{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "96834e0b-c240-4603-b8ce-ab5c8e051a8c", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 3600000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "66925847-0d36-4795-bdfe-1ad0e6fa92a8", "version": "KqlParameterItem/1.0", "name": "SortBy", "label": "Sort By", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\n\n { \"value\":\"Count\", \"label\":\"Count\"},\n { \"value\":\"Severity\", \"label\":\"Severity\", \"selected\":true}\n]", "value": "Count" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 8" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "bc6350d6-4f87-4575-9057-6e80072afdc1", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "b90a2ef4-07db-4f55-b8f1-fcafa493ab16", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Models", "subTarget": "Models", "style": "link" }, { "id": "e097203d-20ea-48de-af3d-d367e704dd61", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Devices", "subTarget": "Devices", "style": "link" } ] }, "name": "links - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "---\n### Adversarial Model Matches by Severity Level for {TimeRange}" }, "customWidth": "30", "name": "Overview_Pie_Label" }, { "type": 1, "content": { "json": "\n\n\n---\n### Adversarial Models Matches for {TimeRange}" }, "customWidth": "70", "name": "Overview_Chart_Label" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| summarize by bin(TimeGenerated,floor(({TimeRange:end}-{TimeRange:start})/30,1m)),Activity,LogSeverity\n| summarize Count=count() by Severity=iif(toint(LogSeverity) between (0 .. 5),\"1\",iif(toint(LogSeverity) between (6 .. 8),\"2\",iif(toint(LogSeverity) between (9 .. 10),\"3\",\"4\")))\n| where toint(Severity)<4\n| order by toint(Severity) desc", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "4", "representation": "redBright", "text": "Critical" }, { "operator": "==", "thresholdValue": "3", "representation": "orange", "text": "High" }, { "operator": "==", "thresholdValue": "2", "representation": "yellow", "text": "Medium" }, { "operator": "==", "thresholdValue": "1", "representation": "green", "text": "Low" }, { "operator": "Default", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "status", "color": "green" }, { "columnName": "status_count", "color": "lightBlue" } ] } } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": true, "sortOrderField": 1, "size": "auto" }, "graphSettings": { "type": 0 }, "chartSettings": { "yAxis": [ "Count" ], "seriesLabelSettings": [ { "seriesName": "1", "label": "Low", "color": "green" }, { "seriesName": "2", "label": "Medium", "color": "yellow" }, { "seriesName": "3", "label": "High", "color": "redBright" } ] } }, "customWidth": "30", "name": "Adversarial Model Matches by Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| summarize by bin(TimeGenerated,floor(({TimeRange:end}-{TimeRange:start})/30,1m)),Activity,LogSeverity\n| summarize High=countif(toint(LogSeverity) between (9 .. 10)),Medium=countif(toint(LogSeverity) between (6 .. 8)),Low=countif(toint(LogSeverity) between (0 .. 5)) by TimeGenerated,LogSeverity\n\n", "size": 2, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "graphSettings": { "type": 0 }, "chartSettings": { "xAxis": "TimeGenerated", "seriesLabelSettings": [ { "seriesName": "High", "color": "redBright" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "Low", "color": "green" } ] } }, "customWidth": "70", "name": "Overview_Chart" }, { "type": 1, "content": { "json": "\n\n\n---\n###### Links" }, "name": "Overview_Links_Label" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "bullets", "links": [ { "id": "49514376-7f9d-40d5-9e71-be047648b095", "cellValue": "https://awakesecurity.com/", "linkTarget": "Url", "linkLabel": "Awake-Security", "preText": "", "postText": "", "style": "link" } ] }, "name": "Overview_Links" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Overview" }, "name": "Overview_Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "---\n### Top 5 Adversarial Models Activities for {TimeRange}" }, "customWidth": "40", "name": "Models_Chart_Label" }, { "type": 1, "content": { "json": "---\n\n### Detailed: Top 50 Adversarial Model Matches for {TimeRange}" }, "customWidth": "60", "name": "Models_Grid_Label" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| summarize d=arg_max(DeviceEventClassID,LogSeverity),TriggeredCount=sum(EventCount) by Activity,DeviceCustomString5\n| sort by case(\"{SortBy}\"==\"Count\",TriggeredCount,toint(LogSeverity)), Activity \n| limit 5\n| project Activity=strcat(substring(Activity,0,20),\"...\"),TriggeredCount", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "TriggeredCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Activity" }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "TriggeredCount", "sizeAggregation": "Sum", "legendMetric": "TriggeredCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "TriggeredCount", "heatmapPalette": "greenRed" } } }, "customWidth": "40", "name": "Models_Chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| summarize arg_max(TimeGenerated,Severity=toint(LogSeverity),DeviceCustomDate2,DeviceEventClassID),arg_min(TimeGenerated, DeviceCustomDate1),\nUniqueDevices= dcount(coalesce(SourceHostName,'Unknown')),TotalActivities=sum(EventCount) by Activity,DeviceCustomString5\n| extend ModelPath= strcat(\"https://\",DeviceCustomString5,\"/app/workbench/?startTime=\",DeviceCustomDate1,\"&endTime=\",DeviceCustomDate2,\"&query=(dataset.threat_behavior%20\",DeviceEventClassID,\")%20%26%26%20(device.threat_behavior%20\",DeviceEventClassID,\")&view=device\")\n| project Activity,ModelPath,Severity,UniqueDevices,TotalActivities\n| sort by case(\"{SortBy}\"==\"Count\",TotalActivities,Severity), Activity\n| limit 50", "size": 2, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Activity", "formatter": 13, "formatOptions": { "linkColumn": "ModelPath", "linkTarget": "Url", "showIcon": false, "customColumnWidthSetting": "70%" } }, { "columnMatch": "ModelPath", "formatter": 5 }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "5", "representation": "green", "text": "Low" }, { "operator": "<=", "thresholdValue": "6", "representation": "yellow", "text": "Medium" }, { "operator": "Default", "representation": "redBright", "text": "High" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "SeverityInt", "color": "redBright" } ] }, "customColumnWidthSetting": "10%" } }, { "columnMatch": "UniqueDevices", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "TotalActivities", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } } ], "labelSettings": [ { "columnId": "Activity", "label": "adversarialModelName" }, { "columnId": "ModelPath", "label": "Model Path" }, { "columnId": "Severity", "label": "riskLevel" }, { "columnId": "UniqueDevices", "label": "uniqueDevices" }, { "columnId": "TotalActivities", "label": "totalActivities" } ] } }, "customWidth": "60", "name": "Models_Grid" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Models" }, "name": "Models_Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "---\n### Top 5 Devices by Model Matches for {TimeRange}" }, "customWidth": "40", "name": "Devices_Chart_Label" }, { "type": 1, "content": { "json": "---\n### Detailed: Top 50 Devices by Model Matches for {TimeRange}" }, "customWidth": "60", "name": "Devices_Grid_Label" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n| summarize \n MaxDeviceRiskScore=max(DeviceCustomNumber1),UniqueDeviceTypeCount=dcount(DeviceCustomString4),\n TimesAlerted=count() by SourceHostName=coalesce(SourceHostName,\"Unknown\"),DeviceCustomString5\n| sort by case(\"{SortBy}\"==\"Count\",TimesAlerted,MaxDeviceRiskScore),SourceHostName\n| project SourceHostName=strcat(substring(SourceHostName,0,22),\"...\"),TimesAlerted\n| limit 5", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "SourceHostName", "yAxis": [ "TimesAlerted" ] } }, "customWidth": "40", "name": "Devices_Chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n| summarize arg_max(TimeGenerated,DeviceCustomDate2, DeviceCustomString2,DeviceCustomString4,DeviceCustomString3),arg_min(TimeGenerated, DeviceCustomDate1),\n// DeviceType=strcat_array(make_set_if(DeviceCustomString4, strlen(DeviceCustomString4) > 0),\", \"),\n// OperatingSystem=strcat_array(make_set_if(DeviceCustomString3, strlen(DeviceCustomString3) > 0),\", \"),\n UniqueDeviceTypeCount=dcount(DeviceCustomString4), IPsFound= dcount(SourceIP), MaxDeviceRiskScore=max(DeviceCustomNumber1), TimesAlerted=count() \nby SourceHostName=coalesce(SourceHostName,\"Unknown\"),DeviceCustomString5\n| extend DevicePath= strcat(\"https://\",DeviceCustomString5,\"/app/workbench/device/\",substring(DeviceCustomString2,-39,36),\"?startTime=\",DeviceCustomDate1,\"&endTime=\",DeviceCustomDate2)\n| project SourceHostName,DevicePath,DeviceCustomString3,DeviceCustomString4,IPsFound,MaxDeviceRiskScore,TimesAlerted\n| sort by case(\"{SortBy}\"==\"Count\",TimesAlerted,MaxDeviceRiskScore),SourceHostName\n| limit 50", "size": 2, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SourceHostName", "formatter": 13, "formatOptions": { "linkColumn": "DevicePath", "linkTarget": "Url", "showIcon": true, "customColumnWidthSetting": "30%" } }, { "columnMatch": "DevicePath", "formatter": 5, "formatOptions": { "linkTarget": "Url", "linkLabel": "Awake-Platform: Device Detail", "customColumnWidthSetting": "20%" } }, { "columnMatch": "IPsFound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "MaxDeviceRiskScore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "33", "representation": "green", "text": "Low" }, { "operator": "<", "thresholdValue": "75", "representation": "yellow", "text": "Medium" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "High" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "IPsFound", "color": "blue" }, { "columnName": "MaxDeviceRiskScore", "color": "brown" } ] }, "customColumnWidthSetting": "10%" } }, { "columnMatch": "TimesAlerted", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "OperatingSystem", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "DeviceType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "UniqueDeviceTypeCount", "formatter": 5 } ], "labelSettings": [ { "columnId": "SourceHostName", "label": "deviceName" }, { "columnId": "DevicePath", "label": "devicePath" }, { "columnId": "DeviceCustomString3", "label": "operatingSystem" }, { "columnId": "DeviceCustomString4", "label": "deviceType" }, { "columnId": "IPsFound", "label": "uniqueIP" }, { "columnId": "MaxDeviceRiskScore", "label": "riskLevel" }, { "columnId": "TimesAlerted", "label": "count" } ] }, "sortBy": [] }, "customWidth": "60", "name": "Devices_Grid" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Devices" }, "name": "Devices_Group" } ], "fallbackResourceIds": [], "styleSettings": {}, "fromTemplateId": "sentinel-AristaAwakeSecurityWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }