{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Filter Parameters", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "" }, "name": "text - 18", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4fcc5be4-5549-497c-8551-18d30d96e9e2", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Time Range for Data", "isGlobal": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 2592000000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "fd3df21f-4894-4876-b224-532b45f6b7db", "version": "KqlParameterItem/1.0", "name": "LogAnalyticsWorkspace", "label": "Log Analytics Workspace", "type": 5, "description": "Source Log Analytics Workspace", "isGlobal": true, "query": "resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' | project id = tostring(properties.workspaceResourceId)", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "20", "name": "LogAnalyticsWorkspace" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "24702f7b-f1eb-4aa5-b8f3-3e947844def8", "version": "KqlParameterItem/1.0", "name": "Ipv4Addr", "label": "IPv4 Address", "type": 1, "description": "Enter IPv4 Address of Host to view", "isGlobal": true, "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 19" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "21de958b-e40f-4ca3-b7b0-33dca2a2eb18", "version": "KqlParameterItem/1.0", "name": "Ipv6Addr", "label": "IPv6 Address", "type": 1, "description": "Enter IPv6 Address of Host to view", "isGlobal": true, "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "parameters - 23" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "041141c4-0346-4ab2-b69f-232fe51df936", "version": "KqlParameterItem/1.0", "name": "ComplianceRuleName", "label": "Compliance Rule Name", "type": 1, "description": "Select from ComlianceInfo Tile or Enter Compliance Rule to view matching Hosts", "isRequired": true, "isGlobal": true, "timeContext": { "durationMs": 86400000 }, "value": "Antivirus Compliance-3 (AV Not Installed)" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 17" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1f43e71e-8295-4d2a-a18a-0cce88f22a91", "version": "KqlParameterItem/1.0", "name": "RuleName", "label": "Policy Rule Name", "type": 1, "description": "Select from PolicyInfo Tile or Enter Policy Rule to view matching Hosts", "isRequired": true, "isGlobal": true, "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 13" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "42568721-87af-4cf8-93b4-dfee17ac7bf9", "version": "KqlParameterItem/1.0", "name": "Vendor", "type": 1, "description": "Select from Tile or Enter Vendor to view hosts of this vendor", "isRequired": true, "isGlobal": true, "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 16" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bc73a7ac-12bb-46b4-8332-5591654dd209", "version": "KqlParameterItem/1.0", "name": "Model", "type": 1, "description": "Select from Tile or Enter Model to view hosts of this Model", "isRequired": true, "isGlobal": true, "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 15" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b69a6249-fc85-441e-9d7f-695824e40b8b", "version": "KqlParameterItem/1.0", "name": "Function", "type": 1, "description": "Select from Tile or Enter Function to view hosts of this Function", "isRequired": true, "isGlobal": true, "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 14", "styleSettings": { "margin": "10" } } ], "exportParameters": true }, "name": "FilterParameters", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Hosts Summary", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \r\n| sort by TimeGenerated\r\n| extend hostID = strcat(strcat(Ipv4Addr, MacAddr), Ipv6Addr)\r\n| distinct hostID\r\n| count", "size": 4, "title": "Number of Hosts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "30", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL\r\n| distinct Ipv4Addr, tostring(Ipv6Addr), tostring(Status)\r\n| where Status contains 'Not'\r\n| count", "size": 4, "title": "Number of Non-Compliant Hosts", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "30", "name": "query - 1" } ] }, "name": "Numbers", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Compliance Info", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL\n| distinct Ipv4Addr, tostring(Ipv6Addr), MacAddr, tostring(PolicyName), tostring(Status)\n| summarize Count=count() by tostring(Status)\n| render piechart", "size": 0, "title": "Overall Compliance (by Policy)", "timeContextFromParameter": "TimeRange", "exportFieldName": "series", "exportParameterName": "ComplianceStatus", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "30", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL| distinct Ipv4Addr, tostring(Ipv6Addr), tostring(Status)\r\n| summarize Count=count() by tostring(Status)| render piechart", "size": 0, "title": "Compliance by Device", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL\r\n//| distinct Ipv4Addr, tostring(Ipv6Addr), tostring(Status)\r\n|sort by TimeGenerated\r\n| summarize count() by bin(TimeGenerated, 6h), tostring(Status)\r\n//| summarize count() by tostring(Status)\r\n//| summarize count() by bin(TimeGenerated, 6h), tostring(Status), Ipv4Addr, tostring(Ipv6Addr)\r\n| render areachart", "size": 0, "title": "Compliance Chart", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL\n| where tostring(Status) contains \"Not\"\n| distinct Ipv4Addr, tostring(Ipv6Addr), MacAddr, tostring(PolicyName)\n| summarize Count=count() by tostring(PolicyName) \n| sort by Count desc", "size": 0, "title": "Most Non-Compliant Rules", "timeContextFromParameter": "TimeRange", "exportFieldName": "PolicyName", "exportParameterName": "ComplianceRuleName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "50", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutComplianceStatus_CL | sort by TimeGenerated \r\n| where Status == 'Not Compliant'\r\n| where '{ComplianceRuleName}' contains PolicyName\r\n| where isnotempty(Ipv4Addr) or isnotempty(Ipv6Addr)\r\n| extend IpAddr = (iff (isnotempty(Ipv4Addr),Ipv4Addr,Ipv6Addr))\r\n| where isnotempty(IpAddr) \r\n//| extend Number = row_number()\r\n| summarize arg_max(TimeGenerated, *) by Ipv4Addr, tostring(Ipv6Addr)\r\n| render table", "size": 0, "title": "Non-Compliant Hosts for Compliance Rule: {ComplianceRuleName}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "gridSettings": { "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 18", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 15", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Hosts Info", "expandable": true, "expanded": true, "loadType": "always", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| sort by TimeGenerated\n| extend hostID = strcat(Ipv4Addr, MacAddr)\n| extend TimeGenerated = startofday(TimeGenerated)\n| distinct TimeGenerated, hostID\n| summarize count() by bin(TimeGenerated, 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Unique Devices Seen per Day", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "visualization": "timechart", "chartSettings": { "xSettings": { "label": "Day" }, "ySettings": { "label": "Count" } } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL\r\n| sort by TimeGenerated\r\n| where isnotempty(Ipv4Addr) or isnotempty(Ipv6Addr)\r\n| extend localIpv6Addr = iff(isnotempty(Ipv6Addr), Ipv6Addr, \" \")\r\n//| project Ipv4Addr, Ipv6Addr, DisplayName\r\n//| distinct Ipv4Addr, tostring(Ipv6Addr)\r\n| summarize arg_max(TimeGenerated, *) by Ipv4Addr, tostring(localIpv6Addr)\r\n| project-away HostProperties, localIpv6Addr\r\n| render table", "size": 0, "title": "Hosts", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "Ipv4Addr", "parameterName": "Ipv4Addr", "parameterType": 1 }, { "fieldName": "localIpv6Addr", "parameterName": "Ipv6Addr", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "gridSettings": { "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 22", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let localIpv6Addr = iff(isnotempty('{Ipv6Addr}'), '{Ipv6Addr}', \"\");\r\nlet isSet = isnotempty('{Ipv6Addr}');\r\n//print isSet;\r\nlet localIpv6Addr = iff(isSet, '{Ipv6Addr}', '');\r\nForescoutHostProperties_CL | sort by TimeGenerated\r\n| where isnotempty('{Ipv4Addr}') or isnotempty(localIpv6Addr)\r\n| where isnotempty(Ipv4Addr) or isnotempty(Ipv6Addr)\r\n| extend matchv4 = iff( isnotempty('{Ipv4Addr}'), iff ( Ipv4Addr == '{Ipv4Addr}', 'TRUE', 'FALSE'), 'FALSE')\r\n| extend matchv6 = iff( isnotempty(localIpv6Addr), iff (isnotempty(Ipv6Addr), iff ( localIpv6Addr == Ipv6Addr, 'TRUE', 'FALSE'), 'FALSE'), 'FALSE')\r\n| where (matchv4 == 'TRUE') or (matchv6 == 'TRUE')\r\n| summarize arg_max(TimeGenerated, *) by Ipv4Addr, tostring(Ipv6Addr)\r\n| project-away matchv4,matchv6\r\n", "size": 0, "title": "Host Details for host: {Ipv4Addr}, {Ipv6Addr}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "50", "name": "query - 20", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 17", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Policy Info", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutPolicyStatus_CL\n//| mv-expand PolicyStatus\n//| extend Policy = tostring(PolicyStatus)\n//| extend Status = extract('.*\"Status\":\"([^\"]*)\".*', 1, Policy)\n//| extend DetectedTime = extract('.*\"DetectedTime\":\"([^\"]*)\".*', 1, Policy)\n//| extend PolicyName = extract('.*\"PolicyName\":\"([^\"]*)\".*', 1, Policy)\n//| extend RuleName = extract('.*\"RuleName\":\"([^\"]*)\".*', 1, Policy)\n| where Status startswith \"Match\"\n| distinct Ipv4Addr, MacAddr, tostring(RuleName)\n| summarize count() by RuleName | sort by count_", "size": 0, "title": "Number of Hosts Meeting Each Policy Rule", "timeContextFromParameter": "TimeRange", "exportFieldName": "RuleName", "exportParameterName": "RuleName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutPolicyStatus_CL\r\n//| sort by TimeGenerated\r\n| where isnotempty(Ipv4Addr) or isnotempty(Ipv6Addr)\r\n| where RuleName contains '{RuleName}'\r\n//| where isnotempty(Ipv4Addr) or isnotempty(Ipv6Addr)\r\n//| sort by TimeGenerated desc\r\n//| summarize arg_max(\"\", *) by Ipv4Addr, tostring(Ipv6Addr), tostring(Status)\r\n| summarize arg_max(TimeGenerated, *) by Ipv4Addr, tostring(Ipv6Addr)\r\n| sort by TimeGenerated desc\r\n| project Ipv4Addr, Ipv6Addr, Status, TimeGenerated, UploadTime, RuleName\r\n| render table", "size": 0, "title": "Hosts with Policy: {RuleName}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Ipv4Addr", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 16", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Policy_Name = tostring(split('{RuleName}', '/', 0));\n\nForescoutPolicyStatus_CL\n//| mv-expand PolicyStatus\n//| extend Policy = tostring(PolicyStatus)\n//| extend Status = extract('.*\"Status\":\"([^\"]*)\".*', 1, Policy)\n//| extend DetectedTime = extract('.*\"DetectedTime\":\"([^\"]*)\".*', 1, Policy)\n//| extend PolicyName = extract('.*\"PolicyName\":\"([^\"]*)\".*', 1, Policy)\n//| extend RuleName = extract('.*\"RuleName\":\"([^\"]*)\".*', 1, Policy)\n//| extend RuleName = extract(\"[^\\\\/]*/(.*)\", 1, RuleName)\n//| where PolicyName == \"C2C-0.1.0 Reporting - USCYBERCOM Device Category\"\n| where isnotempty('{RuleName}')\n| where isnotempty(PolicyName)\n| where tostring(split('{RuleName}', '/', 0)) contains PolicyName\n| where isnotempty(PolicyName)\n| where Status startswith \"Match\"\n| extend hostID = strcat(Ipv4Addr, MacAddr)\n| extend TimeGenerated = startofday(TimeGenerated)\n| distinct hostID, TimeGenerated, tostring(RuleName)\n| summarize count() by bin(TimeGenerated, 1d),RuleName | sort by count_\n| render timechart", "size": 0, "aggregation": 2, "title": "Device Distribution for Selected Policy over Time: {RuleName}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "name": "query - 11", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 10", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Vendors/Model/Function based Info", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where HostProperties has \"VendorClassification\"\n| extend hostID = strcat(Ipv4Addr, MacAddr)\n| extend prop = tostring(HostProperties.VendorClassification[0])\n| distinct hostID, prop\n| summarize count() by prop", "size": 0, "showAnalytics": true, "title": "Vendors Seen over last 30 Days", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "Vendor", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "visualization": "barchart", "chartSettings": { "group": "prop", "createOtherGroup": 20 } }, "customWidth": "33", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where HostProperties has \"ModelClassification\"\n| extend hostID = strcat(Ipv4Addr, MacAddr)\n| extend prop = tostring(HostProperties.ModelClassification[0])\n| distinct hostID, prop\n| summarize count() by prop\n| sort by count_", "size": 0, "showAnalytics": true, "title": "Model Seen over last 30 days", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "Model", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "visualization": "barchart", "chartSettings": { "group": "prop", "createOtherGroup": 20 } }, "customWidth": "33", "name": "query - 1 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where HostProperties has \"FunctionClassification\"\n| extend hostID = strcat(Ipv4Addr, MacAddr)\n| extend prop = tostring(HostProperties.FunctionClassification[0])\n| distinct hostID, prop\n| summarize count() by prop\n| sort by count_", "size": 0, "showAnalytics": true, "title": "Function Seen over last 30 Days", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "Function", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ], "visualization": "barchart", "chartSettings": { "group": "prop", "createOtherGroup": 20 } }, "customWidth": "33", "name": "query - 1 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL\r\n| where HostProperties has \"VendorClassification\"\r\n| where HostProperties.VendorClassification[0] contains '{Vendor}' or HostProperties.VendorClassification[1] contains '{Vendor}'\r\n| extend IP_MAC = strcat(strcat(Ipv4Addr, \"_\"), MacAddr)\r\n| extend Vendor = tostring(HostProperties.VendorClassification[0])\r\n| summarize arg_max(TimeGenerated, *) by IP_MAC, Vendor\r\n", "size": 0, "title": "Hosts by Vendor: ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "33", "name": "query - 15", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL\r\n| where HostProperties has \"ModelClassification\"\r\n| where HostProperties.ModelClassification[0] contains '{Model}' or HostProperties.ModelClassification[1] contains '{Model}'\r\n| extend IP_MAC = strcat(strcat(Ipv4Addr, \"_\"), MacAddr)\r\n| extend Model = tostring(HostProperties.ModelClassification[0])\r\n| summarize arg_max(TimeGenerated, *) by IP_MAC, Model\r\n", "size": 0, "title": "Hosts by Model : {Model}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "33", "name": "query - 14", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL\r\n| where HostProperties has \"FunctionClassification\"\r\n| where HostProperties.FunctionClassification[0] contains '{Function}' or HostProperties.FunctionClassification[1] contains '{Function}'\r\n| extend IP_MAC = strcat(strcat(Ipv4Addr, \"_\"), MacAddr)\r\n| extend Function = tostring(HostProperties.FunctionClassification[0])\r\n| summarize arg_max(TimeGenerated, *) by IP_MAC, Function\r\n", "size": 0, "title": "Hosts By Function: {Function}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticsWorkspace}" ] }, "customWidth": "33", "name": "query - 16", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 16", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "OT Info", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where isnotempty(OtVulnerabilities)\n| extend Vuln = parse_json(OtVulnerabilities)\n| mv-expand Vuln\n| extend Vuln = trim_end(\"}\" ,substring(Vuln, 1))\n| distinct Ipv4Addr, MacAddr, Vuln\n//| extend Vuln = split(Vuln, \", \")\n| parse-kv Vuln as (vendor_specific_id: string, cvss_score: real, title: string, cve_id: string) with (pair_delimiter=', ', kv_delimiter='=')\n| summarize Vuln_Count=count(), Total_CVSS = sum(cvss_score) by Ipv4Addr | sort by Total_CVSS", "size": 0, "title": "OT - Most Vulnerable Devices", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where isnotempty(OtVulnerabilities)\n| extend Vuln = parse_json(OtVulnerabilities)\n| mv-expand Vuln\n| extend Vuln = trim_end(\"}\" ,substring(Vuln, 1))\n| distinct Ipv4Addr, MacAddr, Vuln\n| parse-kv Vuln as (vendor_specific_id: string, cvss_score: real, title: string, cve_id: string, id: string) with (pair_delimiter=', ', kv_delimiter='=')\n| summarize Vuln_Count=count() by id | sort by Vuln_Count", "size": 0, "title": "OT - Most Common CVEs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ForescoutHostProperties_CL \n| where isnotempty(OtVulnerabilities)\n| extend Vuln = parse_json(OtVulnerabilities)\n| mv-expand Vuln\n| extend Vuln = trim_end(\"}\" ,substring(Vuln, 1))\n| distinct Ipv4Addr, MacAddr, Vuln\n| parse-kv Vuln as (vendor_specific_id: string, cvss_score: real, title: string, cve_id: string, id: string) with (pair_delimiter=', ', kv_delimiter='=')\n| distinct Ipv4Addr, MacAddr, id, cvss_score, ['title']", "size": 0, "title": "OT- CVE List", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 5 - Copy - Copy" } ], "exportParameters": true }, "name": "group - 18", "styleSettings": { "showBorder": true } } ], "styleSettings": {}, "fromTemplateId": "sentinel-ForescoutHostPropertyMonitor", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }