{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "92c84cb2-9b9a-498f-9b18-a3a11f70618a",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "description": "Time range for incident created and indicator import.",
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "value": {
              "durationMs": 86400000
            }
          },
          {
            "id": "29f50496-9072-4438-8ac5-7a0cf4cd7307",
            "version": "KqlParameterItem/1.0",
            "name": "Category",
            "label": "Threat Actor Category",
            "type": 2,
            "query": "RecordedFutureThreatMap_V2_CL\r\n| mv-expand actor = todynamic(data)\r\n| project categories_s = tostring(actor.categories)\r\n| mv-expand parse_json(categories_s)\r\n| distinct id = tostring(categories_s.id), name = tostring(categories_s.name)\r\n",
            "typeSettings": {
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": null
          },
          {
            "id": "2d4f8b54-8321-4c37-9c78-79c3787a9d02",
            "version": "KqlParameterItem/1.0",
            "name": "Watchlist",
            "label": "Recorded Future Watchlist",
            "type": 2,
            "query": "RecordedFutureThreatMap_V2_CL\r\n| mv-expand actor = todynamic(data)\r\n| project log_entries_s = tostring(actor.log_entries)\r\n| mv-expand parse_json(log_entries_s)\r\n| where isnotempty(log_entries_s.watchlist)\r\n| distinct id = tostring(log_entries_s.watchlist.id), name = tostring(log_entries_s.watchlist.name)",
            "typeSettings": {
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": null
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "parameters - 5"
    },
    {
      "type": 1,
      "content": {
        "json": "<h1>Threat Actor Map</h1>\n\nThis workbook shows Threat Actors imported from [Recorded Future](https://app.recordedfuture.com/portal/threat), their intent towards your company, and their opportunity. \n\nIntent (y-axis) - The threat actor has presented previous interest (expressed or manifested) against elements that are relevant to an organization (e.g., industry, peers, third parties, executives, brand, internet-facing assets). \n\nOpportunity (x-axis) - A correlation between the threat actor's capabilities and an organization’s vulnerabilities. The capability is a threat actor's ability to perform certain activities or cyber attacks, (i.e., their \"sophistication\"); vulnerabilities include an organization's exposures, gaps, or technology-related vulnerabilities. \n\nData is fetched from Recorded Future thru the playbook ```RecordedFuture-ThreatMap-lmporter```.\n\n\n",
        "style": "info"
      },
      "customWidth": "50",
      "name": "text - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "RecordedFutureThreatMap_V2_CL\n| where TimeGenerated {TimeRange:query}\n| mv-expand actor = todynamic(data)\n| extend id_s = tostring(actor.id), name_s = tostring(actor.name), intent_d = toreal(actor.intent), opportunity_d = toreal(actor.opportunity), categories_s = tostring(actor.categories), log_entries_s = tostring(actor.log_entries)\n| where categories_s has_any('{Category}') \n| where log_entries_s has_any('{Watchlist}') \n| extend combine= intent_d+opportunity_d\n| project TimeGenerated, id_s, name_s, intent_d, opportunity_d,  combine\n| summarize MaxTimeGenerated = max(TimeGenerated) by id_s, name_s, intent_d, opportunity_d, combine\n| order by combine desc \n| project MaxTimeGenerated, id_s, name_s, intent_d, opportunity_d\n| take 100\n",
        "size": 0,
        "title": "Threat Actor Map",
        "noDataMessage": "No data found",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "scatterchart",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "id_s",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "intent_d",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "xAxis": "opportunity_d",
          "yAxis": [
            "intent_d"
          ],
          "group": "name_s",
          "createOtherGroup": 0,
          "showMetrics": false,
          "showLegend": true,
          "xSettings": {
            "min": 0,
            "max": 99
          },
          "ySettings": {
            "min": 0,
            "max": 99
          }
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "intent_d",
          "sizeAggregation": "Sum",
          "legendMetric": "intent_d",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "intent_d",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "customWidth": "50",
      "name": "query - 0 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "RecordedFutureThreatMap_V2_CL\n| where TimeGenerated {TimeRange:query}\n| mv-expand actor = todynamic(data)\n| extend id_s = tostring(actor.id), name_s = tostring(actor.name), intent_d = toreal(actor.intent), opportunity_d = toreal(actor.opportunity), categories_s = tostring(actor.categories), log_entries_s = tostring(actor.log_entries)\n| where categories_s has_any('{Category}') \n| where log_entries_s has_any('{Watchlist}') \n| extend combine= intent_d+opportunity_d\n| project TimeGenerated, id_s, name_s, intent_d, opportunity_d, combine\n| summarize MaxTimeGenerated = max(TimeGenerated) by id_s, name_s, intent_d, opportunity_d,combine\n| order by combine desc \n| project Name=name_s, Intent=intent_d, Opportunity=opportunity_d, id_s\n",
        "size": 0,
        "title": "Threat Actors",
        "exportFieldName": "id_s",
        "exportParameterName": "ThreatActor",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "id_s",
              "formatter": 5
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "query - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "RecordedFutureThreatMap_V2_CL\n| where TimeGenerated  {TimeRange:query}\n| mv-expand actor = todynamic(data)\n| extend id_s = tostring(actor.id), name_s = tostring(actor.name), categories_s = tostring(actor.categories), log_entries_s = tostring(actor.log_entries), alias_s = tostring(actor.alias)\n| where id_s == \"{ThreatActor}\"\n| take 1\n| mv-expand categoriesArray= parse_json(categories_s)\n| mv-expand watchlistArray = parse_json(log_entries_s)\n| summarize  [\"Threat Actor Categories\"] = make_list(categoriesArray.name), WatchLists= make_list_with_nulls(watchlistArray.watchlist.name) by Link=strcat(\"https://app.recordedfuture.com/live/sc/entity/\",id_s), Name=name_s, Id=id_s,  Aliases=array_strcat(parse_json(alias_s),',')",
        "size": 4,
        "title": "Actor Details",
        "noDataMessage": "Please select a threat actor in the Threat Actors table to display details.",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Link",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url",
                "linkLabel": "External Link"
              }
            },
            {
              "columnMatch": "Id",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "GenericDetails",
                "linkLabel": "Open Generic Details",
                "linkIsContextBlade": true
              }
            },
            {
              "columnMatch": "Threat Actor Categories",
              "formatter": 0,
              "formatOptions": {
                "customColumnWidthSetting": "150ch"
              }
            },
            {
              "columnMatch": "https://app.recordedfuture.com/live/sc/entity/{Id}",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url",
                "linkLabel": ""
              }
            },
            {
              "columnMatch": "Categories",
              "formatter": 0,
              "formatOptions": {
                "customColumnWidthSetting": "150ch"
              }
            },
            {
              "columnMatch": "id_s",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "GenericDetails",
                "linkLabel": "Open Generic Details",
                "linkIsContextBlade": true
              }
            }
          ],
          "labelSettings": [
            {
              "columnId": "Link",
              "label": "Recorded Future"
            }
          ]
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Id",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Intent",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "query - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\r\n| where ValidUntil > now()\r\n| where Data.description contains(\"{ThreatActor}\")\r\n| summarize Indicators=count(Data.description) by  tostring(Data.description) ",
        "size": 0,
        "title": "Active Indicators for Hunting",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Description",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Indicators",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Indicators",
          "sortOrderField": 2,
          "size": "auto"
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Description",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Indicators",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "customWidth": "50",
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| where Title contains \"{ThreatActor}\"\r\n| summarize CreateTime = max(CreatedTime) by IncidentUrl, Title,Description ",
        "size": 0,
        "title": "Incidents created",
        "noDataMessage": "No incidents found, but try different time range to display incidents future back in time.",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "IncidentUrl",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url",
                "linkLabel": "Open Incident"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "query - 8"
    },
    {
      "type": 1,
      "content": {
        "json": "To generate incidents using imported indicators. Create analytic rules that  correlates data from infrastructure logs with recorded future hunting indicators. Install and modify the provided analytic rule templates to match your environent. \r\n```\r\nRecorded Future - Threat Hunting - Domain - All Actors\r\nRecorded Future - Threat Hunting - IP - All Actors\r\nRecorded Future - Threat Hunting - Hash - All Actors\r\nRecorded Future - Threat Hunting - Url - All Actors\r\n```\r\nInstall and configure Recorded Future Incident Enrichment Playbook to get additional information when incidents are created ```RecordedFuture-IOC_Enrichment-IP_Domain_URL_Hash```\r\n",
        "style": "info"
      },
      "name": "text - 7"
    }
  ],
  "styleSettings": {
    "paddingStyle": "none",
    "spacingStyle": "none"
  },
  "fromTemplateId": "sentinel-RecordedFutureThreatActorHuntingWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}