{ "version": "Notebook/1.0", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let day_names =dynamic([\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"]);\nlet averageData = view() { CommonSecurityLog \n| extend p1Array = split(AdditionalExtensions,\";\")\n| mv-expand bagexpansion=array p1Array\n| evaluate bag_unpack(p1Array)\n| extend Name=column_ifexists(tostring('@Name'), ''), Value=column_ifexists('#text', '')\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\n| where TimeGenerated > datetime(2000-01-01)\n| where isnotnull(OriginatingUsers) and OriginatingUsers != \"\"\n| summarize Count=count() by Year=getyear(TimeGenerated), Month=monthofyear(TimeGenerated), Day=dayofmonth(TimeGenerated)\n| summarize Average_Count=toint(avg(Count)) by Day=dayofweek(make_datetime(Year,Month,Day)), SortData=\"Average Daily Change\"\n| order by Day asc};\nlet weeklyData = view() { CommonSecurityLog \n| extend p1Array = split(AdditionalExtensions,\";\")\n| mv-expand bagexpansion=array p1Array\n| evaluate bag_unpack(p1Array)\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\n| where TimeGenerated > startofweek(now())\n| where isnotnull(OriginatingUsers) and OriginatingUsers != \"\"\n| summarize Count=count() by Year=getyear(TimeGenerated), Month=monthofyear(TimeGenerated), Day=dayofmonth(TimeGenerated)\n| summarize Average_Count=toint(avg(Count)) by Day=dayofweek(make_datetime(Year,Month,Day)), SortData=\"Daily Change\"\n| order by Day asc };\nunion withsource=TableName averageData,weeklyData\n| order by Day asc, SortData asc\n| project Average_Count,Day,TableName,SortData,Days=tostring(day_names[indexof('00010203040506', format_timespan(Day,'dd'))/2])\n| render barchart with (kind=unstacked)\n\n", "size": 0, "title": "Weekly Active Directory Change Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "xAxis": "Days", "seriesLabelSettings": [ { "seriesName": "averageData", "label": "Average Daily Change", "color": "gray" }, { "seriesName": "weeklyData", "label": "Daily Change", "color": "orange" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Average_Count", "sizeAggregation": "Sum", "legendMetric": "Average_Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Average_Count", "heatmapPalette": "greenRed" } } }, "customWidth": "100", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == 'Semperis-Operation-Log' and EventID == 20000\n| sort by TimeGenerated desc \n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists('@Name', ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend details = column_ifexists('details', '')\n| parse details with * \"Trustee Name: \" TrusteeName \" Correlation ID: \" * \" Source: \" HostIP \":\" * \" Target\" *\n| extend host = tostring(HostIP)\n| project TimeGenerated, TrusteeName, HostIP\n| order by TimeGenerated desc\n| top 10 by TimeGenerated", "size": 1, "title": "Successful Logons", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time Generated" } ] } }, "customWidth": "55", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == 'Semperis-Operation-Log' and ( EventID == 20000 or EventID == 20002 )\n| sort by TimeGenerated desc \n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists('@Name', ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend details = column_ifexists('details', ''), accessGrated = column_ifexists('accessGrated', '')\n| parse details with * \"Trustee Name: \" TrusteeName \" Correlation ID: \" * \" Source: \" HostIP \":\" * \" Target\" *\n| extend host = tostring(HostIP)\n| where isnotempty(accessGrated)\n| summarize Count=count() by accessGrated\n", "size": 1, "title": "DSP Logins", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": " TRUE ", "color": "green" }, { "seriesName": " FALSE ", "color": "redBright" }, { "color": "red" } ] } }, "customWidth": "45", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(SecurityEvent\r\n| where EventSourceName == 'Semperis-DSP-Notifications' \r\n| extend p1Xml = parse_xml(EventData).EventData.Data\r\n| mv-expand bagexpansion=array p1Xml\r\n| evaluate bag_unpack(p1Xml)\r\n| extend Name=column_ifexists(tostring('@Name'), ''), columnValue=column_ifexists('#text', '')\r\n| evaluate pivot(Name, any(columnValue), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\r\n| extend RuleName=tostring(column_ifexists('ruleName', '')), Severity=tostring(column_ifexists('severity', '')), DataSource=tostring(column_ifexists('dataSource', '')), ObjectDN=tostring(column_ifexists('objectDN', '')), TimeCreated=tostring(column_ifexists('timeCreated', '')), Operation=tostring(column_ifexists('fullOperation', '')), Attribute=tostring(column_ifexists('attributeName', '')), Value=tostring(column_ifexists('attributeValue', '')), ChangedBy=tostring(column_ifexists('changedBy', '')), Source=tostring(column_ifexists('Computer', '')))\r\n| union\r\n(CommonSecurityLog \r\n| extend Activity=column_ifexists('Activity', ''), DeviceProduct=column_ifexists('DeviceProduct', '')\r\n| where DeviceProduct == 'Core Directory'\r\n| where Activity == 'rule-alert'\r\n| extend p1Array = split(AdditionalExtensions,\"|\")\r\n| mv-expand bagexpansion=array p1Array\r\n| evaluate bag_unpack(p1Array)\r\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\r\n| extend Value=replace_string(Value, \";\", \" \")\r\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\r\n| extend RuleName=column_ifexists('ruleName', ''), Severity=column_ifexists('severity', ''), DataSource=column_ifexists('dataSources', ''), ObjectDN=column_ifexists('subjectId', ''), TimeCreated=column_ifexists('alertCreated', ''), Operation=column_ifexists('operation', ''), Attribute=column_ifexists('attribute', ''), Value=column_ifexists('value', ''), ChangedBy=column_ifexists('changedBy', ''), Source=column_ifexists('alertSource', '')\r\n| extend Severity = case(toint(Severity) == 1 or toint(Severity) == 2, \"Informational\", toint(Severity)==3 or toint(Severity)==4, \"Low\", toint(Severity)==5 or toint(Severity)==6, \"Medium\", toint(Severity)==7 or toint(Severity)==8, \"High\", toint(Severity)==9 or toint(Severity)==10, \"Critical\", \"\"))\r\n| order by TimeGenerated desc\r\n| project RuleName, Severity, Operation, Attribute, Value, ChangedBy, Source\r\n", "size": 0, "title": "Notifications", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "labelSettings": [ { "columnId": "RuleName", "label": "Rule Name" }, { "columnId": "ChangedBy", "label": "Changed By" } ] } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == 'Semperis-Operation-Log' and EventID == 20012\n| sort by TimeGenerated desc\n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists(tostring('@Name'), ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend details=column_ifexists(tostring('details'), '')\n| parse details with \"Occured at (UTC): \" OccurredAt \"Session ID: \" SessionID \"Trustee Name: \" TrusteeName \"Correlation ID: \" CorrelationID \"Source: \" Source \"WebSite Target: \" WebSiteTarget \"Product: \" Product \"Component: \" Component \"AD Information: \" ADInformation \"Object GUID: \" ObjectGUID \"Attribute: \" Attribute \"Distinguished Name: \" DistinguishedName \"Additional Information: \"AdditionalInformation \"Operation Detail: \" OperationDetail \"operationName: \" operationName \"trustee: \" trustee \"personas: \" personas \"Status: \" status \"Granted: \" Granted \"Result: \" Result\n| where isnotempty(operationName)\n| extend _AccessGranted = iif(operationName contains \"CreateRbacIdentity\", \"Added\", \"Removed\")\n| extend _Identity = iif(operationName contains \"CreateRbacIdentity\", trustee, tostring(substring(trustee,1,strlen(trustee))))\n| extend _Identity = iif(operationName contains \"CreateRbacIdentity\", _Identity, replace_string(_Identity,\"'\",\"\"))\n| extend add_personas = replace_string(replace_string(replace_string(personas,\"{ Name = \",\"\"),\" }\",\"\"),\";\",\",\")\n| extend remove_personas = replace_string(personas,\";\",\",\")\n| extend grid_personas = iif(operationName contains \"CreateRbacIdentity\", add_personas, remove_personas)\n| extend date_to_sort = format_datetime(TimeGenerated,\"yyyy-mm-dd HH:mm:ss\")\n| order by date_to_sort desc\n| project TrusteeName, _Identity, _AccessGranted, grid_personas, TimeGenerated\n\n\n", "size": 1, "title": "Role Based Access Control Changes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TrusteeName", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "TrusteeName", "label": "Changed By" }, { "columnId": "_Identity", "label": "Identity" }, { "columnId": "_AccessGranted", "label": "Access Granted" }, { "columnId": "TimeGenerated", "label": "Timestamp" } ] }, "sortBy": [ { "itemKey": "TrusteeName", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| extend p1Array = split(AdditionalExtensions,\";\")\n| mv-expand bagexpansion=array p1Array\n| evaluate bag_unpack(p1Array)\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity)\n| where isnotnull(OriginatingUsers) and OriginatingUsers != \"\"\n| summarize ChangedCount = count() by tostring(OriginatingUsers)\n| project replace_string(OriginatingUsers,'\\\\\\\\','/'), ChangedCount, OriginatingUsers, \"Details\"\n| order by ChangedCount desc\n| top 5 by ChangedCount", "size": 1, "title": "Top 5 Identities Making Changes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "OriginatingUsers", "formatter": 5 }, { "columnMatch": "Column2", "formatter": 1, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "workbook", "passSpecificParams": true, "templateParameters": [ { "name": "OriginatingUsers", "source": "column", "value": "Column1" } ] } } }, { "columnMatch": "ParentId", "formatter": 5 }, { "columnMatch": "Id", "formatter": 5 }, { "columnMatch": "Originating Identity", "formatter": 1 }, { "columnMatch": "Group", "formatter": 1 } ], "labelSettings": [ { "columnId": "Column1", "label": "Originating Identity" }, { "columnId": "ChangedCount", "label": "Number of Changes" }, { "columnId": "Column2", "label": " " } ] } }, "customWidth": "35", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| extend p1Array = split(AdditionalExtensions,\";\")\n| mv-expand bagexpansion=array p1Array\n| evaluate bag_unpack(p1Array)\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\n| extend DistinguishedName = column_ifexists('DistinguishedName', '')\n| where isnotempty(DistinguishedName)\n| parse DistinguishedName with * \"CN=\" cnName \",\" *\n| parse DistinguishedName with * \"DC=\" dcName \",\" *\n| where ClassName != \"dnsNode\"\n| summarize ChangedCount=count() by cnName\n| project cnName, ChangedCount, \"Details\"\n| order by ChangedCount desc\n| top 5 by ChangedCount\n", "size": 3, "title": "Top 5 Objects Changed", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Column1", "formatter": 1, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "cName", "source": "column", "value": "cnName" } ] } } } ], "labelSettings": [ { "columnId": "cnName", "label": "Object Changed" } ] } }, "customWidth": "35", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == 'Semperis-DSP-Notifications' \n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Key1=tostring(column_ifexists('@Name', '')), Value=column_ifexists('#text', '')\n| evaluate pivot(Key1, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend fullOperation=column_ifexists('fullOperation', '')\n| summarize Count=count() by tostring(fullOperation)\n\n", "size": 1, "title": "AD Change Types", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "sortBy": [ { "itemKey": "fullOperation", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "fullOperation", "label": "Activity" } ] }, "sortBy": [ { "itemKey": "fullOperation", "sortOrder": 1 } ] }, "customWidth": "30", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| extend p1Array = split(AdditionalExtensions,\";\")\n| mv-expand bagexpansion=array p1Array\n| evaluate bag_unpack(p1Array)\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\n| parse DistinguishedName with * \"CN\\\\=\" cnName \",\" *\n| parse DistinguishedName with * \"DC\\\\=\" dcName \",\" *\n| where ClassName == 'group'\n| project AttributeModificationType,cnName,OriginatingTime,replace_string(OriginatingUsers,\"\\\\\\\\\",\"\\\\\"),StringValueFrom,StringValueTo\n", "size": 0, "title": "Builtin Group Changes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Column1", "formatter": 1, "formatOptions": { "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "cName", "source": "column", "value": "cnName" } ] } } } ], "rowLimit": 10000, "labelSettings": [ { "columnId": "AttributeModificationType", "label": "Attribute Modification Type" }, { "columnId": "cnName", "label": "Object Changed" }, { "columnId": "OriginatingTime", "label": "Originating Time" }, { "columnId": "StringValueFrom", "label": "Value From" }, { "columnId": "StringValueTo", "label": "Value To" } ] } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == \"Semperis-DSP-Security\"\n| where EventID in (\"9211\", \"9212\", \"9208\")\n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists(tostring('@Name'), ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend result=column_ifexists(tostring('result'), ''), numberOfResults=column_ifexists(tostring('numberOfResults'), ''), securityIndicatorName=column_ifexists(tostring('securityIndicatorName'), '')\n| extend isProblem = iif(result == \"Failed\", true, false)\n| where isnotnull(numberOfResults) and isProblem == true\n| order by tostring(securityIndicatorName)\n| summarize Count=count() by tostring(securityIndicatorName)\n| top 5 by Count\n\n", "size": 1, "title": "Top 5 Failed Security Indicators", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "rowLimit": 10000 }, "chartSettings": { "yAxis": [ "Count" ], "showLegend": true } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\n| where EventSourceName == \"Semperis-DSP-Security\"\n| where EventID in (\"9211\", \"9212\", \"9208\")\n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists(tostring('@Name'), ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend result=column_ifexists(tostring('result'), ''), numberOfResults=column_ifexists(tostring('numberOfResults'), ''), securityFrameworkTags=column_ifexists(tostring('securityFrameworkTags'), '')\n| extend isProblem = iif(result == \"Failed\", true, false)\n| where isnotnull(numberOfResults) and isProblem == true\n| summarize Count=count() by tostring(securityFrameworkTags)\n\n", "size": 0, "title": "Amount of Generated Events per Category", "timeContext": { "durationMs": 14400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "rowLimit": 10000 }, "chartSettings": { "yAxis": [ "Count" ], "showLegend": true } }, "name": "query - 2" } ], "styleSettings": { "paddingStyle": "wide", "spacingStyle": "wide" }, "fromTemplateId": "sentinel-SemperisDSPQuickviewDashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }