalHistorical / 7.0;\ntodayActivity\n| join kind=inner historicalActivity on Description\n| extend VelocityRatio = TodayCount / DailyAverage\n| where VelocityRatio > 2.0\n| project Description, TodayCount, DailyAverage = round(DailyAverage, 2), VelocityRatio = round(VelocityRatio, 2)\n| order by VelocityRatio desc\n| take 20", "size": 0, "title": "Behavior Velocity Tracker (>200% Increase)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "table-behavior-velocity", "id": "f34ff85f-399c-469b-a1d1-7849c97e9b33" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "hunting" }, "name": "group-hunting", "id": "4802e6fc-c5d8-4d39-9a35-e3ffe3cc9af5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 📚 UEBA Behaviors Resources\n\n## Official Documentation\n- [Entity Behaviors Layer Documentation](https://learn.microsoft.com/en-us/azure/sentinel/entity-behaviors-layer) - Microsoft Learn guide on the entity behaviors layer in Sentinel\n\n## Blog Posts & Announcements\n- [Turn Complexity into Clarity: Introducing the New UEBA Behaviors Layer](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/turn-complexity-into-clarity-introducing-the-new-ueba-behaviors-layer-in-microso/4484493) - Detailed blog post about the new behaviors layer" }, "name": "resources-content", "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "resources" }, "name": "group-resources", "id": "d4e5f6a7-b8c9-0123-4567-890abcdef123" } ], "fromTemplateId": "sentinel-UEBABehaviorsAnalysisWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }