{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "# Cisco Meraki" }, "name": "textWorkbookTitle" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c3f513c2-4160-4261-9ac0-d98aa05599bd", "version": "KqlParameterItem/1.0", "name": "Subscription", "label": "Subscription Name", "type": 6, "description": "Select the Subscription Name that will be used for the queries", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "includeAll": true, "showDefault": false }, "timeContext": { "durationMs": 86400000 } }, { "id": "d13a868b-818e-483a-b601-81ff9bee3097", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "description": "Select the Workspce Name that will be used for the queries.", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 } }, { "id": "1e854ea2-2ffd-4cb0-a63b-e941b422f752", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Select the Time Range that will be used for the queries.", "isRequired": true, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersAllTabs" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "570639ed-d7a3-4fca-86be-4b2b28cf39c1", "cellValue": "VisibleTabName", "linkTarget": "parameter", "linkLabel": "Summary", "subTarget": "summary", "style": "link" }, { "id": "79a2acf6-7858-4a8d-ad27-cf84211b3505", "cellValue": "VisibleTabName", "linkTarget": "parameter", "linkLabel": "Events from Device", "subTarget": "DeviceThreats", "style": "link" }, { "id": "f767421e-ac72-46a5-b33a-1ea6bd24db09", "cellValue": "VisibleTabName", "linkTarget": "parameter", "linkLabel": "Events from IP", "subTarget": "IPThreats", "style": "link" }, { "id": "7573a16c-8c26-4d4c-9b51-53b527bc4e78", "cellValue": "VisibleTabName", "linkTarget": "parameter", "linkLabel": "Malware Detected", "subTarget": "MalwareThreats", "style": "link" }, { "id": "9be11d6c-f6f7-4e9c-b1ba-33b8c377aa37", "cellValue": "VisibleTabName", "linkTarget": "parameter", "linkLabel": "All Events", "subTarget": "allEvents", "style": "link" } ] }, "name": "tabs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4ebf255c-233d-44bc-9cfb-7d21559344fa", "version": "KqlParameterItem/1.0", "name": "SelectLogType", "label": "Log Types", "type": 2, "description": "Select the Log Type to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct LogType\r\n| extend LogType = iff(isempty(LogType),\"empty\",LogType)\r\n| sort by LogType asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "2158e08c-7ff7-435a-8ab6-d84bac37ca69", "version": "KqlParameterItem/1.0", "name": "SelectNetworkDirection", "label": "Network Direction", "type": 2, "description": "Select the Network Direction to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct NetworkDirection\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| order by NetworkDirection asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersSummaryTab" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| extend LogType = iif(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| make-series Trend = count() default = 0 on TimeGenerated step 1h by LogType", "size": 0, "title": "Total Events by Log Type", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRangeLogType", "exportFieldName": "LogType", "exportParameterName": "SelectedLogType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showLegend": true } }, "customWidth": "50", "name": "timelineLogType" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where bin(TimeGenerated,1h) {TimeRangeLogType}\r\n| extend LogType = iff(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| project TimeGenerated, DeviceName, LogType, EventType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr, HttpRequestMethod, Url, NetworkProtocol, NetworkDirection\r\n| order by TimeGenerated", "size": 0, "title": "Total Events by Log Type - Details", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "timelineLogTypeDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(EventType)\r\n| summarize count() by EventType\r\n| sort by count_ ", "size": 0, "title": "Total Events by Event Type", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "EventType", "parameterName": "EventType", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "min": 0, "palette": "blueDark" } } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "topEventType" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki \r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(EventType) and EventType in ('' {EventType:value})\r\n| project DeviceName, LogType, EventType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr", "size": 0, "title": "Total Events by Event Type - Details", "noDataMessage": "Please select Event Type(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage_s", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100ch" } } ] }, "sortBy": [] }, "customWidth": "50", "name": "topEventTypeDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| extend LogType = iif(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| make-series Trend = count() default = 0 on TimeGenerated step 1h by NetworkDirection", "size": 0, "title": "Total Events by Network Direction", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "TimeRangeNetworkDirection", "exportFieldName": "LogType", "exportParameterName": "SelectedLogType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showLegend": true } }, "customWidth": "50", "name": "timelineNetworkDirection" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where bin(TimeGenerated,1h) {TimeRangeNetworkDirection}\r\n| extend LogType = iif(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iff(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| project TimeGenerated, DeviceName, LogType, EventType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr, HttpRequestMethod, Url,NetworkProtocol, NetworkDirection\r\n| order by TimeGenerated\r\n", "size": 0, "title": "Total Events by Network Direction - Details", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "timelineNetworkDirectionDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| extend NetworkProtocol = iff(isempty(NetworkProtocol),\"empty\",NetworkProtocol)\r\n| extend LogType = iif(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| summarize count() by NetworkProtocol", "size": 2, "title": "Total Events by Network Protocol", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "NetworkProtocol", "exportParameterName": "SelectedNetworkProtocol", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "eventsNetworkProtocol" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| extend NetworkProtocol = iff(isempty(NetworkProtocol),\"empty\",NetworkProtocol)\r\n| extend LogType = iif(isempty(LogType),\"empty\",LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| extend NetworkDirection = iif(isempty(NetworkDirection),\"empty\",NetworkDirection)\r\n| where NetworkDirection in ('' {SelectNetworkDirection})\r\n| summarize count() by Action", "size": 2, "title": "Total Events by State", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "eventState" } ] }, "conditionalVisibility": { "parameterName": "VisibleTabName", "comparison": "isEqualTo", "value": "summary" }, "name": "summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bdcc13aa-9775-4bb2-9a61-ce37703d57dd", "version": "KqlParameterItem/1.0", "name": "SelectLogType", "label": "Log Types", "type": 2, "description": "Select the Log Type to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct LogType\r\n| extend LogType = iff(isempty(LogType),\"empty\",LogType)\r\n| sort by LogType asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersDeviceEvents" }, { "type": 1, "content": { "json": "Found_in_Threat_Intel correlates SrcIPAddr and DestIPAddr with Threat Intelligence data present in Sentinel. This helps identify new threat intelligence information that you can use to further enhance your overall security posture. \r\n", "style": "info" }, "showPin": false, "name": "noteDeviceEvents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where isnotempty(DeviceName)\r\n| extend LogType = iif(isempty(LogType), \"empty\", LogType)\r\n| where LogType in ('' {SelectLogType})\r\n| summarize count() by DeviceName\r\n| project-rename Network_Device_name = DeviceName, Events_count = count_\r\n| sort by Events_count", "size": 0, "title": "Top Affected Network Devices", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "Network_Device_name", "parameterName": "Network_Device_name", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "Events_count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Events_count", "sortOrder": 2 } ], "graphSettings": { "type": 0, "topContent": { "columnMatch": "Network_Device_name", "formatter": 1 }, "centerContent": { "columnMatch": "Events_count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "topNetworkDevices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maliciousIP = ThreatIntelIndicatorsv2 | distinct NetworkIP | where isnotempty(NetworkIP);\r\nCiscoMeraki\r\n| where isnotempty(DeviceName)\r\n| extend LogType = iif(isempty(LogType), \"empty\", LogType)\r\n| where DeviceName in ('' {Network_Device_name}) and LogType in ('' {SelectLogType})\r\n| project DeviceName, LogType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr, Action\r\n| extend Found_in_Threat_Intel = iif(SrcIpAddr in (maliciousIP) or DstIpAddr in (maliciousIP), \"Yes\", \"No\")\r\n| project-reorder Found_in_Threat_Intel\r\n| order by Found_in_Threat_Intel, LogType", "size": 0, "title": "Events from Affected Network Device(s)", "noDataMessage": "Please select Affected Network Device(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "topNetworkDevicesDetails" } ] }, "conditionalVisibility": { "parameterName": "VisibleTabName", "comparison": "isEqualTo", "value": "DeviceThreats" }, "name": "DeviceThreat" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0633e46b-060b-4665-99ce-1ff11b892575", "version": "KqlParameterItem/1.0", "name": "SelectLogType", "label": "Log Types", "type": 2, "description": "Select the Log Type to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct LogType\r\n| extend LogType = iff(isempty(LogType),\"empty\",LogType)\r\n| sort by LogType asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersIPEvents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(SrcIpAddr)\r\n| summarize count() by SrcIpAddr\r\n| sort by count_", "size": 0, "title": "Top Affected Source IP Addresses", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "SrcIpAddr", "parameterName": "SrcIpAddr", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "min": 0, "palette": "blueDark" } } ] } }, "customWidth": "30", "name": "topIPAddress" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(SrcIpAddr)\r\n| where SrcIpAddr in ('' {SrcIpAddr})\r\n| project DeviceName, LogType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr", "size": 0, "title": "Events from Affected IP Addresses", "noDataMessage": "Please select Affected IP(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "70", "name": "topIPAddressDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(DstIpAddr)\r\n| summarize count() by DstIpAddr\r\n| sort by count_", "size": 0, "title": "Top Affected Destination IP Addresses", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "DstIpAddr", "parameterName": "DstIpAddr", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "min": 0, "palette": "blueDark" } } ] } }, "customWidth": "30", "name": "topOutboundDestination" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(DstIpAddr)\r\n| where DstIpAddr in ('' {DstIpAddr})\r\n| project DeviceName, LogType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr", "size": 0, "title": "Events from Affected IP Addresses", "noDataMessage": "Please select Affected Outbound Destination(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "70", "name": "topOutboundDestinationDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(SrcPortNumber)\r\n| summarize count() by SrcPortNumber\r\n| sort by count_", "size": 0, "title": "Top Events by Source Port", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "SrcPortNumber", "parameterName": "SrcPortNumber", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "min": 0, "palette": "blueDark" } } ] } }, "customWidth": "30", "name": "topSourcePort" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where SrcPortNumber in (\"0\" {SrcPortNumber})\r\n| project DeviceName, LogType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr", "size": 0, "title": "Events from Affected Source Port(s)", "noDataMessage": "Please select Affected Port(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "70", "name": "topSourcePortDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where isnotempty(DstPortNumber)\r\n| summarize count() by DstPortNumber\r\n| sort by count_", "size": 0, "title": "Top Events by Destination Port", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "DstPortNumber", "parameterName": "DstPortNumber", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "min": 0, "palette": "blueDark" } } ] } }, "customWidth": "30", "name": "topDestinationPort" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki\r\n| where LogType in ('' {SelectLogType})\r\n| where DstPortNumber in (\"0\" {DstPortNumber})\r\n| project DeviceName, LogType, SrcIpAddr, SrcPortNumber, SrcMacAddr, DstIpAddr, DstPortNumber, DstMacAddr", "size": 0, "title": "Events from Affected Destination Port(s)", "noDataMessage": "Please select Affected Port(s) from the left section to view results.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "70", "name": "topDestinationPortDetails" } ] }, "conditionalVisibility": { "parameterName": "VisibleTabName", "comparison": "isEqualTo", "value": "IPThreats" }, "name": "IpThreat" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "Found_in_Threat_Intel correlates Sha256 with Threat Intelligence data present in Sentinel. This helps identify new threat intelligence information that you can use to further enhance your overall security posture.", "style": "info" }, "name": "noteMalwareDetected" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maliciousFileHash = ThreatIntelIndicatorsv2 | where isnotempty(FileHashValue) | distinct FileHashValue;\r\nCiscoMeraki\r\n| where Disposition == \"malicious\"\r\n| summarize Instances=count() by DeviceName, Sha256, Url, Action\r\n| extend Found_in_Threat_Intel = iif(isnotempty(Sha256) and Sha256 in (maliciousFileHash), \"Yes\", \"No\")\r\n| project-reorder Found_in_Threat_Intel, DeviceName, Sha256, Url, Action, Instances\r\n| order by Found_in_Threat_Intel, Instances", "size": 0, "title": "Top Malware Detections", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "IsMalicious", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } } }, { "columnMatch": "Sha256_s", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "80ch" } }, { "columnMatch": "Url_s", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } } ] } }, "name": "topMalwareDetected" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maliciousFileHash = ThreatIntelIndicatorsv2 | where isnotempty(FileHashValue) | distinct FileHashValue;\r\nCiscoMeraki\r\n| where Disposition == \"malicious\" and Action == \"deny\"\r\n| summarize Instances=count() by DeviceName, Sha256, Url, Action\r\n| extend Found_in_Threat_Intel = iif(isnotempty(Sha256) and Sha256 in (maliciousFileHash), \"Yes\", \"No\")\r\n| project-reorder Found_in_Threat_Intel, DeviceName, Sha256, Url, Action, Instances\r\n| order by Found_in_Threat_Intel, Instances", "size": 0, "title": "Top Retrospective Malware Detections", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Sha256_s", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "80ch" } }, { "columnMatch": "Url_s", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } } ] } }, "name": "topRetrospectiveMalwareDetected" } ] }, "conditionalVisibility": { "parameterName": "VisibleTabName", "comparison": "isEqualTo", "value": "MalwareThreats" }, "name": "MalwareThreats" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e75c556b-b636-4599-83cc-b8f9c38d7f60", "version": "KqlParameterItem/1.0", "name": "DeviceName", "label": "Device Name", "type": 2, "description": "Select the Device Name to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct DeviceName\r\n| extend DeviceName = iif(isempty(DeviceName), \"empty\", DeviceName)\r\n| order by DeviceName asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f67ad484-ff20-49cb-afa6-93c1be8debab", "version": "KqlParameterItem/1.0", "name": "LogType", "label": "Log Type", "type": 2, "description": "Select the Log Type to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct LogType\r\n| extend LogType = iif(isempty(LogType), \"empty\", LogType)\r\n| order by LogType asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "8077dc84-a7c8-4bb4-b826-fec999bbdc34", "version": "KqlParameterItem/1.0", "name": "SrcIpAddr", "label": "Source IP Address", "type": 2, "description": "Select the Source IP Address to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct SrcIpAddr\r\n| extend SrcIpAddr = iif(isempty(SrcIpAddr), \"-\", SrcIpAddr)\r\n| sort by SrcIpAddr asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "928b0767-1430-4e75-9978-6bfbc7166af1", "version": "KqlParameterItem/1.0", "name": "SrcPortNumber", "label": "Source Port Number", "type": 2, "description": "Select the Source Port Number to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct SrcPortNumber\r\n| extend SrcPortNumber = iif(isempty(SrcPortNumber), 0, SrcPortNumber)\r\n| sort by SrcPortNumber asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "648072e7-2c48-45fc-99ab-b1c963de1c1b", "version": "KqlParameterItem/1.0", "name": "SrcMacAddr", "label": "Source Mac Address", "type": 2, "description": "Select the Source MAC Address to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct SrcMacAddr\r\n| extend SrcMacAddr = iif(isempty(SrcMacAddr), \"-\", SrcMacAddr)\r\n| sort by SrcMacAddr asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "33c73a68-1916-4ca4-865c-40c456747c17", "version": "KqlParameterItem/1.0", "name": "DstIpAddr", "label": "Destination IP Address", "type": 2, "description": "Select the Destination IP Address to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct DstIpAddr\r\n| extend DstIpAddr = iif(isempty(DstIpAddr), \"-\", DstIpAddr)\r\n| sort by DstIpAddr asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "d3a39bb1-1500-4274-ba6f-e987f1e732a8", "version": "KqlParameterItem/1.0", "name": "DstPortNumber", "label": "Destination Port Number", "type": 2, "description": "Select the Destination Port Number to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct DstPortNumber\r\n| extend DstPortNumber = iif(isempty(DstPortNumber), 0, DstPortNumber)\r\n| sort by DstPortNumber asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "06b715b9-0e2d-42c5-a7d4-8fb3398f2e0d", "version": "KqlParameterItem/1.0", "name": "DstMacAddr", "label": "Destination Mac Address", "type": 2, "description": "Select the Destination MAC Address to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct DstMacAddr\r\n| extend DstMacAddr = iif(isempty(DstMacAddr), \"-\", DstMacAddr)\r\n| sort by DstMacAddr asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "7b6901f3-d646-4e1c-8e83-10c48de6a68e", "version": "KqlParameterItem/1.0", "name": "HttpRequestMethod", "label": "HTTP Request Method", "type": 2, "description": "Select the HTTP Request Method to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct HttpRequestMethod\r\n| extend HttpRequestMethod = iif(isempty(HttpRequestMethod), \"empty\", HttpRequestMethod)\r\n| order by HttpRequestMethod asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f73f8622-3281-4f88-827a-0df99a944af6", "version": "KqlParameterItem/1.0", "name": "Url", "type": 2, "description": "Select the Url to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct Url\r\n| extend Url = iif(isempty(Url), \"empty\", Url)\r\n| order by Url asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "fe51c740-f63c-491c-9734-63e612bf68a8", "version": "KqlParameterItem/1.0", "name": "NetworkProtocol", "label": "Network Protocol", "type": 2, "description": "Select the Network Protocol to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct NetworkProtocol\r\n| extend NetworkProtocol = iif(isempty(NetworkProtocol), \"empty\", NetworkProtocol)\r\n| order by NetworkProtocol asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "38c497b4-9962-4beb-b132-24eb267d68ac", "version": "KqlParameterItem/1.0", "name": "NetworkDirection", "label": "Network Direction", "type": 2, "description": "Select the Network Direction to filter the data", "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "CiscoMeraki\r\n| distinct NetworkDirection\r\n| extend NetworkDirection = iif(isempty(NetworkDirection), \"empty\", NetworkDirection)\r\n| order by NetworkDirection asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersAllEvents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoMeraki \r\n| project\r\n TimeGenerated,\r\n DeviceName=coalesce(DeviceName,\"empty\"),\r\n LogType=coalesce(LogType,\"empty\"),\r\n SrcIpAddr=coalesce(SrcIpAddr,\"-\"),\r\n SrcPortNumber=coalesce(SrcPortNumber,0),\r\n SrcMacAddr=coalesce(SrcMacAddr,\"-\"),\r\n DstIpAddr=coalesce(DstIpAddr,\"-\"),\r\n DstPortNumber=coalesce(DstPortNumber,0),\r\n DstMacAddr=coalesce(DstMacAddr,\"-\"),\r\n HttpRequestMethod=coalesce(HttpRequestMethod,\"empty\"),\r\n Url=coalesce(Url,\"empty\"),\r\n NetworkProtocol=coalesce(NetworkProtocol,\"empty\"),\r\n NetworkDirection=coalesce(NetworkDirection,\"empty\")\r\n| where DeviceName in ('' {DeviceName:value}) and LogType in ('' {LogType:value}) and SrcIpAddr in ('' {SrcIpAddr:value}) and SrcMacAddr in ('' {SrcMacAddr:value}) and DstIpAddr in ('' {DstIpAddr:value}) and DstMacAddr in ('' {DstMacAddr:value}) and HttpRequestMethod in ('' {HttpRequestMethod:value}) and Url in ('' {Url:value}) and NetworkProtocol in ('' {NetworkProtocol:value}) and NetworkDirection in ('' {NetworkDirection:value})\r\n| where SrcPortNumber in ('' {SrcPortNumber:value}) and DstPortNumber in ('' {DstPortNumber:value})\r\n| order by TimeGenerated", "size": 0, "title": "All Events", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "allEvents" } ] }, "conditionalVisibility": { "parameterName": "VisibleTabName", "comparison": "isEqualTo", "value": "allEvents" }, "name": "AllMerakiEvents" } ], "styleSettings": {}, "fromTemplateId": "sentinel-CiscoMerakiWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }