{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# My Company" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "df9ebd46-967c-445f-9328-d3538237ba3b", "version": "KqlParameterItem/1.0", "name": "company", "label": "Company Name", "type": 2, "isRequired": true, "query": "BitSightCompanyDetails\r\n| distinct Name", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "Kati Communications, Inc." } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ae71f2b2-2245-4937-827e-20960f9ae3b8", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let latest_Rating = toscalar(BitSightGraphData\r\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\r\n| distinct CompanyName, RatingDate, Rating\r\n| summarize High = max(Rating), Low = min(Rating), any(RatingDate, Rating)\r\n| order by any_RatingDate desc\r\n| project strcat_delim(\"-\",any_Rating, High, Low)\r\n| limit 1);\r\nBitSightCompanyDetails\r\n| where Name == '{company}'\r\n| sort by TimeGenerated\r\n| extend LatestRating = toint(todecimal(split(latest_Rating, \"-\")[0])), High = toint(todecimal(split(latest_Rating, \"-\")[1])), Low = toint(todecimal(split(latest_Rating, \"-\")[2]))\r\n| project-rename Name = Name, Subscription = SubscriptionType , Industry = Industry, [\"Customer Monitoring Count\"] = CustomerMonitoringCount, [\"Latest Rating\"] = LatestRating\r\n| project Name, [\"Latest Rating\"], High, Low, Industry, [\"Customer Monitoring Count\"]\r\n| limit 1", "size": 4, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3", "styleSettings": { "margin": "0px", "padding": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightGraphData\r\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\r\n| distinct CompanyName, RatingDate, Rating\r\n| project CompanyName, RatingDate, Rating\r\n| order by RatingDate asc", "size": 0, "aggregation": 4, "title": "Security Ratings Over Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "xAxis": "RatingDate", "group": null, "createOtherGroup": 0, "showDataPoints": true, "ySettings": { "min": 300, "max": 850 } } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\r\n| summarize count() by RiskVectorLabel\r\n| order by count_ desc", "size": 0, "title": "Count of Observations by Risk Vector", "exportFieldName": "x", "exportParameterName": "SelectedRiskVectorLabel", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "RiskVectorLabel", "createOtherGroup": 0, "showLegend": true } }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\r\n| where RiskVectorLabel == '{SelectedRiskVectorLabel}'\r\n| project-away EventVendor, EventProduct", "size": 0, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "sortBy": [ { "itemKey": "RemediationHistoryLastRefreshStatusDate", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "RemediationHistoryLastRefreshStatusDate", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "SelectedRiskVectorLabel", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 16", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \"Compromised Systems\"\r\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\r\n| summarize count() by RiskVectorLabel,Date\r\n| project Date, count_, RiskVectorLabel\r\n| order by Date asc\r\n", "size": 0, "aggregation": 4, "title": "Compromised Systems by Risk Vector Over Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "Date", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Date", "yAxis": [ "count_" ], "group": "RiskVectorLabel", "createOtherGroup": null, "showDataPoints": true } }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \"User Behavior\"\r\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\r\n| summarize count() by RiskVectorLabel,Date\r\n| project Date, count_, RiskVectorLabel\r\n| order by Date asc\r\n", "size": 0, "aggregation": 4, "title": "User Behavior by Risk Vector Over Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "xAxis": "Date", "yAxis": [ "count_" ], "group": "RiskVectorLabel", "createOtherGroup": null } }, "name": "query - 15" }, { "type": 1, "content": { "json": "##### Diligence by Risk Vector Over Time" }, "name": "text - 13" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4d26ba1c-db98-437a-9a0c-63126f341afb", "version": "KqlParameterItem/1.0", "name": "Risk_Vector", "label": "Risk Vector", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \"Diligence\"\r\n| distinct RiskVectorLabel\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \"Diligence\" and ('*' in ({Risk_Vector}) or RiskVectorLabel in ({Risk_Vector}))\r\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\r\n| summarize count() by RiskVectorLabel,Date\r\n| project Date, count_, RiskVectorLabel\r\n| order by Date asc\r\n", "size": 0, "aggregation": 4, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Date", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Date", "yAxis": [ "count_" ], "group": "RiskVectorLabel", "createOtherGroup": 0, "showDataPoints": true } }, "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightDiligenceHistoricalStatistics\r\n| where todatetime(Date) {Timer} and CompanyName == '{company}'\r\n| extend yyyy_mm = format_datetime(todatetime(Date), 'yyyy-MM')\r\n| summarize round(avg(Count),2) by yyyy_mm, Category\r\n| project Category, avg_Count, yyyy_mm = strcat(yyyy_mm,\" (Avg)\")\r\n| order by yyyy_mm asc, Category asc\r\n| limit 15", "size": 0, "aggregation": 4, "title": "Diligence Observations by Severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "sortBy": [], "chartSettings": { "xAxis": "yyyy_mm", "yAxis": [ "avg_Count" ], "group": "Category", "createOtherGroup": null } }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsData\r\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \"Compromised Systems\" and RiskVectorLabel == \"Botnet Infections\"\r\n| extend d=parse_json(Details) \r\n| mv-expand asset = todynamic(Assets)\r\n| project Infection = dynamic_to_json(d[0].infection.family), [\"Detection Method\"] = dynamic_to_json(d[0].detection_method), [\"Last Seen\"] = column_ifexists(\"LastSeen\",\"\"), Asset = dynamic_to_json(asset.asset)\r\n| distinct Infection, [\"Detection Method\"], Asset, [\"Last Seen\"]\r\n| order by [\"Last Seen\"] desc", "size": 0, "title": "Infections", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "##### Vulnerabilities" }, "name": "text - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c7ff4374-c346-4c43-9354-8936687c2704", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BitSightFindingsSummary\r\n| where todatetime(StartDate) {Timer} and Company == '{company}'\r\n| extend Filter = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \"Minor\", \r\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \"Moderate\",\r\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \"Material\",\r\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \"Severe\",\r\n \"\")\r\n| distinct Filter", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BitSightFindingsSummary\r\n| where todatetime(StartDate) {Timer} and Company == '{company}'\r\n| distinct Name, Severity, StartDate, EndDate, Description\r\n| extend [\"Severity Details\"] = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \"Minor\", \r\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \"Moderate\",\r\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \"Material\",\r\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \"Severe\",\r\n \"\")\r\n| where ('*' in ({Severity}) or [\"Severity Details\"] in ({Severity}))\r\n| project-rename Name = Name, [\"Start Date\"] = StartDate, [\"End Date\"] = EndDate\r\n| project Name, [\"Severity Details\"], [\"Start Date\"], [\"End Date\"], Description\r\n", "size": 0, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 9", "styleSettings": { "showBorder": true } } ] }, "name": "My Company" } ] }, "name": "Main", "styleSettings": { "showBorder": true } } ], "fromTemplateId": "sentinel-BitSightWorkbook", "fallbackResourceIds": [], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }