{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9875bc24-f51c-4151-96f0-2e4af7039364", "version": "KqlParameterItem/1.0", "name": "Time", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "264cba08-bf9e-44d6-9473-5f03e9aa9375", "version": "KqlParameterItem/1.0", "name": "Illumio_PCE", "label": "Illumio PCE", "type": 2, "description": "Select the Illumio PCE from which you want to see events for", "isRequired": true, "isGlobal": true, "query": "Illumio_Auditable_Events_CL\n| project pce_fqdn , table = \"Illumio_Auditable_Events_CL\"\n| union ( IllumioSyslogAuditEvents \n | project pce_fqdn , table = \"IllumioSyslogAuditEvents\"\n )\n| union (\n print pce_fqdn = 'No PCE', table = 'Illumio_Auditable_Events_CL'\n)\n| distinct table, pce_fqdn ", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "IllumioSyslogAuditEvents" }, { "id": "1b35142b-4e83-4645-83d3-29edd556ee3d", "version": "KqlParameterItem/1.0", "name": "TableToSearchFrom", "type": 1, "description": "use Illumio_PCE to define what table to fetch events from", "isGlobal": true, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "{Illumio_PCE:value}" } } ] } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| summarize dcount(href)", "size": 4, "title": "Audit Events", "noDataMessage": "0", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "30", "name": "Audit Events", "styleSettings": { "maxWidth": "30" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\ntable(table_to_search_from)\n| where event_type has 'tampering'\n| summarize dcount(href)\n", "size": 4, "title": "Tampering Events", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "30", "name": "Tampering Events", "styleSettings": { "maxWidth": "30" } } ] }, "name": "group - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| summarize distinct_count = dcount(href) by event_type\n| order by distinct_count \n| top 10 by distinct_count", "size": 0, "title": "Top Auditable events", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar" }, "name": "query - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Change Monitoring", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| summarize arg_max(TimeGenerated, *) by href\n| where event_type == 'sec_policy.create' \n| mv-expand resource_change = resource_changes\n| project TimeGenerated,\n workloads_affected_after_change = resource_change.changes.workloads_affected.after,\n policy_version = resource_change.resource.sec_policy.version,\n commit_message = resource_change.resource.sec_policy.commit_message,\n modified_objects = resource_change.resource.sec_policy.modified_objects,\n change_type = resource_change.change_type\n", "size": 0, "title": "Workloads affected by policy changes", "noDataMessage": "No workloads were affected by policy changes", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "name": "Workloads affected by policy changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| where resource_changes != '[]' and isnotempty(resource_changes) // ensure resource changes are not empty\n| summarize arg_max(TimeGenerated, *) by href\n| mv-expand parse_json(resource_changes)\n| project resource_type = tostring(bag_keys(resource_changes.resource)[0])\n| summarize Count=count() by resource_type", "size": 0, "title": "Changes by Resource Type", "noDataMessage": "No changes by resource type", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "35", "name": "Changes by Resource Type", "styleSettings": { "maxWidth": "35" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| where resource_changes != '[]' and isnotempty(resource_changes) and not(event_type matches regex '^user.*') and (event_type has '.create' or event_type has '.update' or event_type has '.delete') and (created_by !has \"agent\" and created_by !has \"ven\" and created_by !has \"container\")\n| extend User = tostring(parse_json(created_by)['user']['username'])\n| summarize Count = count() by User", "size": 0, "title": "Changes by User", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "35", "name": "Changes by User", "styleSettings": { "maxWidth": "35" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| where created_by has \"agent\" or created_by has \"ven\"\n| project user = tostring(parse_json(created_by)['agent']['hostname'])\n| summarize count() by user", "size": 0, "title": "Events generated by agents", "noDataMessage": "Agents have not generated any events", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Events generated by agents", "styleSettings": { "maxWidth": "20" } } ] }, "name": "ChangeMonitoring" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| summarize arg_max(TimeGenerated, *) by href // try to filter what event_type to prioritize in bar chart\n| make-series events = count() default = 0 on TimeGenerated from {Time:start} to {Time:end} step 1h by event_type //from ago(1d) to now() step 1h by event_type ", "size": 0, "title": "PCE events breakdown - every hour", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "LatLong" } }, "name": "PCE events breakdown - every hour" }, { "type": 1, "content": { "json": "### Authentication events \nChoose from below drop down to filter authentication events." }, "name": "text - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1ee7c425-b1b5-4a71-8dc3-9b447fa1f316", "version": "KqlParameterItem/1.0", "name": "EventType", "label": "Include Event Type", "type": 2, "description": "Types of events to be included ", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\n { \"value\":\"user.logout\", \"label\":\"User logout\" },\n { \"value\":\"user.sign_in\", \"label\":\"User signin\" },\n { \"value\":\"user.sign_out\", \"label\":\"User signout\" },\n { \"value\":\"user.login\", \"label\":\"User login\"},\n { \"value\":\"user.pce_session_terminated\", \"label\":\"User session terminated\"},\n { \"value\":\"request.authentication_failed\", \"label\":\"Authentication failed\"},\n { \"value\":\"user.authenticate\", \"label\":\"User Authentication\"},\n { \"value\":\"user.create_session\", \"label\":\"User create session\"}\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "value::all" ] }, { "id": "4f1ca215-f902-4fac-9bf0-834e4988a107", "version": "KqlParameterItem/1.0", "name": "ExcludeEventType", "label": "Exclude Event Type", "type": 2, "description": "Types of events to be excluded", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "showDefault": false }, "jsonData": "[\n { \"value\":\"user.logout\", \"label\":\"User logout\" },\n { \"value\":\"user.sign_in\", \"label\":\"User signin\" },\n { \"value\":\"user.sign_out\", \"label\":\"User signout\" },\n { \"value\":\"user.login\", \"label\":\"User login\"},\n { \"value\":\"user.pce_session_terminated\", \"label\":\"User session terminated\"},\n { \"value\":\"request.authentication_failed\", \"label\":\"Authentication failed\"},\n { \"value\":\"user.authenticate\", \"label\":\"User Authentication\"},\n { \"value\":\"user.create_session\", \"label\":\"User create session\"},\n { \"value\":\"None\", \"label\":\"None\", \"selected\": true}\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "None" ] }, { "version": "KqlParameterItem/1.0", "name": "Status", "type": 2, "description": "Status values", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\n { \"value\":\"failure\", \"label\":\"Failure\" },\n { \"value\":\"success\", \"label\":\"Success\", \"selected\": true },\n { \"value\":\"None\", \"label\":\"None\"}\n]", "timeContext": { "durationMs": 86400000 }, "id": "c8996627-2e77-4386-9c23-1eb5d50df311", "value": [ "value::all" ] }, { "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "description": "Status values", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\n { \"value\":\"err\", \"label\":\"Error\" },\n { \"value\":\"info\", \"label\":\"Info\", \"selected\": true } \n]", "timeContext": { "durationMs": 86400000 }, "id": "79d0945d-d0f8-4293-8dc2-3c57391cde95", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let included_event_types = iif(\"*\" in ({EventType}), dynamic(['user.login','user.logout', 'user.sign_in', 'user.sign_out', 'user.authenticate','user.create_session','user.pce_session_terminated']), dynamic([{EventType}]) );\nlet table_to_search_from = '{TableToSearchFrom}';\n\ntable(table_to_search_from)\n| where event_type in (included_event_types)\n| where \"*\" in ({Status}) or status in ({Status}) and \"*\" in ({Severity}) or severity in ({Severity})\n| where not(event_type in ({ExcludeEventType}))\n| project TimeGenerated, pce_fqdn, event_type, status, notification_type = parse_json(notifications)[0].notification_type,severity, created_by_username = iif(created_by == '{\"system\":{}}', parse_json(notifications)[0].info.user.username, parse_json(created_by).user.username)", "size": 0, "title": "PCE Authentication Events", "timeContextFromParameter": "Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 100, "filter": true, "sortBy": [ { "itemKey": "severity", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "severity", "sortOrder": 1 } ] }, "name": "PCE Authentication Events" } ], "fromTemplateId": "sentinel-AuditableEventsWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }