{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "a4b35478-499a-4fcc-8424-63abbb698bfa", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "AI Analyst", "subTarget": "ai-analyst", "style": "link" }, { "id": "45805ae8-29d7-4774-a10a-8d60af407bbf", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "DETECT + RESPOND/Network ", "subTarget": "overview", "style": "link" }, { "id": "7a64cd79-3a09-4046-8d6f-ba24fc2bab6c", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "DETECT + RESPOND/Apps", "subTarget": "cloud", "style": "link" }, { "id": "0dc4ab10-226f-422f-a7bb-9e905f96fb6c", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "DETECT + RESPOND/Email", "subTarget": "email", "style": "link" }, { "id": "2eac3f00-5164-4a77-9781-118eb681b729", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "RESPOND", "subTarget": "agn", "style": "link" }, { "id": "ff97b7e6-6bbf-401c-aaff-833d5309f00d", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "System Status", "subTarget": "status", "style": "link" } ] }, "name": "tabs" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "96e10804-35d4-4d5c-b2d8-1af544471721", "version": "KqlParameterItem/1.0", "name": "Timeframe", "type": 4, "description": "Set the global time range for all queries below", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Timescale " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "610136a1-b7cf-4eb3-9ef6-51a2d22e1621", "version": "KqlParameterItem/1.0", "name": "_severity", "type": 1, "description": "parameter to drill down on clicked severity tile", "value": "", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "label": "severity" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string, status_count: long) [0, \"Compliance\", 1, 0, \"Informational\", 2, 0, \"Suspicious\", 3, 0, \"Critical\", 4]\r\n| union\r\n (\r\n darktrace_model_alerts_CL\r\n | where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n | extend ThreatRiskLevel=score_d\r\n | extend status = case( \r\n compliance_b == false and Category == \"Critical\", \"Critical\",\r\n compliance_b == true, \"Compliance\",\r\n compliance_b == false and Category == \"Suspicious\", \"Suspicious\",\r\n compliance_b == false and Category == \"Informational\", \"Informational\", \r\n \"True\"\r\n )\r\n | where status != \"True\"\r\n | extend status_count = case(status == \"Critical\", 4, status == \"Suspicious\", 3, status == \"Informational\", 2, 1)\r\n | summarize Count = count() by status, status_count\r\n )\r\n| summarize Count=sum(Count) by status, status_count\r\n| sort by status_count asc", "size": 3, "title": "Model Breaches by Category", "timeContextFromParameter": "Timeframe", "exportFieldName": "status", "exportParameterName": "_severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Compliance", "representation": "turquoise", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "model breaches by severity" }, { "type": 1, "content": { "json": "_Click on the tiles to view more details (maximum 100 entries displayed)_", "style": "info" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| project-rename MitreTechniques=mitreTechniques_s\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where compliance_b == true\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Compliance Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Compliance" }, "name": "Low severity model breaches" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| project-rename MitreTechniques=mitreTechniques_s\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where compliance_b == false and Category == \"Informational\"\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n\r\n", "size": 0, "title": "Informational Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Informational" }, "name": "Medium severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| project-rename MitreTechniques=mitreTechniques_s\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where compliance_b == false and Category == \"Suspicious\"\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| limit 100\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Suspicious Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Suspicious" }, "name": "High severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| project-rename MitreTechniques=mitreTechniques_s\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where compliance_b == false and Category == \"Critical\"\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| limit 100\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Critical Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "red", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Critical" }, "name": "Critical severity model breaches" } ] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isNotEqualTo", "value": "hidden" }, "name": "Drill down group for different severities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 0, "title": "Total Model Breaches", "color": "orange", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "Model Breaches" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "breaches in group" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries in this tab _", "style": "info" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| project-rename NetworkRuleName=modelName_s\r\n| summarize event_count=count() by NetworkRuleName\r\n| top 10 by event_count", "size": 0, "title": "Top 10 Most Breached Models", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60ch" } }, { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } } ], "labelSettings": [ { "columnId": "event_count", "label": "Count" } ] } }, "customWidth": "55", "name": "most breached models" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\ndarktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename DstHostname=destHost_s\r\n| where isnotempty(DstHostname) \r\n| summarize count(NetworkRuleName) by DstHostname", "size": 3, "title": "Top External Hostnames", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "45", "name": "top external hostnames" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename DtURL=breachUrl_s\r\n| project-rename ThreatRiskLevel=score_d\r\n| project-rename NetworkRuleName=modelName_s\r\n| project TimeGenerated, ThreatRiskLevel, NetworkRuleName, SrcHostname, SrcIpAddr, DtURL\r\n| top 10 by ThreatRiskLevel desc ", "size": 0, "title": "Top 10 Model Breaches with Highest Severity", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "Severity", "formatter": 8, "formatOptions": { "min": 1, "max": 10, "palette": "yellowOrangeRed" } }, { "columnMatch": "DarktraceURL", "formatter": 5 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "name": "Top 10 hitting devices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\")\n| project-rename DstIpAddr=destIP_s\n| where isnotempty(DstIpAddr) \n| where DstIpAddr !startswith \"10\"\n| where DstIpAddr !startswith \"192\"\n| where DstIpAddr !startswith \"172\"\n| summarize event_count=count() by DstIpAddr\n| top 10 by event_count", "size": 0, "title": "Top 10 External IPs", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "80", "name": "top 10 external IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s !contains (\"SaaS\") and modelName_s !contains (\"IaaS\") and compliance_b == true\r\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})\r\n", "size": 0, "title": "Compliance Model Breaches Over Time", "color": "orange", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "Model Breaches" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "compliance breaches over time" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "name": "overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "610136a1-b7cf-4eb3-9ef6-51a2d22e1621", "version": "KqlParameterItem/1.0", "name": "_severity", "type": 1, "description": "parameter to drill down on clicked severity tile", "value": "hidden", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "label": "severity" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string, status_count: long) [0, \"Low\", 1, 0, \"Medium\", 2, 0, \"High\", 3, 0, \"Critical\", 4]\r\n| union\r\n (\r\n darktrace_model_alerts_CL\r\n | where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\"))\r\n | extend ThreatRiskLevel=score_d\r\n | extend status = case( \r\n ThreatRiskLevel >= 75, \"Critical\",\r\n ThreatRiskLevel < 25, \"Low\",\r\n ThreatRiskLevel >= 50 and ThreatRiskLevel < 75, \"High\",\r\n ThreatRiskLevel >= 25 and ThreatRiskLevel < 50, \"Medium\", \r\n \"True\"\r\n )\r\n | where status != \"True\"\r\n | extend status_count = case(status == \"Critical\", 4, status == \"High\", 3, status == \"Medium\", 2, 1)\r\n | summarize Count = count() by status, status_count\r\n )\r\n| summarize Count=sum(Count) by status, status_count\r\n| sort by status_count asc", "size": 3, "title": "Model Breaches by Severity", "timeContextFromParameter": "Timeframe", "exportFieldName": "status", "exportParameterName": "_severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "model breaches by severity" }, { "type": 1, "content": { "json": "_Click on the tiles to view more details (maximum 100 entries displayed)_", "style": "info" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\"))\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| extend MitreTechniques=parse_json(mitreTechniques_s)\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where ThreatRiskLevel < 25\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Low Severity Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Low" }, "name": "Low severity model breaches" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\"))\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| extend MitreTechniques=parse_json(mitreTechniques_s)\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where ThreatRiskLevel >= 25 and ThreatRiskLevel < 50\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Medium Severity Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Medium" }, "name": "Medium severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\"))\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| extend MitreTechniques=parse_json(mitreTechniques_s)\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where ThreatRiskLevel >= 50 and ThreatRiskLevel < 75\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "High Severity Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "High" }, "name": "High severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\"))\r\n| extend EventCount = 1\r\n| extend EventType = \"NetworkSession\"\r\n| extend EventSchema = \"NetworkSession\"\r\n| extend EventSchemaVersion = \"0.2.2\"\r\n| extend EventResult = \"Success\"\r\n| extend DvcAction = \"Allow\"\r\n| project-rename EventSeverity=score_d\r\n| extend EventVendor = \"Darktrace\"\r\n| extend EventProduct = \"Enterprise Immune System\"\r\n| project-rename EventStartTime = breachTime_s\r\n| extend EventEndTime = EventStartTime\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename NetworkRuleNumber=pid_d\r\n| extend Rule = \"NetworkRuleNumber\"\r\n| project-rename ThreatId=threatID_d\r\n| extend ThreatName = NetworkRuleName\r\n| project-rename ThreatCategory=dtProduct_s\r\n| extend ThreatRiskLevel=EventSeverity\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename SrcMacAddr=sourceMac_s\r\n| project-rename SrcPortNumber=sourcePort_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstPortNumber=destPort_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename DstMacAddr=destMac_s\r\n| extend MitreTechniques=parse_json(mitreTechniques_s)\r\n| project-rename DarktraceLink=breachUrl_s\r\n| where ThreatRiskLevel >= 75\r\n| limit 100\r\n| project TimeGenerated, NetworkRuleName, ThreatRiskLevel, ThreatId, DarktraceLink, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, EventStartTime, MitreTechniques\r\n| sort by TimeGenerated desc\r\n\r\n", "size": 0, "title": "Critical Severity Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "LogSeverity", "formatter": 8, "formatOptions": { "min": 1, "max": 10, "palette": "greenRed" } }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Critical" }, "name": "Critical severity model breaches" } ] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isNotEqualTo", "value": "hidden" }, "name": "Drill down group for different severities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"SaaS\")\r\n| make-series count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 3, "title": "Total SaaS Model Breaches", "color": "orange", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "count_", "label": "Model Breches" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "customWidth": "50", "name": "saas user graph / time ", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"IaaS\")\r\n| make-series count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 3, "title": "Total IaaS Model Breaches", "color": "orange", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "count_", "label": "Model Breaches" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "customWidth": "50", "name": "iaas user graph / time", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries in this tab _", "style": "info" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"SaaS\")\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename SrcHostname=hostname_s\r\n| summarize Count=count() by SrcHostname\r\n| top 10 by Count\r\n| project SrcHostname, Count\r\n\r\n", "size": 0, "title": "Top 10 SaaS Users With Most Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "orange" } }, { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60ch" } } ] } }, "name": "most breached SaaS users" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"SaaS\")\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename DtURL=breachUrl_s\r\n| project-rename ThreatRiskLevel=score_d\r\n| project TimeGenerated, ThreatRiskLevel, NetworkRuleName, SrcHostname, SrcIpAddr, DtURL\r\n| top 10 by ThreatRiskLevel desc ", "size": 0, "title": "Top 10 Highest Severity SaaS Model Breaches", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "Severity", "formatter": 8, "formatOptions": { "min": 1, "max": 10, "palette": "yellowOrangeRed" } }, { "columnMatch": "DarktraceURL", "formatter": 5 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "name": "Top 10 hitting SaaS devices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and (modelName_s contains (\"SaaS\") or modelName_s contains (\"IaaS\")) and compliance_b == true\r\n| make-series count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 0, "title": "Total XaaS Compliance Model Breaches", "color": "orange", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "count_", "label": "Model Breaches" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "compliance breaches over time" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "cloud" }, "name": "Cloud group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"Antigena\") and modelName_s contains (\"Network\")\r\n| project-rename SrcIpAddr=SourceIP\r\n| project-rename SrcHostname=hostname_s\r\n| project-rename DtURL=breachUrl_s\r\n| project-rename ThreatRiskLevel=score_d\r\n| project-rename NetworkRuleName=modelName_s\r\n| project-rename DstIpAddr=destIP_s\r\n| project-rename DstHostname=destHost_s\r\n| project-rename EventStartTime = breachTime_s\r\n| extend DtMitreTechniques=parse_json(mitreTechniques_s)\r\n| project-rename ThreatId=threatID_d\r\n| limit 100\r\n| project TimeGenerated, ThreatRiskLevel, NetworkRuleName, ThreatId, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, DtURL, EventStartTime, DtMitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "/Network ", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "agnActivity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url" } }, "subtitleContent": { "columnMatch": "TimeGenerated", "formatter": 6 }, "leftContent": { "columnMatch": "Device" }, "secondaryContent": { "columnMatch": "msgInfo", "formatter": 1 }, "showBorder": true, "sortCriteriaField": "TimeGenerated", "sortOrderField": 2, "size": "full" } }, "name": "top level query " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s ==\"Policy Breach\" and modelName_s contains (\"Antigena\") and modelName_s contains (\"SaaS\")\n| project-rename SrcIpAddr=SourceIP\n| project-rename SrcHostname=hostname_s\n| project-rename DtURL=breachUrl_s\n| project-rename ThreatRiskLevel=score_d\n| project-rename NetworkRuleName=modelName_s\n| project-rename DstIpAddr=destIP_s\n| project-rename DstHostname=destHost_s\n| project-rename EventStartTime = breachTime_s\n| extend DtMitreTechniques=parse_json(mitreTechniques_s)\n| project-rename ThreatId=threatID_d\n| limit 100\n| project TimeGenerated, ThreatRiskLevel, NetworkRuleName, ThreatId, SrcHostname, SrcIpAddr, DstHostname, DstIpAddr, DtURL, EventStartTime, DtMitreTechniques\n| sort by TimeGenerated desc\n", "size": 0, "title": "/Apps", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "agn" }, "name": "agn group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cd64e441-332e-4f47-8602-a25828ebc053", "version": "KqlParameterItem/1.0", "name": "aia_type", "label": "AI Analyst Incident Types", "type": 2, "description": "Filter out the types of AI Analyst Incidents available.", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\n {\"value\": \"darktrace_model_alerts_CL | where dtProduct_s =='AI Analyst' | project-rename DtIncidentName=title_s | project-rename DtCurrentGroup=externalId_g | project-rename GroupScore=groupScore_d | project-rename SrcDeviceName=bestDeviceName_s | limit 100 | summarize DtMaxIncidentScore=max(GroupScore), take_any(SrcDeviceName, DtIncidentName) by DtCurrentGroup | project DtMaxIncidentScore, DtIncidentName, SrcDeviceName, DtCurrentGroup\", \"label\": \"All\"},\n {\"value\": \"darktrace_model_alerts_CL | where dtProduct_s =='AI Analyst' | project-rename DtIncidentName=title_s | project-rename DtCurrentGroup=externalId_g | project-rename GroupScore=groupScore_d | project-rename SrcDeviceName=bestDeviceName_s | where SrcDeviceName !contains 'SaaS' | limit 100 | summarize DtMaxIncidentScore=max(GroupScore), take_any(SrcDeviceName, DtIncidentName) by DtCurrentGroup | project DtMaxIncidentScore, DtIncidentName, SrcDeviceName, DtCurrentGroup\", \"label\": \"Network\"},\n {\"value\": \"darktrace_model_alerts_CL | where dtProduct_s =='AI Analyst' | project-rename DtIncidentName=title_s | project-rename DtCurrentGroup=externalId_g | project-rename GroupScore=groupScore_d | project-rename SrcDeviceName=bestDeviceName_s | where SrcDeviceName contains 'SaaS' | limit 100 | summarize DtMaxIncidentScore=max(GroupScore), take_any(SrcDeviceName, DtIncidentName) by DtCurrentGroup | project DtMaxIncidentScore, DtIncidentName, SrcDeviceName, DtCurrentGroup\", \"label\": \"SaaS\"}\n]", "timeContext": { "durationMs": 86400000 }, "value": "darktrace_model_alerts_CL | where dtProduct_s =='AI Analyst' | project-rename DtIncidentName=title_s | project-rename DtCurrentGroup=externalId_g | project-rename GroupScore=groupScore_d | project-rename SrcDeviceName=bestDeviceName_s | limit 100 | summarize DtMaxIncidentScore=max(GroupScore), take_any(SrcDeviceName, DtIncidentName) by DtCurrentGroup | project DtMaxIncidentScore, DtIncidentName, SrcDeviceName, DtCurrentGroup" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{aia_type}", "size": 0, "title": "AI Analyst Incidents", "timeContextFromParameter": "Timeframe", "exportFieldName": "DtCurrentGroup", "exportParameterName": "SelectedAIAGroup", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 1, "content": { "json": "_ Selecting an AI Analyst Incident in the table above will put its corresponding Events in focus below _", "style": "info" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s ==\"AI Analyst\"\n| project-rename EventStartTime=startTime_s\n| project-rename EventEndTime = endTime_s\n| project-rename DtIncidentEventName=title_s\n| project-rename DtCurrentGroup=externalId_g //externalId is the Current Group ID from Darktrace \n| project-rename ThreatCategory=dtProduct_s\n| extend ThreatRiskLevel=score_d //This is the event score, which is different from the GroupScore\n| project-rename SrcHostname=hostname_s\n| project-rename DtURL=url_s\n| project-rename DtSummary=summary_s\n| project-rename DtGroupScore=groupScore_d\n| project-rename DtGroupCategory=groupCategory_s\n| project-rename SrcDeviceName=bestDeviceName_s\n| where DtCurrentGroup contains \"{SelectedAIAGroup}\"\n| limit 100\n| project TimeGenerated, DtIncidentEventName, ThreatCategory, ThreatRiskLevel, DtSummary, SrcDeviceName, SrcHostname, DtURL, DtCurrentGroup, DtGroupScore, DtGroupCategory, EventStartTime, EventEndTime\n| sort by TimeGenerated desc\n\n", "size": 0, "title": "Selected AI Analyst Incident Events", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"AI Analyst\"\r\n| make-series count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 3, "title": "Total AI Analyst Incident Events", "color": "lightBlue", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "showMetrics": false, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true, "minimumFractionDigits": 0, "maximumFractionDigits": 0 } } } } }, "name": "incidents in group" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries in this tab _", "style": "info" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\r\n| where dtProduct_s ==\"AI Analyst\"\r\n| extend DtIncidentEventName = title_s\r\n| summarize event_count=count() by DtIncidentEventName\r\n| top 10 by event_count", "size": 0, "title": "Top 10 Most Frequent AI Analyst Incident Events", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "blue" } } ], "labelSettings": [ { "columnId": "event_count", "label": "Count" } ] } }, "name": "Top 10 Most Frequent Incidents" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "ai-analyst" }, "name": "ai- analyst group " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s == \"Antigena Email\"\n| extend Actions = parse_json(actions_s)\n| extend Hold_Email=set_has_element(Actions, \"Hold\")\n| extend Junk_Email=set_has_element(Actions, \"Move to Junk\")\n| extend Lock_Link=set_has_element(Actions, \"Lock Link\")\n| extend Lock_All_Links=set_has_element(Actions, \"Lock All Links\")\n| extend Double_Lock_Link=set_has_element(Actions, \"Double Lock Link\")\n| extend Double_Lock_All_Links=set_has_element(Actions, \"Double Lock All Links\")\n| extend Strip_Attachment=set_has_element(Actions, \"Stip Attachment\")\n| extend Strip_All_Attachments=set_has_element(Actions, \"Strip All Attachments\")\n| extend Convert_Attachment=set_has_element(Actions, \"Convert Attachment\")\n| extend Convert_All_Attachments=set_has_element(Actions, \"Convert All Attachments\")\n| extend Unspoof=set_has_element(Actions, \"Unspoof\")\n| extend XAxis=set_has_element(Actions, \"Unspoof\")\n| summarize XAxis=countif(XAxis == true), Hold_Email=countif(Hold_Email == true), Junk_Email=countif(Junk_Email == true), Lock_Link=countif(Lock_Link == true), Lock_All_Links=countif(Lock_All_Links == true), Double_Lock_Link=countif(Double_Lock_Link == true), Double_Lock_All_Links=countif(Double_Lock_All_Links == true), Convert_Attachment=countif(Convert_Attachment == true), Convert_All_Attachments=countif(Convert_All_Attachments == true), Strip_Attachment=countif(Strip_Attachment == true), Strip_All_Attachments=countif(Strip_All_Attachments == true), Unspoof=countif(Unspoof == true)", "size": 0, "title": "Total Actions Taken", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "sortBy": [ { "itemKey": "Hold_Email", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Hold_Email", "sortOrder": 2 } ], "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Junk_Email", "label": "Junk Email", "color": "redBright" }, { "seriesName": "Lock_Link", "label": "Lock Link", "color": "lightBlue" }, { "seriesName": "Double_Lock_Link", "label": "Double Lock Link", "color": "green" }, { "seriesName": "Strip_Attachment", "label": "Strip Attachment", "color": "purple" }, { "seriesName": "Convert_Attachment", "label": "Convert Attachment", "color": "orange" }, { "seriesName": "Unspoof", "label": "Unspoof", "color": "pink" }, { "seriesName": "Hold_Email", "label": "Hold Email", "color": "redDark" }, { "seriesName": "Lock_All_Links", "label": "Lock All Links", "color": "blueDark" }, { "seriesName": "Double_Lock_All_Links", "label": "Double Lock All Links", "color": "greenDark" }, { "seriesName": "Convert_All_Attachments", "label": "Convert All Attachments", "color": "orangeDark" }, { "seriesName": "Strip_All_Attachments", "label": "Strip All Attachments", "color": "purpleDark" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Hold_Email", "sizeAggregation": "Sum", "legendMetric": "Hold_Email", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Hold_Email", "heatmapPalette": "greenRed" } } }, "name": "query - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ac642d55-be90-4144-8bc3-ce0cb7fcc161", "version": "KqlParameterItem/1.0", "name": "SearchRecipient", "label": "Search Recipient", "type": 1, "description": "Filter for held emails", "value": "", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s == \"Antigena Email\"\n| extend Actions = parse_json(actions_s)\n| extend Hold_Email=set_has_element(Actions, \"Hold\")\n| where Hold_Email == true \n| extend Recipients=parse_json(recipients_s)\n| where Recipients contains \"{SearchRecipient}\"\n| project-rename ThreatRiskLevel=anomaly_score_d\n| project-rename AttachmentSHA1s=attachment_sha1s_s\n| project-rename Sender=from_s\n| project-rename Subject=subject_s\n| project-rename Tags=tags_s\n| project-rename TimestampUTC=timestamp_t\n| project-rename UUID=uuid_s\n| project-rename DarktraceLink=url_s\n| project-rename Direction=direction_s\n| project Subject, Sender, Recipients, ThreatRiskLevel, TimestampUTC, Direction, Tags, AttachmentSHA1s, DarktraceLink, UUID", "size": 0, "title": "Held Emails", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL\n| where dtProduct_s == \"Antigena Email\"\n| where direction_s == \"inbound\"\n| project-rename Sender=from_s\n| summarize Count=count() by Sender\n| top 10 by Count", "size": 0, "title": "Top 10 Most Frequent External Senders ", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "orange" } }, { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } } ] } }, "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "email" }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "darktrace_model_alerts_CL //anything starting with 'Dt' is not an ASIM mapping \n| where dtProduct_s ==\"System Alert\"\n| extend EventVendor = \"Darktrace\"\n| extend EventProduct = \"Darktrace DETECT\"\n| project-rename NetworkRuleName=friendlyName_s\n| project-rename ThreatRiskLevel=priority_code_d\n| project-rename ThreatRiskCategory=priority_s\n| project-rename EventStartTime = time_s\n| project-rename SrcIpAddr=deviceIP_s\n| project-rename SrcHostname=hostname_s\n| project-rename DtStatus=status_s\n| project-rename DtURL=url_s\n| project-rename DtSeverity=Severity\n| project-rename DtName=name_s\n| project-rename DtMessage=Message\n| project EventVendor, EventProduct, NetworkRuleName, ThreatRiskLevel, ThreatRiskCategory, SrcIpAddr, SrcHostname, DtStatus, DtURL, DtName, DtMessage", "size": 0, "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "status" }, "name": "group - 8" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-Darktrace", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }