{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "67d14413-6eca-4803-b447-c9c7f744ce43", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Entity", "subTarget": "Entity", "style": "link" }, { "id": "cbc93b75-3cc9-4191-b334-0d44c7652ce0", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Detections", "subTarget": "Detections", "style": "link" }, { "id": "919866f6-87e0-479f-969f-eedc7d970251", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Lockdown", "subTarget": "Lockdown", "style": "link" }, { "id": "ce743dcd-55b5-42f7-8553-a9d120b1d74b", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Audit", "subTarget": "Audit", "style": "link" }, { "id": "2a426647-ce0b-44ef-8603-bae6bd8e2343", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Health", "subTarget": "Health", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c2e47223-15df-44b3-8040-0bfc72eeab0a", "version": "KqlParameterItem/1.0", "name": "timerange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "f909ea8d-ce5f-41a1-8b26-d2e34169f149", "version": "KqlParameterItem/1.0", "name": "View", "label": "Prioritized", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n { \"value\":\"true\", \"label\":\"Yes\" },\r\n { \"value\":\"false\", \"label\":\"No\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "true" ] }, { "id": "732ba446-ecc2-49fd-be25-53ee45d3f9c2", "version": "KqlParameterItem/1.0", "name": "DataSource", "label": "Data Source Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"AWS\", \"label\":\"AWS\"},\r\n {\"value\":\"M365/AAD\",\"label\":\"Microsoft 365/Azure AD\"},\r\n {\"value\":\"Network\",\"label\":\"Network\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "e2fa7c64-c20c-4e7b-9557-81c64f2c5b58", "version": "KqlParameterItem/1.0", "name": "EntityType", "label": "Entity Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraEntityScoring\r\n| where ['Last Updated'] {timerange} \r\n| summarize arg_max(['Last Updated'],*) by ['Entity ID'], Type\r\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View}))\r\n| extend source = tostring(split(Name,\":\")[0])\r\n| extend source2 = iff(isempty(source),\"NA\",source)\r\n| where ('*' in ({DataSource}) or source2 in ({DataSource}))\r\n| summarize arg_max(TimeGenerated, *) by Type\r\n| distinct ID, ['Type']\r\n| extend splitted_entity_type = split(['Type'],\"_\")\r\n| mv-expand splitted_entity_type = splitted_entity_type\r\n| extend cap = toupper(substring(splitted_entity_type,0,1)), rest_string = substring(splitted_entity_type,1)\r\n| extend joined_str = strcat(cap,rest_string)\r\n| distinct joined_str,ID,['Type']\r\n| summarize joined_array = make_list(todynamic(joined_str)) by ID, ['Type']\r\n| extend capitalized_Category = strcat_array(joined_array, \" \")\r\n| distinct ['Type'], capitalized_Category", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraEntityScoring\r\n| where ['Last Updated'] {timerange}\r\n| summarize arg_max(['Last Updated'],*) by ['Entity ID'], Type\r\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View})) and ('*' in ({EntityType}) or Type in ({EntityType}))\r\n| extend ['Data Source Type'] = case(Name startswith \"AWS\", \"AWS\", \r\n Name startswith \"SAML\", \"AWS\",\r\n Name startswith \"O365\", \"M365/AAD\",\r\n Name startswith \"M365\", \"M365/AAD\",\r\n Name startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| extend priority = case(\r\n ['Is Prioritized'] == true, \"Prioritized\",\r\n ['Is Prioritized'] == false, \"Not Prioritized\",\r\n \"Unknown\"\r\n)\r\n| summarize count() by priority\r\n| order by priority desc", "size": 3, "title": "Entity Count by Priority", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "priority", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Prioritized", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Prioritized", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": true, "size": "auto" } }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraEntityScoring\r\n| where ['Last Updated'] {timerange} \r\n| summarize arg_max(['Last Updated'],*) by ['Entity ID'], Type\r\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View})) and ('*' in ({EntityType}) or Type in ({EntityType}))\r\n| extend ['Data Source Type'] = case(Name startswith \"AWS\", \"AWS\", \r\n Name startswith \"SAML\", \"AWS\",\r\n Name startswith \"O365\", \"M365/AAD\",\r\n Name startswith \"M365\", \"M365/AAD\",\r\n Name startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\",2, Name)\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| sort by ['Urgency Score'] desc, Importance desc\r\n| extend Importance = case(\r\n Importance == 0, \"Low\",\r\n Importance == 1, \"Medium\",\r\n Importance == 2, \"High\",\r\n \"Unknown\"\r\n), Velocity = case(\r\n Velocity == 0, \"Low\",\r\n Velocity == 1, \"Medium\",\r\n Velocity == 2, \"High\",\r\n \"Unknown\"\r\n)\r\n| project ['Urgency Score'], ['Attack Rating'], ['Entity Name'], ['Vectra Pivot'], Prioritized = ['Is Prioritized'], ['Data Source Type'], Importance, Velocity, ['Last Updated']", "size": 0, "showAnalytics": true, "title": "Entity View", "showRefreshButton": true, "exportFieldName": "Vectra Pivot", "exportParameterName": "P_deep_url", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra" } }, { "columnMatch": "Prioritized", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "red", "text": "true" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Deep Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Entity View grid to view more details_" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraEntityScoring\r\n| where ['Last Updated'] {timerange} \r\n| summarize arg_max(['Last Updated'],*) by ['Entity ID'], Type\r\n| where ('*' in ({View}) or [\"Is Prioritized\"] in ({View})) and ('*' in ({EntityType}) or Type in ({EntityType}))\r\n| extend ['Data Source Type'] = case(Name startswith \"AWS\", \"AWS\", \r\n Name startswith \"SAML\", \"AWS\",\r\n Name startswith \"O365\", \"M365/AAD\",\r\n Name startswith \"M365\", \"M365/AAD\",\r\n Name startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\",2, Name)\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource})) and ['Vectra Pivot'] == '{P_deep_url}'\r\n| project ID, ['Entity ID'], ['Data Source Type'], ['Entity Name'], Name, Importance, ['Type'], ['Is Prioritized'], Severity, [\"Urgency Score\"], ['Vectra Pivot'], Category, ['Last Detection URL'], ['Last Detection Type'], [\"Last Detection ID\"], ['Active Detection Types'], ['Last Updated'], ['Breadth Contrib'], Velocity, ['Attack Rating']", "size": 4, "showAnalytics": true, "title": "Selected Entity View data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Last Detection URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ] } }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraDetections\r\n| where ['Last Updated'] > ago(90d) and URL == '{P_deep_url}'\r\n| summarize arg_max(['Last Updated'],*) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\",\r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\",2,['Entity UID'])\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\",\"Botnet\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",\"Unknown\")\r\n| extend [\"Detection Details\"] = parse_json([\"Detection Details\"])[0]\r\n| extend [\"Detection Details\"] = case(isnotempty([\"Detection Details\"]), [\"Detection Details\"], \"Details too large to display.\")\r\n| extend [\"Source IP\"] = case(isnotempty([\"Source IP\"]), [\"Source IP\"], \"Not Applicable\")\r\n| project ['Entity Name'], ['Detection Category'], Behavior=[\"Detection Name\"], ['Vectra Pivot'], ['Data Source Type'], ['Source IP'], ['Last Updated'], [\"Detection Details\"], [\"Detection ID\"]\r\n| sort by ['Last Updated'] desc", "size": 0, "showAnalytics": true, "title": "Detection List", "showRefreshButton": true, "exportFieldName": "Detection ID", "exportParameterName": "P_detection_id", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra", "linkIsContextBlade": false } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Detection ID", "formatter": 5 }, { "columnMatch": "Deep Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Detection List grid to view more details_" }, "conditionalVisibility": { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraDetections\r\n| where ['Last Updated'] > ago(90d) and URL == '{P_deep_url}'\r\n| where ['Detection ID'] == '{P_detection_id}'\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\",\"Botnet\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",\"Unknown\")\r\n| extend [\"Detection Details\"] = parse_json([\"Detection Details\"])[0]\r\n| extend [\"Detection Details\"] = case(isnotempty([\"Detection Details\"]), [\"Detection Details\"], \"Details too large to display.\")\r\n| extend [\"Source Host\"] = parse_json([\"Source Host\"])[0]\r\n| extend [\"Grouped Details\"] = parse_json([\"Grouped Details\"])[0]\r\n| extend Summary = parse_json(Summary)[0]\r\n| extend Details = parse_json(Details)[0]\r\n| project ID, ['Detection Category'], ['Is Triaged'], Behavior=[\"Detection Name\"], [\"Detection ID\"], [\"Vectra Pivot\"], [\"Entity ID\"], URL, [\"Entity UID\"], [\"Last Updated\"], [\"Detection Details\"], [\"Details\"], Severity, ['Source IP'], [\"Normal Domains\"], [\"Is Targeting Key Asset\"], [\"Source Host\"], Summary, [\"Grouped Details\"]", "size": 4, "showAnalytics": true, "title": "Selected Detection List Data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Source Host", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Summary", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Grouped Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ] } }, "conditionalVisibilities": [ { "parameterName": "P_deep_url", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "P_detection_id", "comparison": "isNotEqualTo", "value": "None" } ], "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 8" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Entity" }, "name": "Entity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8ba900f4-2667-4651-87ee-866de79ed08f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "41b0ee6f-04db-423c-a0fd-babfda10e619", "version": "KqlParameterItem/1.0", "name": "DataSource", "label": "Data Source Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"AWS\", \"label\":\"AWS\"},\r\n {\"value\":\"M365/AAD\",\"label\":\"Microsoft 365/Azure AD\"},\r\n {\"value\":\"Network\",\"label\":\"Network\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "bd9a1ea9-0bec-457d-a24b-f84e15e1af42", "version": "KqlParameterItem/1.0", "name": "DetectionCategory", "label": "Detection Category", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n {\"value\":\"botnet\", \"label\":\"Botnet\"},\r\n {\"value\":\"command_and_control\",\"label\":\"Command and Control\"},\r\n {\"value\":\"reconnaissance\",\"label\":\"Reconnaissance\"},\r\n {\"value\":\"lateral_movement\",\"label\":\"Lateral Movement\"},\r\n {\"value\":\"exfiltration\",\"label\":\"Exfiltration\"},\r\n {\"value\":\"botnet_activity\", \"label\":\"Botnet Activity\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "1144f1b6-24e0-422c-bc8c-9bd87f6d258e", "version": "KqlParameterItem/1.0", "name": "DetectionType", "label": "Behavior", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraDetections\r\n| where ['Last Updated'] {TimeRange}\r\n| summarize arg_max(['Last Updated'],*) by ['Detection ID']\r\n| extend source = tostring(split(['Entity UID'],\":\")[0])\r\n| where ('*' in ({DataSource}) or source in ({DataSource})) and ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory}))\r\n| distinct ['Detection Name']\r\n| sort by ['Detection Name'] asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "0a0026bb-e21f-45b0-9678-f3650317ce61", "version": "KqlParameterItem/1.0", "name": "Mitre", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraDetections\r\n| where ['Last Updated'] {TimeRange}\r\n| mv-expand todynamic(Mitre)\r\n| distinct tostring(Mitre)\r\n| sort by Mitre asc\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count:long, ['Detection Category']:string, category_count:long) [0,\"Botnet Activity\",1, 0,\"Command and Control\",2, 0,\"Reconnaissance\",3, 0,\"Lateral Movement\",4, 0,\"Exfiltration\",5]\r\n|union\r\n(\r\nVectraDetections\r\n| where ['Last Updated'] {TimeRange}\r\n| mv-expand todynamic(Mitre)\r\n| where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\r\n| summarize arg_max(['Last Updated'],*) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\",\r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType}))\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\" or ['Detection Category']==\"botnet_activity\",\"Botnet Activity\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",\"Other\")\r\n| extend category_count=case(['Detection Category']==\"Botnet Activity\",1,['Detection Category']==\"Command and Control\",2,['Detection Category']==\"Reconnaissance\",3,['Detection Category']==\"Lateral Movement\",4,['Detection Category']==\"Exfiltration\",5,6)\r\n| summarize Count=count() by ['Detection Category'], category_count\r\n)\r\n| summarize Count=sum(Count) by ['Detection Category'], category_count\r\n| sort by category_count asc", "size": 3, "title": "Detection Category Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Detection Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Command and Control", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Exfiltration", "representation": "purple", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Lateral Movement", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Reconnaissance", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": true, "size": "auto" } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Mitre_List = \r\n VectraDetections\r\n | where ['Last Updated'] {TimeRange}\r\n | summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n | extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\", \r\n \"Network\"\r\n )\r\n | where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n | where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType}))\r\n | mv-expand todynamic(Mitre)\r\n | where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\r\n | summarize Mitre_Numbers = make_list(Mitre) by ['Detection ID'];\r\nVectraDetections\r\n| where ['Last Updated'] {TimeRange}\r\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\", \r\n \"Network\"\r\n)\r\n| extend ['Entity Name'] = extract(\"^(AWS:|SAML:|O365:|M365:|Azure:)?(.*)$\", 2, ['Entity UID'])\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType}))\r\n| extend ['Detection Category'] = case(\r\n ['Detection Category'] == \"botnet\", \"Botnet\",\r\n ['Detection Category'] == \"command_and_control\", \"Command and Control\",\r\n ['Detection Category'] == \"reconnaissance\", \"Reconnaissance\",\r\n ['Detection Category'] == \"lateral_movement\", \"Lateral Movement\",\r\n ['Detection Category'] == \"exfiltration\", \"Exfiltration\",\r\n ['Detection Category'] == \"botnet_activity\", \"Botnet Activity\",\r\n \"Other\"\r\n)\r\n| extend [\"Detection Details\"] = parse_json([\"Detection Details\"])[0]\r\n| extend [\"Detection Details\"] = case(isnotempty([\"Detection Details\"]), [\"Detection Details\"], \"Details too large to display.\")\r\n| extend [\"Source IP\"] = case(isnotempty([\"Source IP\"]), [\"Source IP\"], \"Not Applicable\")\r\n| join kind=inner (Mitre_List) on ['Detection ID']\r\n| project\r\n ['Entity Name'],\r\n ['Detection Category'],\r\n Behavior=[\"Detection Name\"],\r\n ['Vectra Pivot'],\r\n ['Data Source Type'],\r\n ['Source IP'],\r\n ['Last Updated'],\r\n [\"Detection Details\"],\r\n [\"Detection ID\"],\r\n Mitre\r\n| sort by ['Last Updated'] desc\r\n", "size": 0, "showAnalytics": true, "title": "Detection View", "showRefreshButton": true, "exportFieldName": "Detection ID", "exportParameterName": "P_detection_id", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Pivot to Vectra" } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Detection ID", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above Detection View grid to view more details_" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Mitre_List = \r\n VectraDetections\r\n | where ['Last Updated'] {TimeRange}\r\n | summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n | extend ['Data Source Type'] = case(\r\n ['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\", \r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\", \r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\", \r\n \"Network\"\r\n )\r\n | where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n | where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType})) and [\"Detection ID\"] == '{P_detection_id}'\r\n | mv-expand todynamic(Mitre)\r\n | where ('*' == ('{Mitre:escapejson}') or Mitre in ({Mitre}))\r\n | summarize Mitre_Numbers = make_list(Mitre) by ['Detection ID'];\r\nVectraDetections\r\n| where ['Last Updated'] {TimeRange}\r\n| summarize arg_max(['Last Updated'], *) by ['Detection ID']\r\n| extend ['Data Source Type'] = case(['Entity UID'] startswith \"AWS\", \"AWS\", \r\n ['Entity UID'] startswith \"SAML\", \"AWS\",\r\n ['Entity UID'] startswith \"O365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"M365\", \"M365/AAD\",\r\n ['Entity UID'] startswith \"Azure\", \"M365/AAD\",\"Network\")\r\n| where ('*' in ({DataSource}) or ['Data Source Type'] in ({DataSource}))\r\n| where ('*' in ({DetectionCategory}) or ['Detection Category'] in ({DetectionCategory})) and ('*' in ({DetectionType}) or ['Detection Name'] in ({DetectionType})) and [\"Detection ID\"] == '{P_detection_id}'\r\n| extend ['Detection Category'] = case(['Detection Category']==\"botnet\",\"Botnet\",['Detection Category']==\"command_and_control\",\"Command and Control\",['Detection Category']==\"reconnaissance\",\"Reconnaissance\",['Detection Category']==\"lateral_movement\",\"Lateral Movement\",['Detection Category']==\"exfiltration\",\"Exfiltration\",['Detection Category'] == \"botnet_activity\", \"Botnet Activity\",\"Other\")\r\n| extend [\"Detection Details\"] = parse_json([\"Detection Details\"])[0]\r\n| extend [\"Detection Details\"] = case(isnotempty([\"Detection Details\"]), [\"Detection Details\"], \"Details too large to display.\")\r\n| extend [\"Source Host\"] = parse_json([\"Source Host\"])[0]\r\n| extend [\"Grouped Details\"] = parse_json([\"Grouped Details\"])[0]\r\n| extend Summary = parse_json(Summary)[0]\r\n| join kind=inner (Mitre_List) on ['Detection ID']\r\n| project ID, ['Detection Category'], ['Is Triaged'], Behavior=[\"Detection Name\"], [\"Detection ID\"], [\"Vectra Pivot\"], [\"Entity ID\"], URL, [\"Entity UID\"], [\"Last Updated\"], [\"Detection Details\"], [\"Details\"], Severity, ['Source IP'], [\"Normal Domains\"], [\"Is Targeting Key Asset\"], [\"Source Host\"], Summary, [\"Grouped Details\"], Mitre", "size": 4, "showAnalytics": true, "title": "Selected Detection View Data", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Vectra Pivot", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Detection Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Source Host", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Summary", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Grouped Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ] } }, "conditionalVisibility": { "parameterName": "P_detection_id", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 5" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Detections" }, "name": "Detections" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ea3f10f3-aa7e-481c-9d4f-7939d1a463a1", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "7df89745-bea2-4a36-9c0a-4e64a01a0423", "version": "KqlParameterItem/1.0", "name": "EntityType", "label": "Entity Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraLockdown\r\n| where [\"Locked Date\"] {TimeRange} or [\"Unlock Date\"] {TimeRange}\r\n| distinct Type\r\n| extend cap = toupper(substring(Type,0,1)), rest_string = substring(Type,1)\r\n| extend Captilized_type = strcat(cap,rest_string)\r\n| distinct ['Type'], Captilized_type", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "90c8487a-b24b-420e-8a70-73baad8d3301", "version": "KqlParameterItem/1.0", "name": "EntityLocked", "label": "Entity Locked", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"True\", \"label\":\"True\", \"selected\":true },\r\n { \"value\":\"False\", \"label\":\"False\", \"selected\":true}\r\n]", "value": [ "False", "True" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraLockdown\r\n| where case('{TimeRange}' contains 'ago', [\"Locked Date\"] {TimeRange} or ([\"Unlock Date\"] {TimeRange} and [\"Unlock Date\"] <= now()), [\"Locked Date\"] {TimeRange} or [\"Unlock Date\"] {TimeRange})\r\n| summarize arg_max(TimeGenerated, *) by [\"Entity Name\"], Type, [\"Locked Date\"], [\"Unlock Date\"]\r\n| where ('*' in ({EntityType}) or Type in ({EntityType}))\r\n| extend current_status = case([\"Locked Date\"] <= now() and now() < [\"Unlock Date\"], \"True\", \"False\")\r\n| where ('*' in ({EntityLocked}) or current_status in ({EntityLocked}))\r\n| sort by [\"Locked Date\"] desc\r\n| project [\"Entity Name\"], [\"Entity Type\"] = Type, [\"Entity Locked\"] = current_status, [\"Locked By\"], [\"Locked Date\"], [\"Unlock Date\"]", "size": 0, "showAnalytics": true, "title": "Lockdown View", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Entity Locked", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 2" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Lockdown" }, "name": "lockdown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9b914837-bb6a-4932-92ce-9671341c2e55", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "faf02ab6-e28d-4d11-84d7-3039ae73bb37", "version": "KqlParameterItem/1.0", "name": "ResultStatus", "label": "Result Status", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"success\", \"label\":\"Success\" },\r\n { \"value\":\"failure\", \"label\":\"Failure\" },\r\n {\"value\":\"\",\"label\":\"N/A\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "a5e78ed7-0bde-4116-90fc-c37bdc106d19", "version": "KqlParameterItem/1.0", "name": "Username", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraAudits\r\n| where ['Event Timestamp'] {TimeRange} and isnotempty(Username)\r\n| distinct Username", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraAudits\r\n| where ['Event Timestamp'] {TimeRange}\r\n| summarize arg_max(TimeGenerated,*) by ID\r\n| where ('*' in ({ResultStatus}) or Status in ({ResultStatus}))\r\n| where ('*' in ({Username}) or Username in ({Username}))\r\n| extend Status = tolower(Status)\r\n| extend Result_status = case(\r\n Status == \"success\", \"Success\",\r\n Status == \"failure\", \"Failure\",\r\n Status == \"\",\"N/A\"\r\n ,\"Unknown\"\r\n)\r\n| extend importance = case(\r\n Result_status == \"Success\", 0,\r\n Result_status == \"Failure\", 1,\r\n Result_status == \"NA\",2\r\n ,3\r\n)\r\n| summarize count() by Result_status, importance\r\n| sort by importance asc", "size": 3, "title": "Audit Logs Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Result_status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Success", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Failure", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "NA", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": true, "size": "auto" } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraAudits\r\n| where ['Event Timestamp'] {TimeRange}\r\n| summarize arg_max(TimeGenerated,*) by ID\r\n| where ('*' in ({ResultStatus}) or Status in ({ResultStatus}))\r\n| where ('*' in ({Username}) or Username in ({Username}))\r\n| extend Status = case(isnotempty(Status), Status, '-')\r\n| extend ['Event Data'] = parse_json(['Event Data'])[0]\r\n| project-rename Role = ['User Role']\r\n| project ['Event Timestamp'], Username, Role, Status, Message, ['Event Data']\r\n| sort by ['Event Timestamp'] desc", "size": 0, "showAnalytics": true, "title": "Audit View", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "failure", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Event Data", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 3" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Audit" }, "name": "audit", "styleSettings": { "margin": "10px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9ec409ef-a68f-486e-93ae-602d614ff45f", "version": "KqlParameterItem/1.0", "name": "Search", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "155d2a3f-1d3a-4a0f-9839-bd5a1f89c96c", "version": "KqlParameterItem/1.0", "name": "System", "type": 2, "description": "Select system to display particular system's data", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "VectraHealth\r\n| distinct System_Serial_Number\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraHealth\r\n| where ('*' == ('{System:escapejson}') or System_Serial_Number in ({System}))\r\n| extend Network = parse_json(Network)\r\n| extend ['Aggregated Peak Traffic (Mbps)'] = Network[0].traffic.brain.aggregated_peak_traffic_mbps\r\n| where (\"*\" == '{Search}' or ['Last Updated'] contains '{Search}') or (\"*\" == '{Search}' or tostring(['CPU Usage - User (%)']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['CPU Usage - System (%)']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['CPU Usage - Idle (%)']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['Disk Utilization (%)']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['Memory Utilization (%)']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['Power Status']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['Power Error']) contains '{Search}') or (\"*\" == '{Search}' or tostring(['Aggregated Peak Traffic (Mbps)']) contains '{Search}')\r\n| project ['Last Updated'], ['CPU Usage - User (%)'], ['CPU Usage - System (%)'], ['CPU Usage - Idle (%)'], ['Disk Utilization (%)'], ['Memory Utilization (%)'], ['Aggregated Peak Traffic (Mbps)'], ['Power Status'], ['Power Error']\r\n| sort by ['Last Updated'] desc", "size": 0, "showAnalytics": true, "title": "System View", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "System View", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VectraHealth\r\n| where ('*' == ('{System:escapejson}') or System_Serial_Number in ({System}))\r\n| extend Sensors = parse_json(Sensors)\r\n| mvapply Sensors on (project Sensors.name, Sensors.ip_address, Sensors.d_link_status, Sensors.d_aggregated_peak_traffic, Sensors.d_connectivity_status, Sensors.d_connectivity_error, Sensors.d_trafficdrop_status, Sensors.d_trafficdrop_error)\r\n| where (\"*\" == '{Search}' or tostring(Sensors_name) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_ip_address) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_link_status) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_connectivity_status) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_connectivity_error) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_trafficdrop_status) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_trafficdrop_error) contains '{Search}') or (\"*\" == '{Search}' or tostring(Sensors_d_aggregated_peak_traffic) contains '{Search}')\r\n| project Name = Sensors_name, ['IP Address'] = Sensors_ip_address, ['Connectivity Status'] = Sensors_d_connectivity_status, ['Connectivity Error'] = Sensors_d_connectivity_error, ['Traffic Drop Status'] = Sensors_d_trafficdrop_status, ['Traffic Drop Error'] = Sensors_d_trafficdrop_error, ['Aggregated Peak Traffic (Mbps)'] = Sensors_d_aggregated_peak_traffic, ['Interface Link Status'] = Sensors_d_link_status", "size": 0, "showAnalytics": true, "title": "Sensors View", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Interface Link Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Degraded", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true } }, "name": "Sensor View", "styleSettings": { "showBorder": true } } ] }, "name": "group - 1" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Health" }, "name": "health" } ] }, "name": "main" } ], "fromTemplateId": "sentinel-VectraXDR", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }