{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "885a9b5d-b2d6-4316-a6f9-6f65941b55b8", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Threat Response", "subTarget": "Threat Response", "style": "link" }, { "id": "786ffe19-a17d-4ca9-9355-f97406ae048f", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Comply", "subTarget": "Comply", "preText": "Comply", "style": "link" }, { "id": "efd238ee-2305-4384-a38c-a96d850ab4c9", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Discover", "subTarget": "Discover", "style": "link" }, { "id": "a34745a8-6073-484d-adc5-d5c8e7fb9209", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Microsoft Tooling Health", "subTarget": "Microsoft Tooling Health", "style": "link" }, { "id": "32a1a85f-978f-4b42-b27f-41cfb90e4e14", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Patch", "subTarget": "Patch", "style": "link" } ] }, "name": "horizontal tabs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Vulnerability Distribution by OS\nDistribution of all CVEs in the environment by OS" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \n \nTaniumComplyVulnerabilities_CL\n|where TimeGenerated >= lastRunTime\n and Scan_Type_s != 'container registries'\n|distinct CVE_s, Computer_Name_s, Operating_System_Generation_s\n|summarize count() by Operating_System_Generation_s", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "group": "Operating_System_Generation_s", "createOtherGroup": 25 } }, "name": "query - 4" }, { "type": 1, "content": { "json": "## Critical Vulnerability Distribution by OS\nBreakdown of operating systems with critical CVEs (score >= 9.0). Based on the CVSS v3 standard" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n\nTaniumComplyVulnerabilities_CL \n| where TimeGenerated >= lastRunTime\n and CVSS_v3_Score_d >=9.0 \n| summarize count() by Operating_System_Generation_s\n| sort by count_", "size": 4, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "Operating_System_Generation_s", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false } }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Computers with most # of Critical Vulnerabilities\nTop 10 endpoints, sorted by # of critical CVEs (score >= 9.0). Based on the CVSS v3 standard" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n\nTaniumComplyVulnerabilities_CL \n| where Scan_Type_s != 'container registries'\n and TimeGenerated >= lastRunTime\n and CVSS_v3_Score_d >=9.0\n| summarize count() by Computer_Name_s \n| limit 10\n| sort by count_", "size": 4, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Computer_Name_s", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Computer_Name_s", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "name": "query - 2" }, { "type": 1, "content": { "json": "## Vulnerability Distribution by Year\nDistribution of all CVEs in the environment by year" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let getCveYear = (s:string) { substring(s, 4, 4) };\nlet checkCveYearExists = (s:string) { iff(s startswith 'CVE-', getCveYear(s), 'Not Specified') };\nlet extractCveYear = (year:string,cve:string) { iff(year != '', year, checkCveYearExists(cve)) };\n\nlet lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \nlet Vulnerabilities = \nTaniumComplyVulnerabilities_CL\n|where TimeGenerated >= lastRunTime\n|extend ParsedCveYear = extractCveYear(CVE_Year_s, CVE_s);\n\nVulnerabilities\n| distinct ParsedCveYear,Computer_Name_s, CVE_s\n| extend Year = strcat('Year ', ParsedCveYear)\n| summarize count() by Year, ParsedCveYear\n| sort by ParsedCveYear asc", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "Year", "group": "ParsedCveYear", "createOtherGroup": 100 } }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Vulnerability Distribution by Severity\nDistribution of all CVEs in the environment by Severity. Based on the CVSS v3 standard" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \nTaniumComplyVulnerabilities_CL\n|where TimeGenerated >= lastRunTime\n|distinct CVE_s,CVSS_v3_Severity_s\n|summarize count() by CVSS_v3_Severity_s\n", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "orange" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Unscored", "color": "blue" }, { "seriesName": "Low", "color": "green" } ] } }, "name": "query - 7" }, { "type": 1, "content": { "json": "## Compliance Outliers\nFor each endpoint, sums up the all of its associated CVSS v3 scores. Higher numbers indicate endpoints requiring more attention" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyVulnerabilities_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \nTaniumComplyVulnerabilities_CL\n|where TimeGenerated >= lastRunTime\n and Scan_Type_s != 'container registries'\n and CVSS_v3_Severity_s != 'Unscored'\n|distinct CVE_s,Computer_Name_s,CVSS_v3_Score_d, Operating_System_Generation_s\n|summarize CVECount=dcount(CVE_s), cvss_endpoint_score=sum(todecimal(CVSS_v3_Score_d)) by Computer_Name_s, Operating_System_Generation_s\n|sort by cvss_endpoint_score asc", "size": 0, "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "scatterchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Computer_Name_s", "formatter": 1 }, "leftContent": { "columnMatch": "cvss_endpoint_score", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Computer_Name_s", "formatter": 1 }, "centerContent": { "columnMatch": "cvss_endpoint_score", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "cvss_endpoint_score", "yAxis": [ "CVECount" ], "showLegend": true, "customThresholdLine": "{cvecount}", "customThresholdLineStyle": 5 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "cvss_endpoint_score", "sizeAggregation": "Sum", "legendMetric": "cvss_endpoint_score", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "cvss_endpoint_score", "heatmapPalette": "greenRed" } } }, "name": "query - 15" }, { "type": 1, "content": { "json": "## Comply Findings Summary\nFor each unique combination of Benchmark (e.g. CIS) and Profile (e.g. Level 1), shows the % of endpoints that are compliant" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend Findings = Pass + Fail + Informational\n| extend PercentCompliantEndpoints = (Pass*1.0/Findings)\n| project PercentCompliantEndpoints", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "tileSettings": { "showBorder": false }, "statSettings": { "valueField": "PercentCompliantEndpoints", "valueAggregation": "Average", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 0, "options": { "style": "percent", "useGrouping": true, "maximumFractionDigits": 0 } }, "tagText": "Average", "valueFontStyle": "auto", "valueTooltipSettings": { "tooltip": "hello" } } }, "customWidth": "25", "name": "query - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend Findings = Pass + Fail + Informational\n| extend PercentCompliantEndpoints = (Pass*1.0/Findings)\n| summarize median = percentile(PercentCompliantEndpoints, 50)\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "tileSettings": { "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 0, "options": { "style": "percent", "useGrouping": true, "maximumFractionDigits": 0 } }, "tagText": "Median", "valueFontStyle": "auto", "valueTooltipSettings": { "tooltip": "hello" } } }, "customWidth": "25", "name": "query - 17 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend Findings = Pass + Fail + Informational\n| extend PercentCompliantEndpoints = (Pass*1.0/Findings)\n| project PercentCompliantEndpoints", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "tileSettings": { "showBorder": false }, "statSettings": { "valueField": "PercentCompliantEndpoints", "valueAggregation": "Max", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 0, "options": { "style": "percent", "useGrouping": true, "maximumFractionDigits": 0 } }, "tagText": "Max", "valueFontStyle": "auto", "valueTooltipSettings": { "tooltip": "hello" } } }, "customWidth": "25", "name": "query - 17 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend Findings = Pass + Fail + Informational\n| extend PercentCompliantEndpoints = (Pass*1.0/Findings)\n| project PercentCompliantEndpoints", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "tileSettings": { "showBorder": false }, "statSettings": { "valueField": "PercentCompliantEndpoints", "valueAggregation": "Min", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 0, "options": { "style": "percent", "useGrouping": true, "maximumFractionDigits": 0 } }, "tagText": "Min", "valueFontStyle": "auto", "valueTooltipSettings": { "tooltip": "hello" } } }, "customWidth": "25", "name": "query - 17 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend ['Total Findings'] = Pass + Fail + Informational\n| extend ['% of Compliant Endpoints'] = (todecimal(Pass)/todecimal(['Total Findings']))\n| project Benchmark, Profile, ['% of Compliant Endpoints'], ['Total Findings'], Pass, Fail, Informational\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "% of Compliant Endpoints", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "percent" } } }, { "columnMatch": "% Compliant Endpoints", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "percent" } } } ], "sortBy": [ { "itemKey": "Benchmark", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Benchmark", "sortOrder": 1 } ] }, "name": "query - 16" }, { "type": 1, "content": { "json": "## Top Compliance Failures\nShows the Benchmark and Profile combinations that have resulted in high counts or rates of failure" }, "name": "visualization title" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "02d52897-0eb4-448e-94a0-6376a2e79f0f", "version": "KqlParameterItem/1.0", "name": "BenchmarkFailuresLimit", "label": "Limit to", "type": 1, "isRequired": true, "typeSettings": { "paramValidationRules": [ { "regExp": "\\b([1-9]|[1-9]{1}[0-9]{1}|[1-9]{1}[0-9]{2})\\b", "match": true, "message": "Must be between 1 and 999" } ] }, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "10" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| extend ['Rule Id'] = Rule_ID_s\n| extend Rule = Rule_s\n| project Benchmark, Profile, ['Rule Id'], Rule, Status_Category_s\n| where Status_Category_s == 'Fail'\n| summarize ['Failed Count'] = count() by Benchmark, Profile, ['Rule Id'], Rule\n| order by ['Failed Count'] desc\n| limit {BenchmarkFailuresLimit}\n", "size": 0, "title": "By Failure Count", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumComplyCompliance_CL\n | order by TimeGenerated desc\n | distinct bin(TimeGenerated, 5m)\n | limit 1);\n\nTaniumComplyCompliance_CL\n| where TimeGenerated >= lastRunTime\n and Rule_ID_s != ''\n and Rule_ID_s != '[no results]'\n and Status_Category_s != 'Error'\n| extend Benchmark = Standard_s\n| extend Profile = Profile_s\n| project Benchmark, Profile, Status_Category_s\n| summarize FindingsCount = count() by Benchmark, Profile, Status_Category_s\n| evaluate pivot(Status_Category_s, sum(FindingsCount))\n| extend Findings = Pass + Fail + Informational\n| extend ['% of Failures'] = (Fail*1.0/Findings)\n| order by ['% of Failures'] desc\n| limit {BenchmarkFailuresLimit}\n", "size": 0, "title": "By Failure %", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "% of Failures", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "percent" } } } ] } }, "name": "query - 13 - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Comply" }, "customWidth": "100", "name": "comply group", "styleSettings": { "maxWidth": "100" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Unmanaged Devices by OS\nCount of unmanaged assets by Operating System. Nmap (Level 3+) scans are required" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumDiscoverUnmanagedAssets_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \n TaniumDiscoverUnmanagedAssets_CL\n | where TimeGenerated >= lastRunTime and Os_s <> '' \n | distinct MacAddress_s, Os_s\n | summarize count() by Os_s\n \n ", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Os_s", "createOtherGroup": 20 } }, "name": "visualization title" }, { "type": 1, "content": { "json": "## Unmanaged Devices by Manufacturer\nCount of unmanaged assets by manufacturer. All scan types applicable" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\nTaniumDiscoverUnmanagedAssets_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1);\n\nTaniumDiscoverUnmanagedAssets_CL\n|where TimeGenerated >= lastRunTime and MacOrganization_s <> '' \n|distinct MacAddress_s, MacOrganization_s\n|summarize count() by MacOrganization_s", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Unmanaged Devices by Open Ports\nCounts which ports are most frequently found open on unmanaged assets. Level 4 scans required for port data" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumDiscoverUnmanagedAssets_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n\nTaniumDiscoverUnmanagedAssets_CL\n| where TimeGenerated >= lastRunTime\n and Ports_s != '' \n| distinct MacAddress_s,Ports_s\n| extend dPort = parse_json(strcat('[', Ports_s, ']'))\n| mv-expand dPort\n| extend Port = strcat('Port ', tostring(dPort))\n| project MacAddress_s, Port\n| summarize count() by Port;", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Port", "createOtherGroup": 6, "seriesLabelSettings": [ { "seriesName": "Other", "color": "redBright" } ] } }, "name": "query - 5" }, { "type": 1, "content": { "json": "## All Unmanaged Assets" }, "name": "visualization title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\n TaniumDiscoverUnmanagedAssets_CL\n | extend roundedTime = bin(TimeGenerated, 1m) \n | distinct roundedTime \n | order by roundedTime desc \n | limit 1);\n \n TaniumDiscoverUnmanagedAssets_CL\n | where TimeGenerated >= lastRunTime and HostName_s <> ''\n | project ['Host Name']=HostName_s, ['Mac Address']=MacAddress_s, ['IP Address']=IPAddress, ['Mac Organization']=MacOrganization_s, ['Last Discovered At']=LastDiscoveredAt_t\n | sort by ['Last Discovered At']", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Discover" }, "name": "discover_group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Microsoft Tooling Health ", "items": [ { "type": 1, "content": { "json": "## Microsoft Defender Installation Status\nShows distribution of endpoints with Microsoft Defender installed" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet status = (s:string) { iff(s == 'True', 'Installed', iff(s == 'False', 'Not Installed', iff(s == '', 'Unknown', s)))};\n\nlet lastRunTime = toscalar(\nTaniumDefenderHealth_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nlet MsftDefenderHealth =\nTaniumDefenderHealth_CL\n| where TimeGenerated >= lastRunTime\n| extend ComputerName = clean(Computer_Name_s)\n| extend Status = status(clean(Is_Defender_Installed_s))\n| project ComputerName, Status, TimeGenerated;\n\nMsftDefenderHealth\n| summarize Endpoints = count () by Status", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Installed", "color": "green" }, { "seriesName": "Not Installed", "color": "redBright" }, { "seriesName": "Unknown", "color": "orange" } ] } }, "name": "query - 1" }, { "type": 1, "content": { "json": "## Microsoft Defender Health Status\nFor endpoints with Defender installed, shows Defender health status counts" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet installationStatus = (s:string) { iff(s == 'True', 'Installed', iff(s == 'False', 'Not Installed', iff(s == '', 'Unknown', s)))};\nlet status = (s:string) { iff(s == 'True', 'Healthy', iff(s == 'False', 'Unhealthy', s))};\n\nlet lastRunTime = toscalar(\nTaniumDefenderHealth_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime\n| order by roundedTime desc\n| limit 1);\n\nlet MsftDefenderHealth =\nTaniumDefenderHealth_CL\n| where TimeGenerated >= lastRunTime\n| extend ComputerName = clean(Computer_Name_s)\n| extend IsDefenderInstalled = installationStatus(clean(Is_Defender_Installed_s))\n| extend Status = status(clean(Is_Defender_Healthy_s))\n| project ComputerName, IsDefenderInstalled, Status, TimeGenerated;\n\nMsftDefenderHealth\n| where IsDefenderInstalled == 'Installed'\n| summarize Endpoints = count () by Status", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Healthy", "color": "green" }, { "seriesName": "Unhealthy", "color": "redBright" } ] } }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Microsoft Defender AntiMalware Status\nFor endpoints with Defender installed and in a healthy state, shows AntiMalware service status" }, "name": "text - 22" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet installationStatus = (s:string) { iff(s == 'True', 'Installed', iff(s == 'False', 'Not Installed', iff(s == '', 'Unknown', s)))};\nlet defenderHealth = (s: string) { iif(s == 'True', 'Healthy', iff(s == 'False', 'Unhealthy', s))};\nlet malwareStatus = (s:string) { iff(s == 'True', 'Enabled', iff(s == 'False', 'Not Enabled', iff(s == '', 'Unknown', s)))};\n\nlet lastRunTime = toscalar(\nTaniumDefenderHealth_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nlet MsftDefenderHealth =\nTaniumDefenderHealth_CL\n| where TimeGenerated >= lastRunTime\n| extend ComputerName = clean(Computer_Name_s)\n| extend IsDefenderInstalled = installationStatus(clean(Is_Defender_Installed_s))\n| extend DefenderHealth = defenderHealth(clean(Is_Defender_Healthy_s))\n| extend IsAntiMalwareEnabled = malwareStatus(clean(Is_AntiMalware_Service_Enabled_s))\n| project ComputerName, IsDefenderInstalled, DefenderHealth, IsAntiMalwareEnabled, TimeGenerated;\n\nMsftDefenderHealth\n| where IsDefenderInstalled == 'Installed' and DefenderHealth == 'Healthy'\n| summarize Endpoints = count () by IsAntiMalwareEnabled\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Enabled", "color": "green" }, { "seriesName": "Unknown", "color": "orange" }, { "seriesName": "Not Enabled", "color": "redBright" } ] } }, "name": "query - 32" }, { "type": 1, "content": { "json": "## Microsoft Defender AntiSpyware Status\n For endpoints with Defender installed and in a healthy state, shows AntiSpyware service status" }, "name": "text - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet installationStatus = (s:string) { iff(s == 'True', 'Installed', iff(s == 'False', 'Not Installed', iff(s == '', 'Unknown', s)))};\nlet defenderHealth = (s: string) { iif(s == 'True', 'Healthy', iff(s == 'False', 'Unhealthy', s))};\nlet spywareStatus = (s:string) { iff(s == 'True', 'Enabled', iff(s == 'False', 'Not Enabled', iff(s == '', 'Unknown', s)))};\n\nlet lastRunTime = toscalar(\nTaniumDefenderHealth_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nlet MsftDefenderHealth =\nTaniumDefenderHealth_CL\n| where TimeGenerated >= lastRunTime\n| extend ComputerName = clean(Computer_Name_s)\n| extend IsDefenderInstalled = installationStatus(clean(Is_Defender_Installed_s))\n| extend DefenderHealth = defenderHealth(clean(Is_Defender_Healthy_s))\n| extend IsAntiSpywareEnabled = spywareStatus(clean(Is_AntiSpyware_Service_Enabled_s))\n| project ComputerName, IsDefenderInstalled, DefenderHealth, IsAntiSpywareEnabled, TimeGenerated;\n\nMsftDefenderHealth\n| where IsDefenderInstalled == 'Installed' and DefenderHealth == 'Healthy'\n| summarize Endpoints = count () by IsAntiSpywareEnabled", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Enabled", "color": "green" }, { "seriesName": "N/A on Mac", "color": "blue" }, { "seriesName": "Not Enabled", "color": "redBright" }, { "seriesName": "Unknown", "color": "orange" } ] } }, "name": "query - 31" }, { "type": 1, "content": { "json": "## Microsoft Defender AntiSpyware Signature Update Age\nFor endpoints with Defender installed and AntiSpyware enabled, shows endpoints that need signature updates" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet installationStatus = (s:string) { iff(s == 'True', 'Installed', iff(s == 'False', 'Not Installed', iff(s == '', 'Unknown', s)))};\nlet spywareStatus = (s:string) { iff(s == 'True', 'Enabled', iff(s == 'False', 'Not Enabled', iff(s == '', 'Unknown', s)))};\n\nlet lastRunTime = toscalar(\nTaniumDefenderHealth_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nlet MsftDefenderHealth =\nTaniumDefenderHealth_CL\n| where TimeGenerated >= lastRunTime\n| extend ComputerName = clean(Computer_Name_s)\n| extend IsDefenderInstalled = installationStatus(clean(Is_Defender_Installed_s))\n| extend IsAntiSpywareEnabled = spywareStatus(clean(Is_AntiSpyware_Service_Enabled_s))\n| extend SignatureUpdateAge = toint(clean(AntiSpyware_Signature_Days_Age_s))\n| project ComputerName, SignatureUpdateAge, IsDefenderInstalled, IsAntiSpywareEnabled, TimeGenerated;\n\nMsftDefenderHealth\n| where IsDefenderInstalled == 'Installed' and IsAntiSpywareEnabled == 'Enabled'\n| summarize Endpoints = count () by UpdateAge = strcat(SignatureUpdateAge, ' Days'), SignatureUpdateAge\n| order by SignatureUpdateAge desc", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "UpdateAge", "yAxis": "Endpoints", "xSettings": { "label": "Age (Days)" }, "ySettings": { "label": "Count" } } }, "name": "query - 5" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Microsoft Tooling Health" }, "customWidth": "50", "name": "tooling health column 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "MEMCM Health", "items": [ { "type": 1, "content": { "json": "## Microsoft Configuration Manager Health Status\nDisplays health status for endpoints managed by Configuration Manager (formerly known as SCCM). Will not display properly if Configuration Manager is not set up" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\n\nTaniumSCCMClientHealth_CL\n| where Health_Status_s !has \"N/A\"\n| project ['Computer Name']=clean(Computer_Name_s),\n ['Health Status']=clean(Health_Status_s), \n Reason=clean(Reason_s)", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" }, { "type": 1, "content": { "json": "## Microsoft Configuration Manager Health Distribution\nDisplays distribution of health status of endpoints managed by Configuration Manager. Will not display properly if Configuration Manager is not set up" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\n\nTaniumSCCMClientHealth_CL\n| where Reason_s <> \"\"\n| summarize count() by Reason_s\n| project Health_Status=clean(Reason_s), \n Count=count_\n| render piechart", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Microsoft Tooling Health" }, "customWidth": "50", "name": "tooling health column 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Alerts by Intel Documents over time\nVisualization of how often the top intel docs (detection rules) generated alerts over the last 30 days" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "TaniumThreatResponse_CL\n|project Computer_Name_s,Timestamp_t,Intel_Name_s\n|summarize count () by Timestamp_t, Intel_Name_s\n|render areachart", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "## Threat Response Alerts by Intel Document Type\nBreakdown of how often each intel document type generates alerts" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "TaniumThreatResponse_CL\n| summarize count() by Intel_Type_s\n| render piechart ", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Threat Response Alerts by User\nBreakdown of how often each user generates Tanium alerts" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "TaniumThreatResponse_CL\n| summarize count() by Match_Details_match_properties_user_s\n| render piechart ", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 1, "content": { "json": "## Threat Response Alerts by Process Name\nBreakdown of the alerting processes that come up most frequently" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "TaniumThreatResponse_CL\n| where isnotempty(Match_Details_match_properties_name_s)\n| extend ActingProcessName = Match_Details_match_properties_name_s\n| summarize event_count=count() by bin(Timestamp_t, 7d), ActingProcessName\n| top 20 by event_count\n| render barchart", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 1, "content": { "json": "## Threat Response Alerts by Computer Name and Intel\nBreakdown of the endpoint and intel combinations that generate the most alerts" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "TaniumThreatResponse_CL\n|summarize count() by Computer_Name_s, Intel_Name_s\n|project-rename ['Computer Name']=Computer_Name_s, ['Intel Name']=Intel_Name_s, Count=count_\n|sort by Count", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Threat Response" }, "name": "Threat Response" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Endpoints requiring Reboot\nCount of endpoints that require a reboot" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nlet lastRunTime = toscalar(\nTaniumHighUptime_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumHighUptime_CL\n| where TimeGenerated >= lastRunTime\n|project TimeGenerated, Computer_Name_s,Reboot_Required_s\n|where Reboot_Required_s contains 'Yes'\n|count", "size": 4, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "name": "query - 1" }, { "type": 1, "content": { "json": "## Endpoints with High Uptime\nDisplays endpoints that have not rebooted in >=30 days. May indicate missing patches on Windows machines" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanLeft = (s:string) { iff(s startswith '[\"', substring(s,2), s) };\nlet cleanRight = (s:string) { iff(s endswith '\"]', substring(s, 0, strlen(s) - 2), s) };\nlet clean = (s:string) { cleanLeft(cleanRight(s)) };\nlet parseDayCount = (s:string) { toint(split(s, ' ', 0)[0]) };\n\nlet lastRunTime = toscalar(\nTaniumHighUptime_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumHighUptime_CL\n| where TimeGenerated >= lastRunTime and High_Uptime_s contains 'days'\n| extend Days=parseDayCount(High_Uptime_s)\n| project ['Computer Name']=clean(Computer_Name_s), Days", "size": 1, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Computer_Name", "formatter": 1 }, "leftContent": { "columnMatch": "Days", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0 } }, "name": "query - 3" }, { "type": 1, "content": { "json": "## Patch Compliance\nDisplays distribution of patch compliance across all endpoints" }, "name": "text - 4", "styleSettings": { "margin": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let getIndex = (s:string) { array_index_of(parse_json(s), 'All Patches') };\nlet getDisplayOrder = (s:string) { iff(s startswith 'Over', 101, iff(s == 'Compliant', 0, split(s, ' ', 0)[0])) };\n\nlet lastRunTime = toscalar(\nTaniumPatchListCompliance_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumPatchListCompliance_CL\n| where TimeGenerated >= lastRunTime and Patch_List_Name_s contains 'All Patches'\n| extend patchIndex = getIndex(Patch_List_Name_s)\n| extend PatchId = parse_json(Patch_List_Id_s)[patchIndex]\n| extend ComplianceStatus = tostring(parse_json(Compliance_Status_s)[patchIndex])\n| extend OrderValue = getDisplayOrder(ComplianceStatus)\n| project Computer_Name_s, ComplianceStatus, OrderValue\n| summarize Endpoints = count (), SortOrder = min(OrderValue) by ComplianceStatus\n| order by SortOrder desc\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "ComplianceStatus", "createOtherGroup": 20, "seriesLabelSettings": [ { "seriesName": "1 - 5 missing", "color": "turquoise" }, { "seriesName": "Over 100 missing", "color": "redBright" }, { "seriesName": "Compliant", "color": "green" }, { "seriesName": "51 - 100 missing", "color": "orange" }, { "seriesName": "26 - 50 missing", "color": "yellow" }, { "seriesName": "11 - 25 missing", "color": "purple" }, { "seriesName": "6 - 10 missing", "color": "lightBlue" }, { "seriesName": "Other", "color": "amethyst" } ] } }, "name": "query - 5" }, { "type": 1, "content": { "json": "## Severity of Missing Patches\nDisplays distribution of severity of missing patches across all endpoints" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lastRunTime = toscalar(\nTaniumPatchListApplicability_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumPatchListApplicability_CL\n| where TimeGenerated >= lastRunTime\n| extend PatchId = parse_json(Patch_List_Ids_s)\n| extend Title = parse_json(Title_s)\n| extend InstallStatus = parse_json(Install_Status_s)\n| extend Superseded = parse_json(Superseded_s)\n| extend Severity = parse_json(Severity_s)\n| mv-expand PatchId, Title, InstallStatus, Superseded, Severity\n| project PatchId, Title, InstallStatus, Superseded, Severity\n| where InstallStatus == 'Not Installed'\n and Superseded == 'False'\n| distinct tostring(PatchId), tostring(Title), tostring(Severity)\n| summarize PatchCount = count() by Severity", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Moderate", "color": "yellow" }, { "seriesName": "None", "color": "green" }, { "seriesName": "Low", "color": "blue" }, { "seriesName": "Important", "color": "orange" }, { "seriesName": "Critical", "color": "redBright" } ] } }, "name": "query - 7" }, { "type": 1, "content": { "json": "## Patch Tool Health\n Displays health of built-in OS patching tools on Windows and Linux" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cleanStatus = (s:string) { iff(s == '[no results]', 'No Results', iff(s == 'TSE-Error: Error', 'TSE-Error', s)) };\nlet lastRunTime = toscalar(\nTaniumPatchCoverageStatus_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumPatchCoverageStatus_CL\n| where TimeGenerated >= lastRunTime\n and Status_s != 'Unsuppported'\n and Status_s != 'N/A on Tanium Client Container'\n and Status_s != 'An exception occurred, please see Patch sensors.log file for details.'\n and Status_s != ''\n| extend Status = cleanStatus(Status_s)\n| summarize count() by Status", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Needs Attention", "color": "orange" }, { "seriesName": "TSE-Error", "color": "redBright" }, { "seriesName": "Optimal", "color": "green" }, { "seriesName": "Initializing", "color": "purple" }, { "seriesName": "No Results", "color": "blue" } ] } }, "name": "query - 9" }, { "type": 1, "content": { "json": "## Critical/Important Missing Patches by Year\nDisplays the distribution of Critical or Important patches by the patch's year of release" }, "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let getReleaseYear = (s:string){ split(s,'/',2)[0] };\n\nlet lastRunTime = toscalar(\nTaniumPatchListApplicability_CL\n| extend roundedTime = bin(TimeGenerated, 1m) \n| distinct roundedTime \n| order by roundedTime desc \n| limit 1); \n\nTaniumPatchListApplicability_CL\n| where TimeGenerated >= lastRunTime\n| extend PatchId = parse_json(Patch_List_Ids_s)\n| extend Title = parse_json(Title_s)\n| extend KbArticle = parse_json(KB_Articles_s)\n| extend InstallStatus = parse_json(Install_Status_s)\n| extend Severity = parse_json(Severity_s)\n| extend Superseded = parse_json(Superseded_s)\n| extend ReleaseDate = parse_json(Release_Date_s)\n| mv-expand PatchId, Title, KbArticle, InstallStatus, Severity, ReleaseDate, Superseded\n| where InstallStatus == 'Not Installed'\n and (Severity == 'Critical' or Severity == 'Important')\n and Superseded == 'False'\n| extend ReleaseYear = strcat('Year ', getReleaseYear(ReleaseDate))\n| where Title != ''\n| distinct tostring(Title), tostring(ReleaseYear), tostring(Severity)\n| summarize Patches = count() by ReleaseYear, Severity\n| order by ReleaseYear asc", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "ReleaseYear", "yAxis": [ "Patches" ], "createOtherGroup": 100 } }, "name": "query - 11" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Patch" }, "name": "Patch" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-TaniumWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }