{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Semperis Directory Services Protector\r\n\r\n**Semperis Directory Services Protector** (DSP) provides valuable insight into your Active Directory security posture. It queries your Active Directory environment and performs a set of tests against many aspects of Active Directory's security posture, including AD Delegation, Account security, AD Infrastructure security, Group Policy security, and Kerberos security.\r\n\r\nEach security indicator is mapped to MITRE ATT&CK® framework categories, explains what was evaluated, and indicates how likely an exposure will compromise Active Directory. \r\n\r\nEach IoE found highlights weak Active Directory configurations and provides actionable guidance on how to close gaps before they are exploited by attackers. Using this workbook, you can determine how you are doing from a security perspective, compared to best practice environments.\r\n\r\nIn case of security regressions, Semperis Directory Services Protector will trigger alerts through Microsoft Sentinel."
      },
      "name": "text - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "# Security Indicators mapped to MITRE ATT&CK® Framework Categories:"
      },
      "name": "text - 5"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "83787f1b-6573-47c6-8def-36bceb9a8afe",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "description": " Specify the time range on which to query the data",
            "isRequired": true,
            "value": {
              "durationMs": 1209600000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "d46aac4d-bcb8-4dbf-a331-3a3538226bc3",
            "version": "KqlParameterItem/1.0",
            "name": "MitreFramework",
            "label": "MITRE ATT&CK Framework",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "(dsp_parser\r\n| where isnotempty(SecurityFrameworkTags))\r\n| union (CommonSecurityLog\r\n| extend p1Array = split(AdditionalExtensions,\"|\")\r\n| mv-expand bagexpansion=array p1Array\r\n| evaluate bag_unpack(p1Array)\r\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\r\n| extend Value=replace_string(Value, \";\", \" \")\r\n| evaluate pivot(Name, any(Value), TimeGenerated, LogSeverity)\r\n| extend SecurityIndicatorName = column_ifexists('Name', '')\r\n| where isnotempty(SecurityIndicatorName)\r\n| extend SecurityFrameworkTags = column_ifexists('SecurityFrameworkTags', '')\r\n| extend SecurityFrameworkTagsCsv = replace(@' Mitre:', @'', tostring(SecurityFrameworkTags)))| mv-expand bagexpansion=array parse_csv(SecurityFrameworkTagsCsv) to typeof(string)\r\n| summarize Count = count() by SecurityFrameworkTagsCsv\r\n| order by Count desc, SecurityFrameworkTagsCsv asc\r\n| project Value = SecurityFrameworkTagsCsv, Label = strcat(SecurityFrameworkTagsCsv)",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "",
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          },
          {
            "id": "cf84c455-c1b9-4785-a592-54834be54097",
            "version": "KqlParameterItem/1.0",
            "name": "Status",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "(dsp_parser\r\n| where isnotempty(Result))\r\n| union (CommonSecurityLog | extend p1Array = split(AdditionalExtensions,\"|\")| mv-expand bagexpansion=array p1Array| evaluate bag_unpack(p1Array)| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)| evaluate pivot(Name, any(Value))| extend SecurityIndicatorName = column_ifexists('Name', '')| where isnotempty(SecurityIndicatorName)| extend Result = \"Attack detected\")| summarize Count = count() by tostring(Result)\r\n| order by Count desc, Result asc\r\n| project Value = Result, Label = strcat(Result)",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "(dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| extend Result = Result\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend Targets = iff(isempty(Targets), 'AD', Targets))\r\n| union \r\n(CommonSecurityLog \r\n| extend p1Array = split(AdditionalExtensions,\"|\")\r\n| mv-expand bagexpansion=array p1Array\r\n| evaluate bag_unpack(p1Array)\r\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\r\n| extend Value=replace_string(Value, \";\", \" \")\r\n| evaluate pivot(Name, any(Value), TimeGenerated, LogSeverity)\r\n| extend SecurityIndicatorName = column_ifexists('Name', '')\r\n| where isnotempty(SecurityIndicatorName)\r\n| extend Targets = \"AD\"\r\n| extend Severity = column_ifexists('LogSeverity', '')\r\n| extend Score = column_ifexists('PercentageScore', '0')\r\n| extend FirstFound = column_ifexists('Timestamp', '')\r\n| extend Result = \"Attack detected\"\r\n| extend SecurityFrameworkTags = column_ifexists('SecurityFrameworkTags', '')\r\n| extend SecurityFrameworkTagsCsv = replace(@' Mitre:', @'', tostring(SecurityFrameworkTags))\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)) \r\n| where Result in ({Status})\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityIndicatorName), tostring(Targets), tostring(Severity), tostring(Score), tostring(FirstFound), tostring(Result), tostring(SecurityFrameworkTags)\r\n| order by Count",
              "size": 0,
              "title": "Indicators Details:",
              "timeContextFromParameter": "TimeRange",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "sortBy": [
                  {
                    "itemKey": "Severity",
                    "sortOrder": 1
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "FirstFound",
                    "label": "Latest alert"
                  },
                  {
                    "columnId": "SecurityFrameworkTags",
                    "label": "Security framework tags"
                  },
                  {
                    "columnId": "SecurityIndicatorName",
                    "label": "Security Indicator"
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "Severity",
                  "sortOrder": 1
                }
              ],
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "securityIndicatorName",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "name": "query - 1",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Requests = count() by tostring(SecurityIndicatorName)\r\n| order by Requests\r\n",
              "size": 3,
              "title": "Breakdown by Indicators of Exposure (IoEs)",
              "noDataMessageStyle": 4,
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "SecurityIndicatorName",
                  "formatter": 1
                },
                "subtitleContent": {
                  "columnMatch": "Requests",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false,
                "size": "auto"
              },
              "chartSettings": {
                "group": "securityIndicatorName",
                "createOtherGroup": 10,
                "showMetrics": false
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "Requests",
                "sizeAggregation": "Sum",
                "legendMetric": "Requests",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "Requests",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "name": "query - 2",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| mv-expand bagexpansion=array SecurityFrameworkTagList to typeof(string)\r\n| where SecurityFrameworkTagList in ({MitreFramework})\r\n| summarize event_count=count() by SecurityFrameworkTagList\r\n",
        "size": 0,
        "title": "Amount of Generated Events per Category",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "securityFrameworkTags",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "event_count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "event_count",
          "sizeAggregation": "Sum",
          "legendMetric": "event_count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "event_count",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "name": "query - 5",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityIndicatorName)\r\n| top 10 by Count desc",
              "size": 3,
              "title": "Top 10 Indicators of Exposure (IoEs)",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "group": "SecurityIndicatorName",
                "createOtherGroup": 10,
                "showMetrics": false,
                "showLegend": true,
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": false
                    }
                  }
                }
              }
            },
            "customWidth": "40",
            "name": "query - 4",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityFrameworkTags), tostring(SecurityIndicatorName), tostring(Remediation)\r\n| top 10 by Count desc\r\n| project-away Count",
              "size": 0,
              "title": "Top 10 Indicators of Exposure (IoEs) Details:",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table"
            },
            "customWidth": "60",
            "name": "query - 1",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 5",
      "styleSettings": {
        "showBorder": true
      }
    }
  ],
  "fromTemplateId": "sentinel-SemperisDSPSecurityIndicators",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}