{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "909e17ae-41a9-4f76-83ba-c8d6a5d49780",
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "ac31c596-b13e-463d-8eaf-caef627e844a",
"version": "KqlParameterItem/1.0",
"name": "InternalWSs",
"type": 1,
"query": "SecurityIncident\r\n| take 1\r\n| parse IncidentUrl with * \"/workspaces/\" Workspace \"/\" *\r\n| project Workspace",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "ad9329d3-470a-4a45-ab52-2a9f81372203",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"type": 6,
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)",
"isHiddenWhenLocked": true,
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "d3ed9f5f-b558-40e7-9ea9-2a8b3853e2e8",
"version": "KqlParameterItem/1.0",
"name": "Workspace",
"type": 5,
"query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| project subscriptionId,id,name\r\n| where '{Subscription}' has subscriptionId\r\n| project value =id, label = name, selected = iff(name =~ '{InternalWSs}', true, false)",
"isHiddenWhenLocked": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "6f115f05-f48e-4ac4-8603-129c7afbc31e",
"version": "KqlParameterItem/1.0",
"name": "InternalRG",
"type": 1,
"query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| where id =~ \"{Workspace}\"\r\n| project resourceGroup",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "ab4782bf-fdb2-4c4c-a850-ef92420d2f4b",
"version": "KqlParameterItem/1.0",
"name": "Watchlist",
"type": 2,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourceGroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{InternalWSs}/providers/Microsoft.SecurityInsights/watchlists?api-version=2019-01-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}",
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 12,
"label": "Watchlist to Modify"
}
],
"style": "pills",
"queryType": 12
},
"name": "parameters - 1"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "a30180d1-89c7-4205-87c4-e882224065d8",
"version": "KqlParameterItem/1.0",
"name": "SelectType",
"label": "Show Type",
"type": 10,
"isRequired": true,
"query": "_GetWatchlist('SOCMA')\r\n| project a = pack_array(Type, \"1 : Show All\")\r\n| summarize a = make_set(a)\r\n| mv-expand a\r\n| order by tostring(a) asc",
"value": "Security Monitoring",
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('SOCMA')\r\n| where Type = iif('{SelectType}' ==\"1 : Show All\",true,Type in ('{SelectType}') )\r\n| project Number, Title, Type, Question, SOCMAScore, SOCMAWeight, SOCMA, Answer, Examples, Notes, _DTItemId",
"size": 1,
"exportedParameters": [
{
"fieldName": "_DTItemId",
"parameterName": "_DTItemId",
"parameterType": 1
},
{
"fieldName": "Number",
"parameterName": "Number",
"parameterType": 1
},
{
"fieldName": "Type",
"parameterName": "Type",
"parameterType": 1
},
{
"fieldName": "Title",
"parameterName": "Title",
"parameterType": 1
},
{
"fieldName": "Question",
"parameterName": "Question",
"parameterType": 1
},
{
"fieldName": "Answer",
"parameterName": "Answer",
"parameterType": 1
},
{
"fieldName": "SOCMA",
"parameterName": "SOCMA",
"parameterType": 1
},
{
"fieldName": "SOCMAScore",
"parameterName": "SOCMAScore",
"parameterType": 1
},
{
"fieldName": "SOCMAWeight",
"parameterName": "SOCMAWeight",
"parameterType": 1
},
{
"fieldName": "Examples",
"parameterName": "Examples",
"parameterType": 1
},
{
"fieldName": "Notes",
"parameterName": "Notes",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"rowLimit": 800,
"filter": true
}
},
"name": "query - 2"
},
{
"type": 1,
"content": {
"json": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\r\n\r\nThe DTItemId is : **{_DTItemId}**
\r\nThe Number is : **{Number}**
\r\nThe Title is : **{Title}**
\r\nThe Type is : **{Type}**
\r\nThe Question is : **{Question}**
\r\nThe Answer is : {Answer}
\r\nThe SOCMA is : **{SOCMA}**
\r\nThe SOCMAScore is : **{SOCMAScore}**
\r\nThe SOCMAWeight is : **{SOCMAWeight}**
\r\nThe Examples is : **{Examples}**
\r\nThe Notes is : {Notes}"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "d9eeb79f-7025-438c-92a7-a988c09a4037",
"linkTarget": "ArmAction",
"linkLabel": "Update SOCMA : 1 - Initial",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
"headers": [],
"params": [],
"body": "{ \r\n \"properties\": { \r\n \"itemsKeyValue\": {\r\n \"Number\": \"{Number}\",\r\n \"Title\": \"{Title}\",\r\n \"Type\" : \"{Type}\",\r\n \"Question\": \"{Question}\",\r\n \"Answer\": \"{Answer}\",\r\n \"SOCMA\": \"Partial\", \r\n \"SOCMAScore\": \"1\",\r\n \"SOCMAWeight\": \"{SOCMAWeight}\",\r\n \"Examples\": \"{Examples}\",\r\n \"Notes\": \"{Notes}\"\r\n } \r\n } \r\n}",
"httpMethod": "PUT",
"title": "Update SOC Maturity Score",
"description": "# This action will update the following:\n\n{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\n\nThe DTItemId is : **{_DTItemId}**
\nThe Number is : **{Number}**
\nThe Title is : **{Title}**
\nThe Type is : **{Type}**
\nThe Question is : **{Question}**
\nThe Answer is : {Answer}
\nThe SOCMA is : **{SOCMA}**
\nThe SOCMAScore is : **{SOCMAScore}**
\nThe SOCMAWeight is : **{SOCMAWeight}**
\nThe Examples is : **{Examples}**
\nThe Notes is : {Notes}",
"actionName": "Update SOCMA : 1 - Initial",
"runLabel": "Save SOCMA : 1 - Initial"
}
},
{
"id": "fed80f87-5326-4832-aa27-7d1fc3d623d7",
"linkTarget": "ArmAction",
"linkLabel": "Update SOCMA : 2 - Managed",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
"headers": [],
"params": [],
"body": "{ \r\n \"properties\": { \r\n \"itemsKeyValue\": {\r\n \"Number\": \"{Number}\",\r\n \"Title\": \"{Title}\",\r\n \"Type\" : \"{Type}\",\r\n \"Question\": \"{Question}\",\r\n \"Answer\": \"{Answer}\",\r\n \"SOCMA\": \"Yes\", \r\n \"SOCMAScore\": \"2\",\r\n \"SOCMAWeight\": \"{SOCMAWeight}\",\r\n \"Examples\": \"{Examples}\",\r\n \"Notes\": \"{Notes}\"\r\n } \r\n } \r\n}",
"httpMethod": "PUT",
"title": "Update SOC Maturity Score",
"description": "# This action will update the following:\n\n{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\n\nThe DTItemId is : **{_DTItemId}**
\nThe Number is : **{Number}**
\nThe Title is : **{Title}**
\nThe Type is : **{Type}**
\nThe Question is : **{Question}**
\nThe Answer is : {Answer}
\nThe SOCMA is : **{SOCMA}**
\nThe SOCMAScore is : **{SOCMAScore}**
\nThe SOCMAWeight is : **{SOCMAWeight}**
\nThe Examples is : **{Examples}**
\nThe Notes is : {Notes}",
"actionName": "Update SOCMA : 2 - Managed",
"runLabel": "Save SOCMA : 2 - Managed"
}
},
{
"id": "f7dca1ee-0b05-4fa2-ae39-e3636d8b1bd7",
"linkTarget": "ArmAction",
"linkLabel": "Update SOCMA : 3 - Defined",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
"headers": [],
"params": [],
"body": "{ \r\n \"properties\": { \r\n \"itemsKeyValue\": {\r\n \"Number\": \"{Number}\",\r\n \"Title\": \"{Title}\",\r\n \"Type\" : \"{Type}\",\r\n \"Question\": \"{Question}\",\r\n \"Answer\": \"{Answer}\",\r\n \"SOCMA\": \"Yes\", \r\n \"SOCMAScore\": \"3\",\r\n \"SOCMAWeight\": \"{SOCMAWeight}\",\r\n \"Examples\": \"{Examples}\",\r\n \"Notes\": \"{Notes}\"\r\n } \r\n } \r\n}",
"httpMethod": "PUT",
"title": "Update SOC Maturity Score",
"description": "# This action will update the following:\n\n{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\n\nThe DTItemId is : **{_DTItemId}**
\nThe Number is : **{Number}**
\nThe Title is : **{Title}**
\nThe Type is : **{Type}**
\nThe Question is : **{Question}**
\nThe Answer is : {Answer}
\nThe SOCMA is : **{SOCMA}**
\nThe SOCMAScore is : **{SOCMAScore}**
\nThe SOCMAWeight is : **{SOCMAWeight}**
\nThe Examples is : **{Examples}**
\nThe Notes is : {Notes}",
"actionName": "Update SOCMA : 3 - Defined",
"runLabel": "Save SOCMA : 3 - Defined"
}
},
{
"id": "8964b9f7-6320-40d8-85e6-3a4f548f20e8",
"linkTarget": "ArmAction",
"linkLabel": "Update SOCMA : 4 - Quantitatively Managed",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
"headers": [],
"params": [],
"body": "{ \r\n \"properties\": { \r\n \"itemsKeyValue\": {\r\n \"Number\": \"{Number}\",\r\n \"Title\": \"{Title}\",\r\n \"Type\" : \"{Type}\",\r\n \"Question\": \"{Question}\",\r\n \"Answer\": \"{Answer}\",\r\n \"SOCMA\": \"Yes\", \r\n \"SOCMAScore\": \"4\",\r\n \"SOCMAWeight\": \"{SOCMAWeight}\",\r\n \"Examples\": \"{Examples}\",\r\n \"Notes\": \"{Notes}\"\r\n } \r\n } \r\n}",
"httpMethod": "PUT",
"title": "Update SOC Maturity Score",
"description": "# This action will update the following:\n\n{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\n\nThe DTItemId is : **{_DTItemId}**
\nThe Number is : **{Number}**
\nThe Title is : **{Title}**
\nThe Type is : **{Type}**
\nThe Question is : **{Question}**
\nThe Answer is : {Answer}
\nThe SOCMA is : **{SOCMA}**
\nThe SOCMAScore is : **{SOCMAScore}**
\nThe SOCMAWeight is : **{SOCMAWeight}**
\nThe Examples is : **{Examples}**
\nThe Notes is : {Notes}",
"actionName": "Update SOCMA : 4 - Quantitatively Managed",
"runLabel": "Save SOCMA : 4 - Quantitatively Managed"
}
},
{
"id": "0ab1ad27-b7de-4a95-917a-005a2b925516",
"linkTarget": "ArmAction",
"linkLabel": "Update SOCMA : 5 - Optimizing",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
"headers": [],
"params": [],
"body": "{ \r\n \"properties\": { \r\n \"itemsKeyValue\": {\r\n \"Number\": \"{Number}\",\r\n \"Title\": \"{Title}\",\r\n \"Type\" : \"{Type}\",\r\n \"Question\": \"{Question}\",\r\n \"Answer\": \"{Answer}\",\r\n \"SOCMA\": \"Yes\", \r\n \"SOCMAScore\": \"5\",\r\n \"SOCMAWeight\": \"{SOCMAWeight}\",\r\n \"Examples\": \"{Examples}\",\r\n \"Notes\": \"{Notes}\"\r\n } \r\n } \r\n}",
"httpMethod": "PUT",
"title": "Update SOC Maturity Score",
"description": "# This action will update the following:\n\n{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\n\nThe DTItemId is : **{_DTItemId}**
\nThe Number is : **{Number}**
\nThe Title is : **{Title}**
\nThe Type is : **{Type}**
\nThe Question is : **{Question}**
\nThe Answer is : {Answer}
\nThe SOCMA is : **{SOCMA}**
\nThe SOCMAScore is : **{SOCMAScore}**
\nThe SOCMAWeight is : **{SOCMAWeight}**
\nThe Examples is : **{Examples}**
\nThe Notes is : {Notes}",
"actionName": "Update SOCMA : 5 - Optimizing",
"runLabel": "Save SOCMA : 5 - Optimizing"
}
}
]
},
"name": "links - 2"
}
],
"fallbackResourceIds": [
""
],
"fromTemplateId": "sentinel-UpdateSOCMaturityScore",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}