{
"version": "Notebook/1.0",
"name": "Filewall for Microsoft 365 - Overview",
"description": "Unified visibility for Exchange, SharePoint, OneDrive and Teams using Filewall log data.",
"items": [
{
"type": 1,
"name": "text - title",
"content": {
"json": "Filewall for Microsoft 365 - Overview
Unified visibility for Exchange, SharePoint, OneDrive and Teams using Filewall log data.
"
}
},
{
"type": 9,
"name": "parameters - timerange",
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "2bb4bd2d-3f6c-4a49-8b28-9c65f2df2f50",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"type": 4,
"description": "Sets the time for analysis",
"isGlobal": true,
"typeSettings": {
"selectableValues": [
{ "durationMs": 300000 },
{ "durationMs": 900000 },
{ "durationMs": 1800000 },
{ "durationMs": 3600000 },
{ "durationMs": 14400000 },
{ "durationMs": 43200000 },
{ "durationMs": 86400000 },
{ "durationMs": 172800000 },
{ "durationMs": 259200000 },
{ "durationMs": 604800000 },
{ "durationMs": 1209600000 },
{ "durationMs": 2419200000 },
{ "durationMs": 2592000000 },
{ "durationMs": 5184000000 },
{ "durationMs": 7776000000 }
],
"allowCustom": true
},
"timeContext": {
"durationMs": 604800000
},
"value": {
"durationMs": 604800000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
},
{
"type": 3,
"name": "query - events-by-platform",
"content": {
"version": "KqlItem/1.0",
"query": "let exch=FilewallM365ExchangeEvent()|summarize Count=count()|extend Platform='Exchange';\nlet sp=FilewallM365FileEvent()|where tolower(application)=='sharepoint'|summarize Count=count()|extend Platform='SharePoint';\nlet od=FilewallM365FileEvent()|where tolower(application)=='onedrive'|summarize Count=count()|extend Platform='OneDrive';\nlet tm=FilewallM365FileEvent()|where tolower(application)=='teams'|summarize Count=count()|extend Platform='Teams';\nexch|union sp|union od|union tm",
"size": 1,
"title": "Events by platform",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
}
},
{
"type": 3,
"name": "query - time-by-platform",
"content": {
"version": "KqlItem/1.0",
"query": "let exch=FilewallM365ExchangeEvent()|project TimeGenerated,Platform='Exchange';\nlet files=FilewallM365FileEvent()\n| extend Platform=case(\n tolower(application)=='sharepoint','SharePoint',\n tolower(application)=='onedrive','OneDrive',\n tolower(application)=='teams','Teams',\n 'Other')\n| project TimeGenerated,Platform;\nexch\n| union files\n| where Platform in ('Exchange','SharePoint','OneDrive','Teams')\n| summarize Count=count() by Platform, bin(TimeGenerated, 1h)\n| order by TimeGenerated asc",
"size": 1,
"title": "Events over time (by platform)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "timechart"
}
},
{
"type": 3,
"name": "query - top-senders",
"content": {
"version": "KqlItem/1.0",
"query": "FilewallM365ExchangeEvent()\n| where status == 'blocked'\n| summarize BlockedEmails=count() by sender\n| top 20 by BlockedEmails desc",
"size": 0,
"title": "Top senders with blocked emails",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table"
}
},
{
"type": 3,
"name": "query - blocked-attachments",
"content": {
"version": "KqlItem/1.0",
"query": "FilewallExchange_CL\n| where event_type == \"email_log\"\n| mv-expand attachment = attachments\n| where tostring(attachment.status) == \"blocked\"\n| extend size_string = tostring(attachment.size)\n| extend size_number = todouble(extract(@\"^([\\d\\.]+)\", 1, size_string))\n| extend size_unit = extract(@\"[A-Za-z]+$\", 0, size_string)\n| extend size_bytes = case(\n size_unit =~ \"B\", size_number,\n size_unit =~ \"KB\", size_number * 1024,\n size_unit =~ \"MB\", size_number * 1024 * 1024,\n size_unit =~ \"GB\", size_number * 1024 * 1024 * 1024,\n size_number)\n| project TimeGenerated,\n sender,\n recipient,\n subject,\n attachment_name = tostring(attachment.name),\n attachment_mime_type = tostring(attachment.type),\n attachment_status = tostring(attachment.status),\n attachment_block_reason = tostring(attachment.block_reason),\n attachment_summary = tostring(attachment.summary),\n attachment_size_human = size_string,\n attachment_size_bytes = size_bytes,\n attachment_original_sha1 = tostring(attachment.original_sha1),\n attachment_original_sha256 = tostring(attachment.original_sha256)",
"size": 0,
"title": "Blocked Filewall attachments (Exchange)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "attachment_status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "iconsOnly",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "blocked",
"representation": "red"
}
]
}
},
{
"columnMatch": "attachment_size_bytes",
"formatter": 8,
"formatOptions": { "min": 0, "max": 104857600 }
}
]
}
}
},
{
"type": 3,
"name": "query - all-attachments",
"content": {
"version": "KqlItem/1.0",
"query": "FilewallExchange_CL\n| where event_type == \"email_log\"\n| mv-expand attachment = attachments\n| extend size_string = tostring(attachment.size)\n| extend size_number = todouble(extract(@\"^([\\d\\.]+)\", 1, size_string))\n| extend size_unit = extract(@\"[A-Za-z]+$\", 0, size_string)\n| extend size_bytes = case(\n size_unit =~ \"B\", size_number,\n size_unit =~ \"KB\", size_number * 1024,\n size_unit =~ \"MB\", size_number * 1024 * 1024,\n size_unit =~ \"GB\", size_number * 1024 * 1024 * 1024,\n size_number)\n| project TimeGenerated,\n sender,\n recipient,\n subject,\n attachment_name = tostring(attachment.name),\n attachment_mime_type = tostring(attachment.type),\n attachment_status = tostring(attachment.status),\n attachment_block_reason = tostring(attachment.block_reason),\n attachment_summary = tostring(attachment.summary),\n attachment_size_human = size_string,\n attachment_size_bytes = size_bytes,\n attachment_original_sha1 = tostring(attachment.original_sha1),\n attachment_original_sha256 = tostring(attachment.original_sha256)",
"size": 0,
"title": "All Filewall attachments (Exchange)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table"
}
}
],
"fromTemplateId": "sentinel-FilewallM365Workbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}