{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "8db3a050-3c9c-4e91-ab49-ac4d4768f203", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "TIDE Lookup", "subTarget": "1", "style": "link" }, { "id": "42f28d3c-e462-48c4-9ac9-c616a5b7d1b7", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "TIDE Lookup via Incident", "subTarget": "4", "style": "link" }, { "id": "718e54eb-4786-4d21-bef1-372877db0a85", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Dossier Lookup", "subTarget": "2", "style": "link" }, { "id": "86d6d161-40c8-4d8c-81cd-78aa762610e6", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Dossier Lookup via Incident", "subTarget": "3", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This workbook depends on the **Infoblox-TIDE-Lookup** logic app which is deployed with the Microsoft Sentinel Solution.
\r\nPlease configure this logic app first and keep it enabled in order to use this workbook.\r\n", "style": "info" }, "name": "text - 5" }, { "type": 1, "content": { "json": "## Infoblox TIDE Lookup\r\n---\r\n\r\n" }, "name": "text - 7" }, { "type": 1, "content": { "json": "## Steps to perform TIDE Lookup using this workbook\r\n- This workbook is intended to help perform TIDE Lookup for Indicators.\r\n- Select the **Resource Group** and **Subscription ID**.\r\n- Select Indicator type from Type filter and provide indicator value corresponding to it's type in the Target parameter.\r\n- You will be able to see a lookup panel for that specific indicator. \r\n- If lookup information of this target is available in the last 24 hours it will be displayed in the lookup panel.\r\n- If there is message like **The query returned no results** on lookup panel, then click on the **GET TIDE DATA** button.\r\n- This will execute the **TIDE-Lookup** logic app in the background.\r\n- You can check the status of the playbook to identify the TIDE Lookup status.\r\n- Click on the refresh button of the lookup panel until you get the TIDE Lookup information.\r\n
\r\n
\r\n**Note** : In cases where specific indicators may not have lookup information available in Infoblox, users are advised to refer to the Logic App status for further details. ", "style": "upsell" }, "name": "text - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7783c2b4-a6e6-4117-92ec-a9a751f01465", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\r\n| distinct subscriptionId", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "4a15b858-69b6-4198-abfd-6af5f187d813", "version": "KqlParameterItem/1.0", "name": "SentinelResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\r\n| where subscriptionId == ('{SubscriptionId}')\r\n| extend ResourceGroupName = resourceGroup\r\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ca226b80-e11b-4cb2-a1ae-3722f60aa4c1", "version": "KqlParameterItem/1.0", "name": "EntityType", "label": "Type", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\"host\", \"ip\", \"url\", \"hash\", \"email\"]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "9fbfab7b-f382-483b-975c-ab1fe0815b83", "version": "KqlParameterItem/1.0", "name": "EntityName", "type": 1, "isGlobal": true, "timeContext": { "durationMs": 86400000 }, "value": "", "label": "Target" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "SentinelResourceGroup", "comparison": "isNotEqualTo" } ], "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "f2242052-b69a-48b7-ac97-1f33d5e58c0f", "linkTarget": "ArmAction", "linkLabel": "GET TIDE DATA", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{SentinelResourceGroup}/providers/Microsoft.Logic/workflows/Infoblox-TIDE-Lookup/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\r\n \"type\": \"{EntityType}\",\r\n \"target\": \"{EntityName}\"\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command." } } ] }, "conditionalVisibilities": [ { "parameterName": "EntityName", "comparison": "isNotEqualTo" }, { "parameterName": "EntityType", "comparison": "isNotEqualTo" } ], "name": "links - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| where type_s == toupper('{EntityType}') and ip == '{EntityName}'\r\n| project \r\n IP = column_ifexists(\"ip\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for ip : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "ip" }, { "parameterName": "EntityName", "comparison": "isNotEqualTo" } ], "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend host = column_ifexists(\"host\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and host == '{EntityName}'\r\n| project \r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for host : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "host" }, { "parameterName": "EntityName", "comparison": "isNotEqualTo" } ], "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend url = column_ifexists(\"url\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and url == '{EntityName}'\r\n| project \r\n Url = column_ifexists(\"url\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for url : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "url" }, { "parameterName": "EntityName", "comparison": "isNotEqualTo" } ], "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend hash = column_ifexists(\"hash\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and hash == '{EntityName}'\r\n| project \r\n Hash = column_ifexists(\"hash\",\"\"),\r\n ['Hash Type'] = column_ifexists(\"hash_type\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for hash : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "hash" }, { "parameterName": "EntityName", "comparison": "isNotEqualTo" } ], "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend email = column_ifexists(\"email\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and email == '{EntityName}'\r\n| project \r\n Email = column_ifexists(\"email\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for email : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "email" }, { "parameterName": "EntityName", "comparison": "isNotEqualTo" } ], "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "1" }, "name": "group - 3", "styleSettings": { "padding": "10px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This workbook depends on the **Infoblox-TIDE-Lookup-Via-Incident** playbook which is deployed with the Microsoft Sentinel Solution.
\r\nPlease configure this logic app first and keep it enabled in order to use this workbook.\r\n\r\n", "style": "info" }, "name": "text - 8" }, { "type": 1, "content": { "json": "## Infoblox TIDE Lookup via Incidents\r\n---\r\n" }, "name": "text - 2" }, { "type": 1, "content": { "json": "## Steps to perform TIDE Lookup via Incident using this workbook\r\n- This workbook is intended to help perform TIDE Lookup for Indicators via Incidents.\r\n- Select the **Resource Group**, **Subscription ID**, **Workspace** and provide **[Tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)**.\r\n- Select TimeRange and Type for Incidents.\r\n- From the **Available Incidents** panel, select any indicator.\r\n- You will be able to see a lookup panel for that specific indicator. \r\n- If lookup information of this target is available in the last 24 hours it will be displayed in the lookup panel.\r\n- If there is message like **The query returned no results** on lookup panel, then click on the **GET TIDE DATA** link to get the TIDE Lookup information for the Indicator of that Incident.\r\n- This will execute the **TIDE-Lookup-Via-Incident** logic app in the background.\r\n- You can check the status of the playbook to identify the TIDE Lookup status.\r\n- Click on the refresh button of the lookup panel until you get the TIDE Lookup information.\r\n
\r\n
\r\n**Note** :\r\n\t* In cases where specific indicators may not have lookup information available in Infoblox, users are advised to refer to the Logic App status for further details.\r\n\t* Please ensure that you select the workspace where your workbook and playbook are available. Otherwise, the data ingested by the playbook will not be reflected in the drilldown panel.\r\n", "style": "upsell" }, "name": "text - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7783c2b4-a6e6-4117-92ec-a9a751f01465", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\r\n| distinct subscriptionId", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "4a15b858-69b6-4198-abfd-6af5f187d813", "version": "KqlParameterItem/1.0", "name": "SentinelResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\r\n| where subscriptionId == ('{SubscriptionId}')\r\n| extend ResourceGroupName = resourceGroup\r\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "9e2b01b1-798f-4239-a845-f1a0a3781a99", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| where resourceGroup =~ \"{SentinelResourceGroup}\"", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "854db66e-d6e4-4ae3-bb16-abc9dcd0a334", "version": "KqlParameterItem/1.0", "name": "TenantID", "label": "Tenant ID", "type": 1, "isRequired": true, "value": "" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "51b0558c-95f7-452c-95c3-c501535f7a92", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 }, "label": "Time Range" }, { "id": "ca226b80-e11b-4cb2-a1ae-3722f60aa4c1", "version": "KqlParameterItem/1.0", "name": "IOCType", "label": "Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities.Type in ('ip','filehash','url','host')\r\n| distinct tostring(Entities.Type)\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "TenantID", "comparison": "isNotEqualTo" }, { "parameterName": "Workspace", "comparison": "isNotEqualTo" } ], "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| extend AlertIds = todynamic(AlertIds)\r\n| extend AlertId = tostring(AlertIds[0])\r\n| join kind=inner (SecurityAlert| project SystemAlertId, Entities) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| extend EntityType = case(Entities.Type =~ \"filehash\",\"hash\",Entities.Type)\r\n| where isnotempty(EntityType)\r\n| where \"{IOCType:escapejson}\" == '*' or EntityType in ({IOCType})\r\n| extend EntityName = case(EntityType =~ \"ip\", Entities.Address, \r\n EntityType =~ \"hash\", Entities.Value,\r\n EntityType =~ \"host\", Entities.NetBiosName,\r\n EntityType =~ \"url\", Entities.Url,\r\n \"\"), ['TIDE Lookup'] = \"GET TIDE DATA\"\r\n| where isnotempty(EntityName)\r\n| summarize arg_max(TimeGenerated, *) by EntityName,tostring(EntityType)\r\n| project ['IOC Value'] = EntityName, ['IOC Type'] = EntityType, IncidentUrl, ['TIDE Lookup'], IncidentName, Title, Description, Severity, Status, ProviderName, CreatedTime, IncidentNumber, Tasks, Labels, ModifiedBy\r\n", "size": 0, "showAnalytics": true, "title": "Available Incidents", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "IncidentName", "parameterName": "IncidentName" }, { "fieldName": "IOC Value", "parameterName": "EntityName", "parameterType": 1 }, { "fieldName": "IOC Type", "parameterName": "EntityType", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident", "linkIsContextBlade": false } }, { "columnMatch": "TIDE Lookup", "formatter": 7, "formatOptions": { "linkTarget": "ArmAction", "linkIsContextBlade": true, "armActionContext": { "path": "/{Workspace}/providers/Microsoft.SecurityInsights/incidents/{IncidentName}/runPlaybook?api-version=2019-01-01-preview", "headers": [], "params": [], "body": "{\r\n\r\n\"LogicAppsResourceId\":\"/subscriptions/{SubscriptionId}/resourceGroups/{SentinelResourceGroup}/providers/Microsoft.Logic/workflows/Infoblox-TIDE-Lookup-Via-Incident\",\r\n\r\n \"TenantId\":\"{TenantID}\"\r\n\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command." } } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "TenantID", "comparison": "isNotEqualTo" }, { "parameterName": "Workspace", "comparison": "isNotEqualTo" } ], "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| where type_s == toupper('{EntityType}') and ip == '{EntityName}'\r\n| project \r\n IP = column_ifexists(\"ip\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for ip : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "ip" }, "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend host = column_ifexists(\"host\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and host == '{EntityName}'\r\n| project \r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for host : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "host" }, "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend url = column_ifexists(\"url\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and url == '{EntityName}'\r\n| project \r\n Url = column_ifexists(\"url\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for url : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "url" }, "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, type_s: string, ip: string, host:string, url:string, hash:string, email:string) [];\r\nunion isfuzzy=true dummy_table,\r\ntide_lookup_data_CL\r\n| extend hash = column_ifexists(\"hash\",\"\")\r\n| extend type_s = column_ifexists(\"type_s\",\"\")\r\n| where type_s == toupper('{EntityType}') and hash == '{EntityName}'\r\n| project \r\n Hash = column_ifexists(\"hash\",\"\"),\r\n ['Hash Type'] = column_ifexists(\"hash_type\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ['Threat Level'] = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")", "size": 0, "showAnalytics": true, "title": "Lookup for hash : {EntityName}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "EntityType", "comparison": "isEqualTo", "value": "hash" }, "name": "query - 3", "styleSettings": { "padding": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "4" }, "name": "TIDE Incident Lookup", "styleSettings": { "padding": "10px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This workbook depends on the **Dossier Function App** which is deployed with the Microsoft Sentinel Solution. \r\n
Please configure this function app first and keep it enabled in order to use this workbook.\r\n", "style": "info" }, "name": "text - 9" }, { "type": 1, "content": { "json": "## Infoblox Dossier Lookup\r\n---" }, "name": "text - 7" }, { "type": 1, "content": { "json": "## Steps to perform Dossier Lookup using this workbook\r\n- This workbook is intended to help perform Dossier Lookup for Indicators.\r\n- Select **Dossier Function App Name** which is deployed with the Microsoft Sentinel Solution.\r\n- Select Indicator type from Type filter and provide indicator value corresponding to it's type in the Target parameter.\r\n- Click on the **GET DOSSIER DATA** link.\r\n- This will execute the function app in the background to get the Dossier Lookup data (You will be redirect in new tab).\r\n- You will be able to see a message like **Refresh to check for Dossier data availability**.\r\n- Click on the refresh button above the message until you get a message like **Click here to view the data**.\r\n- Click on the message **Click here to view the data** and it will display various lookup panels for different source data.\r\n
\r\n
\r\n**Note** :\r\n\t* The lookup information will be cache for 24 hours in sentinel.
\r\n\t* It is suggested to perform a **Hard Refresh** before getting Dossier data for the new target. Otherwise, the source drill down panels will not be populated properly.\r\n", "style": "upsell" }, "name": "text - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1bc43239-b48a-4894-a7ef-5d9326cfe690", "version": "KqlParameterItem/1.0", "name": "DurableFunction", "label": "Dossier Function App Name", "type": 5, "isRequired": true, "query": "resources\r\n| where type contains \"microsoft.web/sites\"\r\n| where name startswith \"dossier\"\r\n| distinct name", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ca226b80-e11b-4cb2-a1ae-3722f60aa4c1", "version": "KqlParameterItem/1.0", "name": "IOCType", "label": "Type", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\"host\", \"ip\", \"url\", \"hash\", \"email\"]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "9fbfab7b-f382-483b-975c-ab1fe0815b83", "version": "KqlParameterItem/1.0", "name": "IOCValue", "label": "Target", "type": 1, "isGlobal": true, "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(Dossier_Lookup: string)\r\n[\r\n \"https://{DurableFunction}.azurewebsites.net/api/orchestrators/InfobloxDossierOrchestrator?target={IOCValue}&type={IOCType}\"\r\n];\r\ndummy_table", "size": 3, "timeContext": { "durationMs": 86400000 }, "exportFieldName": "Dossier_Lookup", "exportParameterName": "Dossier_Lookup", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Dossier_Lookup", "formatter": 1, "formatOptions": { "linkTarget": "Url", "linkLabel": "GET DOSSIER DATA" } }, "showBorder": false, "sortCriteriaField": "export_param" } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "IOCValue", "comparison": "isNotEqualTo" }, { "parameterName": "IOCType", "comparison": "isNotEqualTo" } ], "name": "query - 10", "styleSettings": { "maxWidth": "20%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string) [];\r\nunion isfuzzy=true dummy_table, dossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_source == \"atp\"\r\n| summarize count()\r\n| extend status = case(count_ == 0 , \"Refresh to check for Dossier data availability\",\"Click here to view the data\")\r\n| project status\r\n", "size": 3, "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "dossier_status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 1 }, "showBorder": false, "size": "auto" }, "textSettings": { "style": "editor" } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "IOCValue", "comparison": "isNotEqualTo" }, { "parameterName": "Dossier_Lookup", "comparison": "isNotEqualTo" } ], "name": "query - 10", "styleSettings": { "maxWidth": "30%" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelist", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_infoblox_web_cat_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"infoblox_web_cat\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_results = column_ifexists(\"data_results\",\"\")\r\n| where isnotempty(data_results)\r\n| extend data_results = parse_json(data_results)\r\n| mv-expand data_results\r\n| project ['Web Category'] = data_results.name", "size": 3, "title": "Web Categories", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Web Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Uncategorized", "representation": "Normal", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Found", "representation": "Unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "sortOrderField": 2, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "80" } } ] }, "customWidth": "0", "name": "group - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_rpz_feeds_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"rpz_feeds\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (union isfuzzy = true dummy_table, dossier_rpz_feeds_records_CL) on $left.task_id == $right.task_id\r\n| extend \r\n class = column_ifexists(\"class\",\"\"),\r\n detected = column_ifexists(\"detected\",\"\"),\r\n expiration = column_ifexists(\"expiration\",\"\"),\r\n feed_name = column_ifexists(\"feed_name\",\"\"),\r\n property = column_ifexists(\"property\",\"\"),\r\n threat_level = column_ifexists(\"threat_level\", 0)\r\n| where isnotempty(class ) or isnotempty(detected ) or isnotempty(expiration ) or isnotempty(feed_name ) or isnotempty(property )\r\n|extend Severity = case( tolong(threat_level) >= 75, \"High\",tolong(threat_level) < 75 and tolong(threat_level) >= 50, \"Medium\",tolong(threat_level) < 50 and tolong(threat_level) >= 25,\"Low\",tolong(threat_level) <25 , \"Info\",\"\")\r\n| project\r\n ['Feed Name'] = feed_name,\r\n ['Threat Level'] = threat_level,\r\n Severity,\r\n Property = property,\r\n Class = class,\r\n Detected = detected,\r\n Expiration = expiration", "size": 3, "showAnalytics": true, "title": "Active Threat Feeds and Status (RPZ Feeds)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_inforank_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"inforank\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n Domain = column_ifexists(\"data_domain\",\"\"),\r\n Interval = column_ifexists(\"data_interval\",\"\"),\r\n Rank = column_ifexists(\"data_rank\",\"\"),\r\n Message = column_ifexists(\"data_message\",\"\")\r\n| where\r\nisnotempty(Domain) or\r\nisnotempty(Interval) or\r\nisnotempty(Rank) or\r\nisnotempty(Message)\r\n| project \r\n Domain,\r\n Interval,\r\n Rank,\r\n Message\r\n\r\n", "size": 3, "title": "Inforank Ranking", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_threat_actor_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"threat_actor\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n actor_description = column_ifexists( \"data_actor_description\",\"\"),\r\n actor_name = column_ifexists( \"data_actor_name\",\"\"),\r\n purpose = tostring(column_ifexists( \"data_purpose\",\"\")),\r\n related_count = column_ifexists( \"data_related_count\",\"\"),\r\n ttp = tostring(column_ifexists( \"data_ttp\",\"\")),\r\n Url = strcat('https://csp.infoblox.com/#/security_research/search/auto/','{IOCValue}','/threat-actor')\r\n| where\r\n isnotempty(actor_description) or\r\n isnotempty(actor_name) or\r\n isnotempty(purpose) or\r\n isnotempty(ttp)\r\n| extend purpose = replace_string(purpose,'\"','')\r\n| extend purpose = replace_string(purpose,',',', ')\r\n| extend purpose = trim(@\"[\\[\\]]\",purpose)\r\n| extend ttp = replace_string(ttp,'\"','')\r\n| extend ttp = replace_string(ttp,',',', ')\r\n| extend ttp = trim(@\"[\\[\\]]\",ttp)\r\n| project\r\n ['Actor Description'] = actor_description,\r\n ['Actor Name'] = actor_name,\r\n Purpose = purpose,\r\n ['Related Count'] = related_count,\r\n ['CSP Portal'] = Url,\r\n Ttp = ttp", "size": 3, "title": "DNS Threat Actor", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CSP Portal", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "More Detail" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_geo_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"geo\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend\r\n asn_num = column_ifexists(\"data_asn_num\", \"\"),\r\n city = column_ifexists(\"data_city\", \"\"),\r\n country_code = column_ifexists(\"data_country_code\", \"\"),\r\n country_name = column_ifexists(\"data_country_name\", \"\"),\r\n isp = column_ifexists(\"data_isp\", \"\"),\r\n latitude = column_ifexists(\"data_latitude\", \"\"),\r\n longitude = column_ifexists(\"data_longitude\", \"\"),\r\n org = column_ifexists(\"data_org\", \"\"),\r\n postal_code = column_ifexists(\"data_postal_code\", \"\"),\r\n region = column_ifexists(\"data_region\", \"\")\r\n| where\r\n isnotempty(asn_num) or\r\n isnotempty(city) or\r\n isnotempty(country_code) or\r\n isnotempty(country_name) or\r\n isnotempty(isp) or\r\n isnotempty(latitude) or\r\n isnotempty(longitude) or\r\n isnotempty(org) or\r\n isnotempty(postal_code) or\r\n isnotempty(region)\r\n| project \r\n ['Asn Number'] = asn_num,\r\n City = city,\r\n ['Country Code'] = country_code,\r\n ['Country Name'] = country_name,\r\n Isp = isp,\r\n Latitude = latitude,\r\n Longitude = longitude,\r\n Org = org,\r\n ['Postal Code'] = postal_code,\r\n Region = region", "size": 3, "title": "Geo Graphic Details", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_tld_risk_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"tld_risk\" \r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_matches = column_ifexists(\"data_matches\",\"\")\r\n| mv-expand todynamic(data_matches)\r\n| project data_matches\r\n| parse-kv data_matches as (confidence:string, popular:string, rare:string, score:string, score_label:string, tld:string) with (pair_delimiter=',', kv_delimiter=':',quote='\"')\r\n| where\r\n isnotempty(confidence) or\r\n isnotempty(popular) or\r\n isnotempty(rare) or\r\n isnotempty(score) or\r\n isnotempty(score_label) or\r\n isnotempty(tld)\r\n| project \r\n ['Score Label'] = score_label,\r\n Score = score,\r\n TLD = tld,\r\n Confidence = confidence,\r\n Popular = popular,\r\n Rare = rare\r\n\r\n", "size": 0, "title": "TLD Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Score Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "showBorder": false } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_nameserver_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"nameserver\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_nameserver_matches_CL) on $left.task_id == $right.task_id\r\n|extend \r\n Domain = column_ifexists(\"domain\",\"\"),\r\n Confidence = column_ifexists(\"ns_reputation_confidence\",\"\"),\r\n Label = column_ifexists(\"ns_reputation_label\",\"\"),\r\n malicious_counts = column_ifexists(\"ns_reputation_malicious_counts\",\"\"),\r\n Popular = column_ifexists(\"ns_reputation_popular\",\"\"),\r\n Rare = column_ifexists(\"ns_reputation_rare\",\"\"),\r\n raw_score = column_ifexists(\"ns_reputation_raw_score\",\"\"),\r\n Score = column_ifexists(\"ns_reputation_score\",\"\"),\r\n total_counts = column_ifexists(\"ns_reputation_total_counts\",\"\")\r\n| where\r\n isnotempty(Domain) or\r\n isnotempty(Confidence) or\r\n isnotempty(Label) or\r\n isnotempty(malicious_counts) or\r\n isnotempty(Popular) or\r\n isnotempty(Rare) or\r\n isnotempty(raw_score) or\r\n isnotempty(Score) or\r\n isnotempty(total_counts)\r\n| project \r\n Domain,\r\n Label,\r\n Score,\r\n Confidence,\r\n Popular,\r\n Rare,\r\n ['Raw Score'] = raw_score,\r\n ['Total Counts'] = total_counts,\r\n ['Malicious Counts'] = malicious_counts\r\n", "size": 0, "title": "Nameserver Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Very Low Risk", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "sortBy": [ { "itemKey": "Popular", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Popular", "sortOrder": 1 } ] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 14", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\")\r\n| project \r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Confidence,\r\n Class,\r\n Detected,\r\n ['Threat Level'] = ThreatLevel,\r\n Imported,\r\n Received,\r\n Up,\r\n Expiration,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whois_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"whois\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n RegistrantName = column_ifexists(\"data_response_registrant\",\"\"),\r\n Nameservers = tostring(column_ifexists(\"data_response_nameservers\",\"\")),\r\n RegistrarEmail = column_ifexists(\"data_response_parsed_whois_registrar_abuse_contact_email\",\"\"),\r\n RegistrarPhone = column_ifexists(\"data_response_parsed_whois_registrar_abuse_contact_phone\",\"\"),\r\n Domain = column_ifexists(\"data_response_parsed_whois_domain\",\"\"),\r\n Created = column_ifexists(\"data_response_registration_created\",\"\"),\r\n Expires = column_ifexists(\"data_response_registration_expires\",\"\"),\r\n Statuses = tostring(column_ifexists(\"data_response_registration_statuses\",\"\")),\r\n Updated = column_ifexists(\"data_response_registration_updated\",\"\")\r\n| where \r\n isnotempty(RegistrantName) or\r\n isnotempty(Nameservers) or\r\n isnotempty(RegistrarEmail) or\r\n isnotempty(RegistrarPhone) or\r\n isnotempty(Domain) or\r\n isnotempty(Created) or\r\n isnotempty(Expires) or\r\n isnotempty(Statuses) or\r\n isnotempty(Updated)\r\n| extend Nameservers = replace_string(Nameservers,'\"','')\r\n| extend Nameservers = replace_string(Nameservers,',',', ')\r\n| extend Nameservers = trim(@\"[\\[\\]]\",Nameservers)\r\n| extend Statuses = replace_string(Statuses,'\"','')\r\n| extend Statuses = replace_string(Statuses,',',', ')\r\n| extend Statuses = trim(@\"[\\[\\]]\",Statuses)\r\n| project \r\n ['Registrant Name'] = RegistrantName,\r\n Domain,\r\n Statuses,\r\n ['Name Servers'] = Nameservers,\r\n ['Registrar Email'] = RegistrarEmail,\r\n ['Registrar Phone'] = RegistrarPhone,\r\n Created,\r\n Expires,\r\n Updated", "size": 3, "title": "Registered Owner (WHOIS)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nlet dns_A_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n A = column_ifexists(\"data_A\",\"\")\r\n | mv-expand todynamic(data_A)\r\n | project Type=\"A\", Value=data_A.ip, Reverse=data_A.reverse, TTL=data_A.ttl;\r\nlet dns_AAAA_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n AAAA = column_ifexists(\"data_AAAA\",\"\")\r\n | mv-expand todynamic(data_AAAA)\r\n | project Type=\"AAAA\",Value=data_AAAA;\r\nlet dns_CERT_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n CERT = column_ifexists(\"data_CERT\",\"\")\r\n | mv-expand todynamic(data_CERT)\r\n | project Type=\"CERT\",Value=data_CERT;\r\nlet dns_CNAME_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n CNAME = column_ifexists(\"data_CNAME\",\"\")\r\n | mv-expand todynamic(data_CNAME)\r\n | project Type=\"CNAME\",Value=data_CNAME;\r\nlet dns_HTTPS_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n HTTPS = column_ifexists(\"data_HTTPS\",\"\")\r\n | mv-expand todynamic(data_HTTPS)\r\n | project Type=\"HTTPS\",Value=data_HTTPS;\r\nlet dns_NS_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n NS = column_ifexists(\"data_NS\",\"\")\r\n | mv-expand todynamic(data_NS)\r\n | project Type=\"NS\",Value=data_NS;\r\nlet dns_SOA_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n SOA = column_ifexists(\"data_SOA\",\"\")\r\n | mv-expand todynamic(data_SOA)\r\n | project Type=\"SOA\",Value=data_SOA;\r\nlet dns_MX_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n MX = column_ifexists(\"data_MX\",\"\")\r\n | mv-expand todynamic(data_MX)\r\n | project Type=\"MX\",Value=data_MX;\r\nlet dns_SVCB_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n SVCB = column_ifexists(\"data_SVCB\",\"\")\r\n | mv-expand todynamic(data_SVCB)\r\n | project Type=\"SVCB\",Value=data_SVCB;\r\nlet dns_TSIG_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n TSIG = column_ifexists(\"data_TSIG\",\"\")\r\n | mv-expand todynamic(data_TSIG)\r\n | project Type=\"TSIG\",Value=data_TSIG;\r\nlet dns_TXT_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n TXT = column_ifexists(\"data_TXT\",\"\")\r\n | mv-expand todynamic(data_TXT)\r\n | project Type=\"TXT\",Value=data_TXT;\r\n union dns_A_data,dns_AAAA_data,dns_CERT_data,\r\ndns_CNAME_data,\r\ndns_HTTPS_data,\r\ndns_NS_data,\r\ndns_SOA_data,\r\ndns_MX_data,\r\ndns_SVCB_data,\r\ndns_TSIG_data,\r\ndns_TXT_data\r\n| where isnotempty( Value) or isnotempty( Reverse) or isnotempty( TTL)\r\n| sort by Type asc", "size": 0, "showAnalytics": true, "title": "Current DNS", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Type", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "host" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelisted", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_ptr_CL\r\n| where params_target == '{IOCValue}' and params_type == \"ip\" and params_source == \"ptr\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend ptr_record = column_ifexists(\"data_ptr_record\",\"\")\r\n| extend ptr_record = case( isempty(ptr_record), \"Not Found\",ptr_record)\r\n| project ptr_record", "size": 3, "title": "Domain Name Associated (PTR)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "ptr_record", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Found", "representation": "Unavailable", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "name": "query - 1", "styleSettings": { "maxWidth": "20" } } ] }, "customWidth": "0", "name": "group - 11", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_rpz_feeds_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"rpz_feeds\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (union isfuzzy = true dummy_table, dossier_rpz_feeds_records_CL) on $left.task_id == $right.task_id\r\n| extend \r\n class = column_ifexists(\"class\",\"\"),\r\n detected = column_ifexists(\"detected\",\"\"),\r\n expiration = column_ifexists(\"expiration\",\"\"),\r\n feed_name = column_ifexists(\"feed_name\",\"\"),\r\n property = column_ifexists(\"property\",\"\"),\r\n threat_level = column_ifexists(\"threat_level\", 0)\r\n| where isnotempty(class ) or isnotempty(detected ) or isnotempty(expiration ) or isnotempty(feed_name ) or isnotempty(property )\r\n|extend Severity = case( tolong(threat_level) >= 75, \"High\",tolong(threat_level) < 75 and tolong(threat_level) >= 50, \"Medium\",tolong(threat_level) < 50 and tolong(threat_level) >= 25,\"Low\",tolong(threat_level) <25 , \"Info\",\"\")\r\n| project\r\n ['Feed Name'] = feed_name,\r\n ['Threat Level'] = threat_level,\r\n Severity,\r\n Property = property,\r\n Class = class,\r\n Detected = detected,\r\n Expiration = expiration", "size": 3, "showAnalytics": true, "title": "Active Threat Feeds and Status (RPZ Feeds)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_geo_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"geo\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend\r\n asn_num = column_ifexists(\"data_asn_num\", \"\"),\r\n city = column_ifexists(\"data_city\", \"\"),\r\n country_code = column_ifexists(\"data_country_code\", \"\"),\r\n country_name = column_ifexists(\"data_country_name\", \"\"),\r\n isp = column_ifexists(\"data_isp\", \"\"),\r\n latitude = column_ifexists(\"data_latitude\", \"\"),\r\n longitude = column_ifexists(\"data_longitude\", \"\"),\r\n org = column_ifexists(\"data_org\", \"\"),\r\n postal_code = column_ifexists(\"data_postal_code\", \"\"),\r\n region = column_ifexists(\"data_region\", \"\")\r\n| where\r\n isnotempty(asn_num) or\r\n isnotempty(city) or\r\n isnotempty(country_code) or\r\n isnotempty(country_name) or\r\n isnotempty(isp) or\r\n isnotempty(latitude) or\r\n isnotempty(longitude) or\r\n isnotempty(org) or\r\n isnotempty(postal_code) or\r\n isnotempty(region) \r\n| project \r\n ['Asn Number'] = asn_num,\r\n City = city,\r\n ['Country Code'] = country_code,\r\n ['Country Name'] = country_name,\r\n Isp = isp,\r\n Latitude = latitude,\r\n Longitude = longitude,\r\n Org = org,\r\n ['Postal Code'] = postal_code,\r\n Region = region", "size": 3, "title": "Geo Graphic Details", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "60", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n IP = column_ifexists(\"ip\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n Threatlevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n IP,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = Threatlevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whois_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"whois\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\nCountry = column_ifexists(\"data_response_ip_response_country\",\"\"),\r\nHandle = column_ifexists(\"data_response_ip_response_handle\",\"\"),\r\nlast_changed = column_ifexists(\"data_response_ip_response_last_changed\",\"\"),\r\nName = column_ifexists(\"data_response_ip_response_name\",\"\"),\r\nnet_range = column_ifexists(\"data_response_ip_response_net_range\",\"\"),\r\nnet_type = column_ifexists(\"data_response_ip_response_net_type\",\"\"),\r\nParent = column_ifexists(\"data_response_ip_response_parent\",\"\"),\r\nRegistration = column_ifexists(\"data_response_ip_response_registration\",\"\"),\r\nsource_registery = column_ifexists(\"data_response_ip_response_source_registery\",\"\")\r\n| where\r\n isnotempty(Country) or\r\n isnotempty(Handle) or\r\n isnotempty(last_changed) or\r\n isnotempty(Name) or\r\n isnotempty(net_range) or\r\n isnotempty(net_type) or\r\n isnotempty(Parent) or\r\n isnotempty(Registration) or\r\n isnotempty(source_registery)\r\n| project \r\n Name,\r\n Country,\r\n Handle,\r\n ['Network Range'] = net_range,\r\n ['Network Type'] = net_type,\r\n Parent,\r\n ['Source Registery'] = source_registery,\r\n ['Last Changed'] = last_changed ,\r\n Registration", "size": 3, "title": "Registered Owner (WHOIS)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "ip" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelist", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_infoblox_web_cat_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"infoblox_web_cat\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_results = column_ifexists(\"data_results\",\"\")\r\n| where isnotempty(data_results)\r\n| extend data_results = parse_json(data_results)\r\n| mv-expand data_results\r\n| project ['Web Category'] = data_results.name", "size": 3, "title": "Web Categories", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Web Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Uncategorized", "representation": "Normal", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Found", "representation": "Unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "sortOrderField": 2, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "80" } } ] }, "customWidth": "0", "name": "group - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_tld_risk_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"tld_risk\" \r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_matches = column_ifexists(\"data_matches\",\"\")\r\n| mv-expand todynamic(data_matches)\r\n| project data_matches\r\n| parse-kv data_matches as (confidence:string, popular:string, rare:string, score:string, score_label:string, tld:string) with (pair_delimiter=',', kv_delimiter=':',quote='\"')\r\n| where\r\n isnotempty(confidence) or\r\n isnotempty(popular) or\r\n isnotempty(rare) or\r\n isnotempty(score) or\r\n isnotempty(score_label) or\r\n isnotempty(tld)\r\n| project \r\n ['Score Label'] = score_label,\r\n Score = score,\r\n TLD = tld,\r\n Confidence = confidence,\r\n Popular = popular,\r\n Rare = rare\r\n\r\n", "size": 3, "title": "TLD Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Score Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "showBorder": false } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Url = column_ifexists(\"url\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Url,\r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "url" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Hash = column_ifexists(\"hash\",\"\"),\r\n HashType = column_ifexists(\"hash_type\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Hash,\r\n ['Hash Type'] = HashType,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "hash" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5 - Copy - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"email\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"email\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Email = column_ifexists(\"email\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Email,\r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "email" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 6" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "2" }, "name": "group - 3", "styleSettings": { "padding": "10px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This workbook depends on the **Dossier Function App** which is deployed with the Microsoft Sentinel Solution.\r\n
Please configure this function app first and keep it enabled in order to use this workbook.\r\n", "style": "info" }, "name": "text - 9" }, { "type": 1, "content": { "json": "## Infoblox Dossier Lookup via Incidents\r\n---\r\n" }, "name": "text - 7" }, { "type": 1, "content": { "json": "## Steps to perform Dossier Lookup via Incident using this workbook\r\n- This workbook is intended to help perform Dossier Lookup for Indicators via Incidents.\r\n- Select **Dossier Function App Name** which is deployed with the Microsoft Sentinel Solution.\r\n- Select TimeRange and Type for Incidents .\r\n- From the **Available Incidents** panel, select any indicator and click on the **GET DOSSIER DATA** link (You will be redirect in new tab) to get the Dossier Lookup information for the Indicator of that Incident.\r\n- This will execute the function app in the background to get the Dossier Lookup data.\r\n- You will be able to see a message like **Refresh to check for Dossier data availability**.\r\n- Click on the refresh button above the message until you get a message like **Click here to view the data**.\r\n- Click on that message and it will display various lookup panels for different source data.\r\n
\r\n
\r\n**Note** :\r\n\t* The lookup information will be cache for 24 hours in sentinel.
\r\n\t* It is suggested to perform a **Hard Refresh** before getting Dossier data for the new target. Otherwise, the source drill down panels will not be populated properly.", "style": "upsell" }, "name": "text - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1bc43239-b48a-4894-a7ef-5d9326cfe690", "version": "KqlParameterItem/1.0", "name": "DurableFunction", "label": "Dossier Function App Name", "type": 5, "isRequired": true, "query": "resources\r\n| where type contains \"microsoft.web/sites\"\r\n| where name startswith \"dossier\"\r\n| distinct name", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "de1d2274-20d3-4f7f-81cf-d8df4db9c0ec", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "10e7adfc-f0de-45db-b3e7-1adc0b3fe3b5", "version": "KqlParameterItem/1.0", "name": "Type", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityAlert\r\n| mv-expand todynamic(Entities)\r\n| where Entities.Type in ('ip','filehash','url','host')\r\n| distinct tostring(Entities.Type)\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| extend AlertIds = todynamic(AlertIds)\r\n| extend AlertId = tostring(AlertIds[0])\r\n| join kind=inner (SecurityAlert| project SystemAlertId, Entities) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| extend IOCType = case(Entities.Type =~ \"filehash\",\"hash\",Entities.Type)\r\n| extend IOCValue = case(IOCType =~ \"ip\", Entities.Address, \r\n IOCType =~ \"hash\", Entities.Value,\r\n IOCType =~ \"host\", Entities.NetBiosName,\r\n IOCType =~ \"url\", Entities.Url,\r\n \"\")\r\n|extend ['Dossier Lookup'] =strcat('https://','{DurableFunction}','.azurewebsites.net/api/orchestrators/InfobloxDossierOrchestrator?target=',IOCValue,'&type=',IOCType)\r\n| where isnotempty(IOCType) and isnotempty(IOCValue)\r\n| where \"{Type:escapejson}\" == '*' or IOCType in ({Type})\r\n| summarize arg_max(TimeGenerated, *) by ['IOC Value'] = IOCValue,['IOC Type'] = tostring(IOCType)\r\n| project ['IOC Value'], ['IOC Type'], IncidentUrl, ['Dossier Lookup'], IncidentName, Title, Description, Severity, Status, ProviderName, CreatedTime, IncidentNumber, Tasks, Labels, ModifiedBy\r\n", "size": 0, "showAnalytics": true, "title": "Available Incidents", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "IOC Value", "parameterName": "IOCValue", "parameterType": 1 }, { "fieldName": "IOC Type", "parameterName": "IOCType", "parameterType": 1 }, { "fieldName": "Dossier Lookup", "parameterName": "Dossier_Lookup", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "Dossier Lookup", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "GET DOSSIER DATA" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "DurableFunction", "comparison": "isNotEqualTo" }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string) [];\r\nunion isfuzzy=true dummy_table, dossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_source == \"atp\"\r\n| summarize count()\r\n| extend status = case(count_ == 0 , \"Refresh to check for Dossier data availability\",\"Click here to view the data\")\r\n| project status\r\n", "size": 3, "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "dossier_status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 1 }, "showBorder": false, "size": "auto" }, "textSettings": { "style": "editor" } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "IOCValue", "comparison": "isNotEqualTo" }, { "parameterName": "Dossier_Lookup", "comparison": "isNotEqualTo" } ], "name": "query - 10", "styleSettings": { "maxWidth": "30%" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelist", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_infoblox_web_cat_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"infoblox_web_cat\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_results = column_ifexists(\"data_results\",\"\")\r\n| where isnotempty(data_results)\r\n| extend data_results = parse_json(data_results)\r\n| mv-expand data_results\r\n| project ['Web Category'] = data_results.name", "size": 3, "title": "Web Categories", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Web Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Uncategorized", "representation": "Normal", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Found", "representation": "Unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "sortOrderField": 2, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "80" } } ] }, "customWidth": "0", "name": "group - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_rpz_feeds_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"rpz_feeds\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (union isfuzzy = true dummy_table, dossier_rpz_feeds_records_CL) on $left.task_id == $right.task_id\r\n| extend \r\n class = column_ifexists(\"class\",\"\"),\r\n detected = column_ifexists(\"detected\",\"\"),\r\n expiration = column_ifexists(\"expiration\",\"\"),\r\n feed_name = column_ifexists(\"feed_name\",\"\"),\r\n property = column_ifexists(\"property\",\"\"),\r\n threat_level = column_ifexists(\"threat_level\", 0)\r\n| where isnotempty(class ) or isnotempty(detected ) or isnotempty(expiration ) or isnotempty(feed_name ) or isnotempty(property )\r\n|extend Severity = case( tolong(threat_level) >= 75, \"High\",tolong(threat_level) < 75 and tolong(threat_level) >= 50, \"Medium\",tolong(threat_level) < 50 and tolong(threat_level) >= 25,\"Low\",tolong(threat_level) <25 , \"Info\",\"\")\r\n| project\r\n ['Feed Name'] = feed_name,\r\n ['Threat Level'] = threat_level,\r\n Severity,\r\n Property = property,\r\n Class = class,\r\n Detected = detected,\r\n Expiration = expiration", "size": 3, "showAnalytics": true, "title": "Active Threat Feeds and Status (RPZ Feeds)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_inforank_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"inforank\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n Domain = column_ifexists(\"data_domain\",\"\"),\r\n Interval = column_ifexists(\"data_interval\",\"\"),\r\n Rank = column_ifexists(\"data_rank\",\"\"),\r\n Message = column_ifexists(\"data_message\",\"\")\r\n| where\r\nisnotempty(Domain) or\r\nisnotempty(Interval) or\r\nisnotempty(Rank) or\r\nisnotempty(Message)\r\n| project \r\n Domain,\r\n Interval,\r\n Rank,\r\n Message\r\n\r\n", "size": 3, "title": "Inforank Ranking", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_threat_actor_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"threat_actor\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n actor_description = column_ifexists( \"data_actor_description\",\"\"),\r\n actor_name = column_ifexists( \"data_actor_name\",\"\"),\r\n purpose = tostring(column_ifexists( \"data_purpose\",\"\")),\r\n related_count = column_ifexists( \"data_related_count\",\"\"),\r\n ttp = tostring(column_ifexists( \"data_ttp\",\"\")),\r\n Url = strcat('https://csp.infoblox.com/#/security_research/search/auto/','{IOCValue}','/threat-actor')\r\n| where\r\n isnotempty(actor_description) or\r\n isnotempty(actor_name) or\r\n isnotempty(purpose) or\r\n isnotempty(ttp)\r\n| extend purpose = replace_string(purpose,'\"','')\r\n| extend purpose = replace_string(purpose,',',', ')\r\n| extend purpose = trim(@\"[\\[\\]]\",purpose)\r\n| extend ttp = replace_string(ttp,'\"','')\r\n| extend ttp = replace_string(ttp,',',', ')\r\n| extend ttp = trim(@\"[\\[\\]]\",ttp)\r\n| project\r\n ['Actor Description'] = actor_description,\r\n ['Actor Name'] = actor_name,\r\n Purpose = purpose,\r\n ['Related Count'] = related_count,\r\n ['CSP Portal'] = Url,\r\n Ttp = ttp", "size": 3, "title": "DNS Threat Actor", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CSP Portal", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "More Detail" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_geo_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"geo\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend\r\n asn_num = column_ifexists(\"data_asn_num\", \"\"),\r\n city = column_ifexists(\"data_city\", \"\"),\r\n country_code = column_ifexists(\"data_country_code\", \"\"),\r\n country_name = column_ifexists(\"data_country_name\", \"\"),\r\n isp = column_ifexists(\"data_isp\", \"\"),\r\n latitude = column_ifexists(\"data_latitude\", \"\"),\r\n longitude = column_ifexists(\"data_longitude\", \"\"),\r\n org = column_ifexists(\"data_org\", \"\"),\r\n postal_code = column_ifexists(\"data_postal_code\", \"\"),\r\n region = column_ifexists(\"data_region\", \"\")\r\n| where\r\n isnotempty(asn_num) or\r\n isnotempty(city) or\r\n isnotempty(country_code) or\r\n isnotempty(country_name) or\r\n isnotempty(isp) or\r\n isnotempty(latitude) or\r\n isnotempty(longitude) or\r\n isnotempty(org) or\r\n isnotempty(postal_code) or\r\n isnotempty(region)\r\n| project \r\n ['Asn Number'] = asn_num,\r\n City = city,\r\n ['Country Code'] = country_code,\r\n ['Country Name'] = country_name,\r\n Isp = isp,\r\n Latitude = latitude,\r\n Longitude = longitude,\r\n Org = org,\r\n ['Postal Code'] = postal_code,\r\n Region = region", "size": 3, "title": "Geo Graphic Details", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_tld_risk_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"tld_risk\" \r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_matches = column_ifexists(\"data_matches\",\"\")\r\n| mv-expand todynamic(data_matches)\r\n| project data_matches\r\n| parse-kv data_matches as (confidence:string, popular:string, rare:string, score:string, score_label:string, tld:string) with (pair_delimiter=',', kv_delimiter=':',quote='\"')\r\n| where\r\n isnotempty(confidence) or\r\n isnotempty(popular) or\r\n isnotempty(rare) or\r\n isnotempty(score) or\r\n isnotempty(score_label) or\r\n isnotempty(tld)\r\n| project \r\n ['Score Label'] = score_label,\r\n Score = score,\r\n TLD = tld,\r\n Confidence = confidence,\r\n Popular = popular,\r\n Rare = rare\r\n\r\n", "size": 0, "title": "TLD Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Score Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "showBorder": false } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_nameserver_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"nameserver\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_nameserver_matches_CL) on $left.task_id == $right.task_id\r\n|extend \r\n Domain = column_ifexists(\"domain\",\"\"),\r\n Confidence = column_ifexists(\"ns_reputation_confidence\",\"\"),\r\n Label = column_ifexists(\"ns_reputation_label\",\"\"),\r\n malicious_counts = column_ifexists(\"ns_reputation_malicious_counts\",\"\"),\r\n Popular = column_ifexists(\"ns_reputation_popular\",\"\"),\r\n Rare = column_ifexists(\"ns_reputation_rare\",\"\"),\r\n raw_score = column_ifexists(\"ns_reputation_raw_score\",\"\"),\r\n Score = column_ifexists(\"ns_reputation_score\",\"\"),\r\n total_counts = column_ifexists(\"ns_reputation_total_counts\",\"\")\r\n| where\r\n isnotempty(Domain) or\r\n isnotempty(Confidence) or\r\n isnotempty(Label) or\r\n isnotempty(malicious_counts) or\r\n isnotempty(Popular) or\r\n isnotempty(Rare) or\r\n isnotempty(raw_score) or\r\n isnotempty(Score) or\r\n isnotempty(total_counts)\r\n| project \r\n Domain,\r\n Label,\r\n Score,\r\n Confidence,\r\n Popular,\r\n Rare,\r\n ['Raw Score'] = raw_score,\r\n ['Total Counts'] = total_counts,\r\n ['Malicious Counts'] = malicious_counts\r\n", "size": 0, "title": "Nameserver Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Very Low Risk", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "sortBy": [ { "itemKey": "Popular", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Popular", "sortOrder": 1 } ] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 14", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\")\r\n| project \r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Confidence,\r\n Class,\r\n Detected,\r\n ['Threat Level'] = ThreatLevel,\r\n Imported,\r\n Received,\r\n Up,\r\n Expiration,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whois_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"whois\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\n RegistrantName = column_ifexists(\"data_response_registrant\",\"\"),\r\n Nameservers = tostring(column_ifexists(\"data_response_nameservers\",\"\")),\r\n RegistrarEmail = column_ifexists(\"data_response_parsed_whois_registrar_abuse_contact_email\",\"\"),\r\n RegistrarPhone = column_ifexists(\"data_response_parsed_whois_registrar_abuse_contact_phone\",\"\"),\r\n Domain = column_ifexists(\"data_response_parsed_whois_domain\",\"\"),\r\n Created = column_ifexists(\"data_response_registration_created\",\"\"),\r\n Expires = column_ifexists(\"data_response_registration_expires\",\"\"),\r\n Statuses = tostring(column_ifexists(\"data_response_registration_statuses\",\"\")),\r\n Updated = column_ifexists(\"data_response_registration_updated\",\"\")\r\n| where \r\n isnotempty(RegistrantName) or\r\n isnotempty(Nameservers) or\r\n isnotempty(RegistrarEmail) or\r\n isnotempty(RegistrarPhone) or\r\n isnotempty(Domain) or\r\n isnotempty(Created) or\r\n isnotempty(Expires) or\r\n isnotempty(Statuses) or\r\n isnotempty(Updated)\r\n| extend Nameservers = replace_string(Nameservers,'\"','')\r\n| extend Nameservers = replace_string(Nameservers,',',', ')\r\n| extend Nameservers = trim(@\"[\\[\\]]\",Nameservers)\r\n| extend Statuses = replace_string(Statuses,'\"','')\r\n| extend Statuses = replace_string(Statuses,',',', ')\r\n| extend Statuses = trim(@\"[\\[\\]]\",Statuses)\r\n| project \r\n ['Registrant Name'] = RegistrantName,\r\n Domain,\r\n Statuses,\r\n ['Name Servers'] = Nameservers,\r\n ['Registrar Email'] = RegistrarEmail,\r\n ['Registrar Phone'] = RegistrarPhone,\r\n Created,\r\n Expires,\r\n Updated", "size": 3, "title": "Registered Owner (WHOIS)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nlet dns_A_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n A = column_ifexists(\"data_A\",\"\")\r\n | mv-expand todynamic(data_A)\r\n | project Type=\"A\", Value=data_A.ip, Reverse=data_A.reverse, TTL=data_A.ttl;\r\nlet dns_AAAA_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n AAAA = column_ifexists(\"data_AAAA\",\"\")\r\n | mv-expand todynamic(data_AAAA)\r\n | project Type=\"AAAA\",Value=data_AAAA;\r\nlet dns_CERT_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n CERT = column_ifexists(\"data_CERT\",\"\")\r\n | mv-expand todynamic(data_CERT)\r\n | project Type=\"CERT\",Value=data_CERT;\r\nlet dns_CNAME_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n CNAME = column_ifexists(\"data_CNAME\",\"\")\r\n | mv-expand todynamic(data_CNAME)\r\n | project Type=\"CNAME\",Value=data_CNAME;\r\nlet dns_HTTPS_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n HTTPS = column_ifexists(\"data_HTTPS\",\"\")\r\n | mv-expand todynamic(data_HTTPS)\r\n | project Type=\"HTTPS\",Value=data_HTTPS;\r\nlet dns_NS_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n NS = column_ifexists(\"data_NS\",\"\")\r\n | mv-expand todynamic(data_NS)\r\n | project Type=\"NS\",Value=data_NS;\r\nlet dns_SOA_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n SOA = column_ifexists(\"data_SOA\",\"\")\r\n | mv-expand todynamic(data_SOA)\r\n | project Type=\"SOA\",Value=data_SOA;\r\nlet dns_MX_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n MX = column_ifexists(\"data_MX\",\"\")\r\n | mv-expand todynamic(data_MX)\r\n | project Type=\"MX\",Value=data_MX;\r\nlet dns_SVCB_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n SVCB = column_ifexists(\"data_SVCB\",\"\")\r\n | mv-expand todynamic(data_SVCB)\r\n | project Type=\"SVCB\",Value=data_SVCB;\r\nlet dns_TSIG_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n TSIG = column_ifexists(\"data_TSIG\",\"\")\r\n | mv-expand todynamic(data_TSIG)\r\n | project Type=\"TSIG\",Value=data_TSIG;\r\nlet dns_TXT_data=\r\n union isfuzzy=true dummy_table,\r\n dossier_dns_CL\r\n | where params_target == '{IOCValue}' and params_type ==\"host\" and params_source == \"dns\"\r\n | summarize arg_max(TimeGenerated,*) by params_target\r\n | extend\r\n TXT = column_ifexists(\"data_TXT\",\"\")\r\n | mv-expand todynamic(data_TXT)\r\n | project Type=\"TXT\",Value=data_TXT;\r\n union dns_A_data,dns_AAAA_data,dns_CERT_data,\r\ndns_CNAME_data,\r\ndns_HTTPS_data,\r\ndns_NS_data,\r\ndns_SOA_data,\r\ndns_MX_data,\r\ndns_SVCB_data,\r\ndns_TSIG_data,\r\ndns_TXT_data\r\n| where isnotempty( Value) or isnotempty( Reverse) or isnotempty( TTL)\r\n| sort by Type asc", "size": 0, "showAnalytics": true, "title": "Current DNS", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Type", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "host" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelisted", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_ptr_CL\r\n| where params_target == '{IOCValue}' and params_type == \"ip\" and params_source == \"ptr\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend ptr_record = column_ifexists(\"data_ptr_record\",\"\")\r\n| extend ptr_record = case( isempty(ptr_record), \"Not Found\",ptr_record)\r\n| project ptr_record", "size": 3, "title": "Domain Name Associated (PTR)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "ptr_record", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Found", "representation": "Unavailable", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "name": "query - 1", "styleSettings": { "maxWidth": "20" } } ] }, "customWidth": "0", "name": "group - 11", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_rpz_feeds_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"rpz_feeds\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (union isfuzzy = true dummy_table, dossier_rpz_feeds_records_CL) on $left.task_id == $right.task_id\r\n| extend \r\n class = column_ifexists(\"class\",\"\"),\r\n detected = column_ifexists(\"detected\",\"\"),\r\n expiration = column_ifexists(\"expiration\",\"\"),\r\n feed_name = column_ifexists(\"feed_name\",\"\"),\r\n property = column_ifexists(\"property\",\"\"),\r\n threat_level = column_ifexists(\"threat_level\", 0)\r\n| where isnotempty(class ) or isnotempty(detected ) or isnotempty(expiration ) or isnotempty(feed_name ) or isnotempty(property )\r\n|extend Severity = case( tolong(threat_level) >= 75, \"High\",tolong(threat_level) < 75 and tolong(threat_level) >= 50, \"Medium\",tolong(threat_level) < 50 and tolong(threat_level) >= 25,\"Low\",tolong(threat_level) <25 , \"Info\",\"\")\r\n| project\r\n ['Feed Name'] = feed_name,\r\n ['Threat Level'] = threat_level,\r\n Severity,\r\n Property = property,\r\n Class = class,\r\n Detected = detected,\r\n Expiration = expiration", "size": 3, "showAnalytics": true, "title": "Active Threat Feeds and Status (RPZ Feeds)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_geo_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"geo\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend\r\n asn_num = column_ifexists(\"data_asn_num\", \"\"),\r\n city = column_ifexists(\"data_city\", \"\"),\r\n country_code = column_ifexists(\"data_country_code\", \"\"),\r\n country_name = column_ifexists(\"data_country_name\", \"\"),\r\n isp = column_ifexists(\"data_isp\", \"\"),\r\n latitude = column_ifexists(\"data_latitude\", \"\"),\r\n longitude = column_ifexists(\"data_longitude\", \"\"),\r\n org = column_ifexists(\"data_org\", \"\"),\r\n postal_code = column_ifexists(\"data_postal_code\", \"\"),\r\n region = column_ifexists(\"data_region\", \"\")\r\n| where\r\n isnotempty(asn_num) or\r\n isnotempty(city) or\r\n isnotempty(country_code) or\r\n isnotempty(country_name) or\r\n isnotempty(isp) or\r\n isnotempty(latitude) or\r\n isnotempty(longitude) or\r\n isnotempty(org) or\r\n isnotempty(postal_code) or\r\n isnotempty(region) \r\n| project \r\n ['Asn Number'] = asn_num,\r\n City = city,\r\n ['Country Code'] = country_code,\r\n ['Country Name'] = country_name,\r\n Isp = isp,\r\n Latitude = latitude,\r\n Longitude = longitude,\r\n Org = org,\r\n ['Postal Code'] = postal_code,\r\n Region = region", "size": 3, "title": "Geo Graphic Details", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "60", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n IP = column_ifexists(\"ip\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n Threatlevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n IP,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = Threatlevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whois_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"ip\" and params_source == \"whois\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend \r\nCountry = column_ifexists(\"data_response_ip_response_country\",\"\"),\r\nHandle = column_ifexists(\"data_response_ip_response_handle\",\"\"),\r\nlast_changed = column_ifexists(\"data_response_ip_response_last_changed\",\"\"),\r\nName = column_ifexists(\"data_response_ip_response_name\",\"\"),\r\nnet_range = column_ifexists(\"data_response_ip_response_net_range\",\"\"),\r\nnet_type = column_ifexists(\"data_response_ip_response_net_type\",\"\"),\r\nParent = column_ifexists(\"data_response_ip_response_parent\",\"\"),\r\nRegistration = column_ifexists(\"data_response_ip_response_registration\",\"\"),\r\nsource_registery = column_ifexists(\"data_response_ip_response_source_registery\",\"\")\r\n| where\r\n isnotempty(Country) or\r\n isnotempty(Handle) or\r\n isnotempty(last_changed) or\r\n isnotempty(Name) or\r\n isnotempty(net_range) or\r\n isnotempty(net_type) or\r\n isnotempty(Parent) or\r\n isnotempty(Registration) or\r\n isnotempty(source_registery)\r\n| project \r\n Name,\r\n Country,\r\n Handle,\r\n ['Network Range'] = net_range,\r\n ['Network Type'] = net_type,\r\n Parent,\r\n ['Source Registery'] = source_registery,\r\n ['Last Changed'] = last_changed ,\r\n Registration", "size": 3, "title": "Registered Owner (WHOIS)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "ip" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_whitelist_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"whitelist\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_whitelisted = column_ifexists(\"data_whitelisted\",\"\")\r\n| where isnotempty(data_whitelisted)\r\n| project tostring(data_whitelisted)", "size": 3, "title": "Whitelist", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "data_whitelisted", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_infoblox_web_cat_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"infoblox_web_cat\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_results = column_ifexists(\"data_results\",\"\")\r\n| where isnotempty(data_results)\r\n| extend data_results = parse_json(data_results)\r\n| mv-expand data_results\r\n| project ['Web Category'] = data_results.name", "size": 3, "title": "Web Categories", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Web Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Uncategorized", "representation": "Normal", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Found", "representation": "Unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, "showBorder": true, "sortOrderField": 2, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "maxWidth": "80" } } ] }, "customWidth": "0", "name": "group - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_tld_risk_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"tld_risk\" \r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_matches = column_ifexists(\"data_matches\",\"\")\r\n| mv-expand todynamic(data_matches)\r\n| project data_matches\r\n| parse-kv data_matches as (confidence:string, popular:string, rare:string, score:string, score_label:string, tld:string) with (pair_delimiter=',', kv_delimiter=':',quote='\"')\r\n| where\r\n isnotempty(confidence) or\r\n isnotempty(popular) or\r\n isnotempty(rare) or\r\n isnotempty(score) or\r\n isnotempty(score_label) or\r\n isnotempty(tld)\r\n| project \r\n ['Score Label'] = score_label,\r\n Score = score,\r\n TLD = tld,\r\n Confidence = confidence,\r\n Popular = popular,\r\n Rare = rare\r\n\r\n", "size": 3, "title": "TLD Reputation", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Score Label", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High Risk", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "showBorder": false } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"url\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Url = column_ifexists(\"url\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Url,\r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "url" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_malware_analysis_v3_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"malware_analysis_v3\"| summarize arg_max(TimeGenerated,*) by params_target\r\n| extend data_info = column_ifexists(\"data_info\",\"\"), data_reason = column_ifexists(\"data_reason\",\"\"), Status = column_ifexists(\"status\",\"\")\r\n| where Status == \"error\"\r\n| project Information = data_info, Reason = data_reason", "size": 3, "title": "VirusTotal", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"hash\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Hash = column_ifexists(\"hash\",\"\"),\r\n HashType = column_ifexists(\"hash_type\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Hash,\r\n ['Hash Type'] = HashType,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "hash" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 5 - Copy - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "---" }, "name": "text - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"email\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend\r\n Property = column_ifexists(\"property\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\")\r\n| where todatetime(Expiration) >= now()\r\n| distinct ['Threat Property'] = Property", "size": 3, "title": "Threat Property", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Threat Property", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev1", "text": "{0}{1}" } ] } }, "showBorder": true, "size": "auto" } }, "customWidth": "0", "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 6" }, { "type": 1, "content": { "json": "---" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, params_source: string, params_target:string, params_type:string, task_id:string) [];\r\nunion isfuzzy=true dummy_table,\r\ndossier_atp_CL\r\n| where params_target == '{IOCValue}' and params_type ==\"email\" and params_source == \"atp\"\r\n| summarize arg_max(TimeGenerated,*) by params_target\r\n| join kind=inner (dossier_atp_threat_CL) on $left.task_id == $right.task_id\r\n| extend \r\n Email = column_ifexists(\"email\",\"\"),\r\n Host = column_ifexists(\"host\",\"\"),\r\n Domain = column_ifexists(\"domain\",\"\"),\r\n TLD = column_ifexists(\"tld\",\"\"),\r\n Profile = column_ifexists(\"profile\",\"\"),\r\n Property = column_ifexists(\"property\",\"\"),\r\n Class = column_ifexists(\"class\",\"\"),\r\n Confidence = column_ifexists(\"confidence\",\"\"),\r\n ThreatLevel = column_ifexists(\"threat_level\",\"\"),\r\n Detected = column_ifexists(\"detected\",\"\"),\r\n Received = column_ifexists(\"received\",\"\"),\r\n Imported = column_ifexists(\"imported\",\"\"),\r\n Expiration = column_ifexists(\"expiration\",\"\"),\r\n Up = column_ifexists(\"up\",\"\"),\r\n Dga = column_ifexists(\"dga\",\"\"),\r\n Notes = column_ifexists(\"extended_notes\",\"\")\r\n| project \r\n Email,\r\n Host,\r\n Domain,\r\n TLD,\r\n Profile,\r\n Property,\r\n Class,\r\n Confidence,\r\n ['Threat Level'] = ThreatLevel,\r\n Detected,\r\n Received,\r\n Imported,\r\n Expiration,\r\n Up,\r\n Dga,\r\n Notes", "size": 0, "showAnalytics": true, "title": "Threat Details (ATP)", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IOCType", "comparison": "isEqualTo", "value": "email" }, { "parameterName": "dossier_status", "comparison": "isEqualTo", "value": "Click here to view the data" } ], "name": "group - 6" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "3" }, "name": "group - 2", "styleSettings": { "padding": "10px" } } ], "fromTemplateId": "sentinel-Infoblox | Infoblox Lookup Workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }