{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **ApacheHTTPServer** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-apachehttpserver-parser)" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cd8447d9-b096-4673-92d8-2a1e8291a125", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "description": "Sets the time name for analysis", "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 900000 }, { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};", "size": 0, "title": "Events Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "graphSettings": { "type": 0 } }, "customWidth": "60", "name": "query - 12", "styleSettings": { "maxWidth": "55" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Total Http status code result\r\nApacheHTTPServer\r\n| where isnotempty( HttpStatusCode)\r\n| extend HttpStatus = case(\r\n HttpStatusCode startswith \"1\", \"Informational\", \r\n HttpStatusCode startswith \"2\", \"Success\", \r\n HttpStatusCode startswith \"3\", \"Redirect\",\r\n HttpStatusCode startswith \"4\", \"Client Error\",\r\n HttpStatusCode startswith \"5\", \"Server Error\",\r\n \"Unknown\")\r\n| summarize TotalHttpStatus = count() by HttpStatus", "size": 3, "title": "HTTP Status Codes", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "30", "name": "query - 0", "styleSettings": { "maxWidth": "30" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| where isnotempty( SrcIpAddr)\r\n| summarize dcount(SrcIpAddr) ", "size": 3, "title": "Unique IP Addresses", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| where HttpStatusCode >= 500 and HttpStatusCode <= 599 \r\n| count", "size": 3, "title": "Total Server Errors", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| where HttpStatusCode >= 400 and HttpStatusCode <= 499 \r\n| count", "size": 3, "title": "Total Client Errors", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 2" } ] }, "customWidth": "10", "name": "group - 9", "styleSettings": { "maxWidth": "100", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top IP requested\r\nApacheHTTPServer\r\n| summarize TotalRequests = count() by SrcIpAddr\r\n| project-rename SourceIP=SrcIpAddr\r\n| top 10 by TotalRequests desc ", "size": 3, "title": "Top 10 Sources", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "34", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top IP requested with server error\r\nApacheHTTPServer\r\n| where HttpStatusCode >= 500 and HttpStatusCode <600\r\n| summarize TotalEvents = count() by SrcIpAddr\r\n| project-rename SourceIP = SrcIpAddr\r\n| top 10 by TotalEvents desc ", "size": 3, "title": "Top Source IP addresses with server error", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 3", "styleSettings": { "margin": "10", "padding": "10" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top IP requested with client error\r\nApacheHTTPServer\r\n| where HttpStatusCode >= 400 and HttpStatusCode <500\r\n| summarize TotalEvents = count() by SrcIpAddr\r\n| project-rename SourceIP = SrcIpAddr\r\n| top 10 by SourceIP desc ", "size": 3, "title": "Top Source IP addresses with client error", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "TotalEvents", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TotalEvents", "sortOrder": 2 } ] }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top file requested\r\nApacheHTTPServer\r\n| extend File = extract(@\".*\\/([a-zA-Z0-9-._]*)\", 1, tostring(UrlOriginal))\r\n| where isnotempty(File)\r\n| summarize TotalEvents = count() by File\r\n| top 10 by TotalEvents desc", "size": 3, "title": "Top files requested", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| extend File = extract(@\".*\\/([a-zA-Z0-9-._]*)\", 1, tostring(UrlOriginal))\r\n| where isnotempty( File)\r\n| sort by TimeGenerated desc \r\n| project File, strcat(iff(HttpStatusCode startswith \"4\" or HttpStatusCode startswith \"5\", '❌', '✅')), HttpStatusCode\r\n| project-rename Result = Column1, FileName=File", "size": 0, "title": "Latest files accessed", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 50, "filter": true } }, "customWidth": "35", "name": "query - 12", "styleSettings": { "maxWidth": "33" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ApacheHTTPServer\r\n| where TimeGenerated > ago(40d)\r\n| where HttpStatusCode >= 400 and HttpStatusCode <= 599 \r\n| where UrlOriginal != '/'\r\n| summarize TotalEvents = count() by tostring(UrlOriginal)\r\n| top 10 by TotalEvents desc ", "size": 3, "title": "Top URLs with Error", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "35", "name": "query - 10", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Average_Body_Bytes = ApacheHTTPServer\r\n| summarize Avg_ByUrl = avg(tolong(HttpResponseBodyBytes))\r\n| extend K = 1;\r\nApacheHTTPServer\r\n| extend K = 1\r\n| join kind=inner Average_Body_Bytes on K\r\n| where HttpResponseBodyBytes > Avg_ByUrl*1.5\r\n| order by tolong(HttpResponseBodyBytes)\r\n| summarize RequestSize=max(tolong(HttpResponseBodyBytes)) by SrcIpAddr\r\n| project-rename SourceIP=SrcIpAddr\r\n", "size": 3, "title": "Top sources with large request size", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10 }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "SrcIpAddr", "formatter": 1 }, "centerContent": { "columnMatch": "LargeRequest", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "30", "name": "query - 7" } ], "fromTemplateId": "sentinel-ApacheHTTPServerWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }