{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## VMware SD-WAN and SASE SOC Dashboard\n---\n\nThis Dashboard provides valuable insights into the security operations center (SOC) by tracking key metrics and threat data from VMware SD-WAN and SASE solutions. This information can be used to monitor the SOC's efficiency and ensure that all security operations (detection, analysis, and response) are proceeding as planned. The workbook also provides insights into emerging threats and trends, which can be used to proactively improve the organization's security posture." }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 1. Sentinel Connectivity Overview\n\nThis section shows connectivity from VMware SD-WAN and SASE services to Sentinel. The key deliverables are the following:\n1. Syslog - AMA Agent connecitivity (heartbeat), volume of logs imported from AMA Agents\n2. API calls - Function app activity, DCR/DCE activity" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(Heartbeat | summarize min(TimeGenerated));\nlet max_t = toscalar(Heartbeat | summarize max(TimeGenerated));\nHeartbeat\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h by Computer\n| render timechart with(title=\"Heartbeat response from AMA agents\")", "size": 1, "aggregation": 1, "title": "Heartbeat response from AMA agents", "color": "purpleDark", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Heartbeat Activity", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(Syslog | summarize min(TimeGenerated));\nlet max_t = toscalar(Syslog | summarize max(TimeGenerated));\nSyslog\n| where CollectorHostName != \"\"\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h by CollectorHostName\n| render areachart with(title=\"Syslog upload from AMA agents\")", "size": 1, "title": "Syslog upload from AMA agents", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Syslog Activity", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(Syslog | summarize min(TimeGenerated));\nlet max_t = toscalar(Syslog | summarize max(TimeGenerated));\nSyslog\n| where CollectorHostName != \"\"\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h by HostName\n| render timechart with(title=\"Syslog message ingestion by Edge Appliance\")", "size": 1, "title": "Syslog message ingestion by Edge Appliance", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "tileSettings": { "showBorder": false } }, "customWidth": "50", "name": "Syslog ingestion by Edge", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_CWS_Weblogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_CWS_Weblogs_CL | summarize max(TimeGenerated));\nVMware_CWS_Weblogs_CL\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h\n| render areachart with(title=\"Cloud Web Security Log ingestion\")", "size": 1, "title": "Cloud Web Security Log ingestion", "color": "greenDark", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "CWS Event Ingestion by API", "styleSettings": { "showBorder": true } } ] }, "name": "VMware SASE - Sentinel Connectivity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 2. VMware Cloud Web Security Overview\n\nVMware Cloud Web Security is a cloud-hosted service that protects users and infrastructure accessing SaaS and Internet applications from threats, offering visibility, control, and compliance. It is delivered through a global network of VMware SASE Points of Presence (PoPs) to ensure optimal access to applications." }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Health_CL\n| render timechart", "size": 0, "aggregation": 3, "title": "Cloud Web Security - Solution Health", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "healthtest_observed_value" ], "seriesLabelSettings": [ { "seriesName": "cwsManager_responseTime", "label": "CWS Manager Response Time", "color": "amethyst" }, { "seriesName": "vni_responseTime", "label": "VNI Response Time", "color": "blueDark" }, { "seriesName": "database_responseTime", "label": "CWS DB Response Time", "color": "green" }, { "seriesName": "database_connection", "label": "CWS DB Query Time", "color": "magenta" } ], "ySettings": { "numberFormatSettings": { "unit": 23, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "CWS Health metrics", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_CWS_Weblogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_CWS_Weblogs_CL | summarize max(TimeGenerated));\nVMware_CWS_Weblogs_CL\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h by action\n| render areachart with(title=\"Cloud Web Security events by Action\")", "size": 0, "title": "Cloud Web Security events by Action", "color": "blueDark", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "allow", "label": "Allow", "color": "grayBlue" }, { "seriesName": "block", "label": "Block", "color": "orangeDark" }, { "seriesName": "sslbump_bypass", "label": "SSL Inspection Bypass", "color": "magenta" } ] } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_CWS_Weblogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_CWS_Weblogs_CL | summarize max(TimeGenerated));\nVMware_CWS_Weblogs_CL\n| make-series num=count() default=0 on TimeGenerated from min_t to max_t step 1h by userAgent\n| render areachart with(title=\"Access activity by user agents\")", "size": 0, "title": "Connectivity Events by Agents", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Connectivity by Agent type" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| summarize hitcount = count() by region\n| sort by hitcount\n| render barchart with(title=\"Cloud Web Security SASE POP Utilization\")", "size": 0, "title": "CWS -SASE POP Utilization", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "DE", "color": "grayBlue" }, { "seriesName": "US", "color": "blue" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "CWS -SASE POP Utilization" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| summarize siterisk = count() by webRiskScore\n| sort by siterisk\n| render piechart with(title=\"Cloud Web Security Website Risks\")", "size": 0, "title": "URLF - Website Risk scores", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "G", "label": "Green/Low Risk", "color": "green" }, { "seriesName": "Y", "label": "Yellow/Medium Risk", "color": "yellow" }, { "seriesName": "R", "label": "Red/High Risk", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "CWS Website Categories - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where threatTypes != \"\"\n| summarize hitcount = count() by tostring(threatTypes)", "size": 0, "title": "URLF - Risk Categories", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "labelSettings": [ { "columnId": "threatTypes", "label": "Threat Type" }, { "columnId": "hitcount", "label": "Hit Count" } ] } }, "customWidth": "25", "name": "Risk Category Overview" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where threatTypes != \"\"\n| summarize hitcount = count() by sourceIp", "size": 0, "title": "URLF - Risky website access request by Client IP", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "labelSettings": [ { "columnId": "sourceIp", "label": "Source IP", "comment": "Internal Source IP of the CWS client" }, { "columnId": "hitcount", "label": "Hit Count" } ] } }, "customWidth": "25", "name": "URLF - Risky website access request by Client IP" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| summarize hitcount = count() by categories\n| sort by hitcount\n| render piechart with(title=\"Cloud Web Security Website categories\")", "size": 0, "title": "URLF - Website Categories", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "URLF - Website Categories" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| summarize destCountry = count() by dstCountry\n| sort by destCountry\n| render piechart with(title=\"Cloud Web Security Destination Countries\")", "size": 0, "title": "URLF - Destination Countries", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "DE", "color": "grayBlue" }, { "seriesName": "US", "color": "blue" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "CWS Destination Countries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| where categories == \"Uncategorized\"\n| summarize hitcount = count() by domain\n| sort by hitcount", "size": 0, "title": "URLF - Uncategorized Domains", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "domain", "formatter": 1 }, "leftContent": { "columnMatch": "uncat_domain", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "25", "name": "URLF - Uncategorized Domains" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where casbAppName != \"\"\n| summarize hitcount = count() by tostring(casbAppName)\n| sort by hitcount\n| render areachart with(title=\"CASB - SaaS Application Overview\")", "size": 0, "title": "CASB.- SaaS Application Overview", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "CASB.- SaaS Application Overview" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where casbAppName != \"\"\n| summarize riskScore = max(tolong(casbRiskScore)) by tostring(casbAppName)\n| sort by riskScore\n| render areachart with(title=\"CASB - SaaS Applications by Risk\")", "size": 0, "title": "CASB - SaaS Applications by Risk", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "customThresholdLine": "3", "customThresholdLineStyle": 1 } }, "customWidth": "50", "name": "CASB - SaaS Applications by Risk" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL\n| where fileScanResult != \"\"\n| summarize hitcount = count() by tostring(fileScanResult)\n| render piechart with(title=\"Content Inspection - File disposition\")", "size": 0, "title": "Content Inspection - File Disposition", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Clean", "color": "purple" } ] } }, "customWidth": "25", "name": "CI - File disposition" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where action == \"block\"\n| summarize hitcount = count() by userId\n| sort by hitcount\n| render piechart with(title=\"Users with CWS Policy Violations\")", "size": 0, "title": "Policy Violation by User ID (E-Mail)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "labelSettings": [ { "columnId": "hitcount", "label": "Hit Count" } ] } }, "customWidth": "25", "name": "CWS - Policy Violation by User ID (E-Mail)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_CWS_Weblogs_CL \n| where action == \"block\"\n| extend cRulePolicy = strcat(ruleMatched, \" / \", policyName)\n| summarize hitcount = count() by cRulePolicy\n| sort by hitcount\n| render piechart with(title=\"Cloud Web Security Policy Health\")", "size": 0, "title": "Connections blocked by Rule/Policy", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "Connections blocked by Rule/Policy" } ] }, "name": "VMware CWS Security" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 3. VMware SD-WAN Security Dashboard\n\nThis section details key security KPI information for the VMware SD-WAN Platform. Information can be collected from the Edge appliances via Syslog or from the VMware Edge Cloud Orchestrator (VECO) platform via API.\n\nThis group is split into three sections:\n\t1. Edge Firewall Telemetry (Flood Protection & Enhanced Firewall Services)\n\t2. Edge Health (Congestion, Non-SDWAN Destination or Cloud Security Service Health)\n\t3. SD-WAN Audit" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## 3A. Edge Firewall Telemetry" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| summarize categorycount = count() by IdpsAlertCategory\n| sort by categorycount\n| render piechart", "size": 0, "title": "Edge Firewall - IDS/IPS Alert Categories", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "Edge Firewall - IDS/IPS Alert Categories" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| make-series kind=nonempty countevent=count(TimeGenerated) default=0 on TimeGenerated step 1h by EdgeName\n| render timechart", "size": 0, "title": "Edge Firewall - IDS/IPS Events over time by Edge", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "xSettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "60", "name": "Edge Firewall - IDS/IPS Events By Edge" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| summarize signaturecount = count() by IdpsSignatureName\n| sort by signaturecount\n| render piechart", "size": 0, "title": "Edge Firewall - IDS/IPS Signature Match", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "35", "name": "Edge Firewall - IDS/IPS Signature Hits", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| summarize attackercount = count() by AttackerIp\n| sort by attackercount\n| render barchart", "size": 0, "title": "Edge Firewall - IDS/IPS Attackers", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "35", "name": "Edge Firewall - Attackers", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| summarize victimcount = count() by VictimIp\n| sort by victimcount\n| render barchart", "size": 0, "title": "Edge Firewall - IDS/IPS Victims", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "Edge Firewall - Victims", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(Syslog | summarize min(TimeGenerated));\nlet max_t = toscalar(Syslog | summarize max(TimeGenerated));\nSyslog\n| where CollectorHostName != \"\"\n| where SyslogMessage contains \"ACTION=VCF \"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend EdgeFwAction = case(SyslogMessage contains \"VCF Open\", \"Session Open\", SyslogMessage contains \"VCF Close\", \"Session Close\", SyslogMessage contains \"VCF Drop\", \"Session Drop\", SyslogMessage contains \"VCF Alert\", \"IDS/IPS Signature Match\", SyslogMessage contains \"VCF Deny\", \"Session Denied\", SyslogMessage contains \"VCF Update\", \"Session Refresh\", \"Unmapped Message\")\n| make-series FwEventCount=count(TimeGenerated) on TimeGenerated from min_t to max_t step 1h by EdgeFwAction\n| render timechart", "size": 0, "title": "Edge Firewall - Events over Time by Category", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Session Open", "color": "green" }, { "seriesName": "Session Close", "color": "greenDark" }, { "seriesName": "Session Drop", "color": "orange" }, { "seriesName": "Session Refresh", "color": "greenDarkDark" }, { "seriesName": "IDS/IPS Signature Match", "color": "redBright" }, { "seriesName": "Session Denied", "color": "red" } ], "xSettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "65", "name": "Edge Firewall - Events over Time by Category", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\n| where CollectorHostName != \"\"\n| where SyslogMessage contains \"ACTION=VCF \"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend EdgeFwAction = case(SyslogMessage contains \"VCF Open\", \"Session Open\", SyslogMessage contains \"VCF Close\", \"Session Close\", SyslogMessage contains \"VCF Drop\", \"Session Drop\", SyslogMessage contains \"VCF Alert\", \"IDS/IPS Signature Match\", SyslogMessage contains \"VCF Deny\", \"Session Denied\", SyslogMessage contains \"VCF Update\", \"Session Refresh\", \"Unmapped Message\")\n| where EdgeFwAction == \"Session Drop\"\n| extend DropReason = extract(\"REASON=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| summarize eventcount=count() by DropReason\n| render piechart", "size": 0, "title": "Edge Firewall - Anomaly Detection", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Session Open", "color": "green" }, { "seriesName": "Session Close", "color": "greenDark" }, { "seriesName": "Session Drop", "color": "orange" }, { "seriesName": "Session Refresh", "color": "greenDarkDark" }, { "seriesName": "IDS/IPS Signature Match", "color": "redBright" }, { "seriesName": "Session Denied", "color": "red" } ], "xSettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "35", "name": "Edge Firewall - Anomaly Detection", "styleSettings": { "margin": "5px", "padding": "5px" } } ] }, "name": "Edge Firewall" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 3B Edge Health and Cloud Security Service" }, "name": "text - 0" } ] }, "name": "Edge Health & CSS" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_VECO_EventLogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_VECO_EventLogs_CL | summarize max(TimeGenerated));\nVMware_VECO_EventLogs_CL\n| where event contains \"EDGE_NVS_TUNNEL_DOWN\"\n| extend EdgeName = extract(\"edge \\\\[(.+)\\\\] for\", 1, message)\n| extend nsdServiceName=todynamic(detail).nvsProviderName\n| extend nsdServiceId=todynamic(detail).nvsTunnelSiteName\n| extend nsdServicePath=todynamic(detail).nvsTunnelPathId\n| extend nsdPeerIp=todynamic(detail).nvsDestinationPublicIp\n| project-away detail\n| make-series nsdDownstatistics = count(nsdServiceId) default=0 on TimeGenerated from min_t to max_t step 1h by EdgeName\n| render timechart", "size": 0, "title": "NSD/CSS Down Events by Edge over Time", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "60", "name": "NSD/CSS Down Events by Edge over Time", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_VECO_EventLogs_CL\n| where event contains \"EDGE_NVS_TUNNEL_DOWN\"\n| extend EdgeName = extract(\"edge \\\\[(.+)\\\\] for\", 1, message)\n| extend nsdServiceName=todynamic(detail).nvsProviderName\n| extend nsdServiceId=todynamic(detail).nvsTunnelSiteName\n| extend nsdServicePath=todynamic(detail).nvsTunnelPathId\n| extend nsdPeerIp=todynamic(detail).nvsDestinationPublicIp\n| project-away detail\n| summarize nsdEndpoint = count() by tostring(nsdPeerIp)\n| render barchart", "size": 0, "title": "NSD / CSS - Tunnel Down alerts per Remote IP", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "NSD / CSS - Tunnel Down alerts per Remote IP", "styleSettings": { "margin": "5px", "padding": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_VECO_EventLogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_VECO_EventLogs_CL | summarize max(TimeGenerated));\nVMware_VECO_EventLogs_CL\n| where event == \"VPN_DATACENTER_STATUS\"\n| extend nsdServiceChange = todynamic(detail).ikeState\n| extend nsdServiceName = extract(\"^Tunnel to \\\\[(.+)\\\\]\", 1, message)\n| where nsdServiceChange == \"DOWN\"\n| make-series nsdStatusChange = count(TimeGenerated) default=0 on TimeGenerated from min_t to max_t step 1h by nsdServiceName\n| render timechart\n", "size": 0, "title": "NSD via Gateway service - IKE SA Down Events", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "60", "name": "NSD via Gateway service - IKE SA Down Events", "styleSettings": { "margin": "5px", "padding": "5px" } } ] }, "name": "Edge NSD/CSS" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# 3C SD-WAN and SASE Audit Logs & Events" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_VECO_EventLogs_CL\n| where event == \"CWS_EVENT\"\n| extend eventType = todynamic(detail).subEvent\n| summarize count() by tostring(eventType)\n| render piechart", "size": 0, "title": "CWS Audit Event Summary by Type", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "group": "eventType", "createOtherGroup": null, "seriesLabelSettings": [ { "seriesName": "CWS_POLICY_PUBLISHED", "label": "Policy Publish", "color": "green" }, { "seriesName": "CWS_SECURITY_RULE_DELETED", "label": "Security Rule Deleted", "color": "orange" }, { "seriesName": "CWS_SECURITY_RULE_UPDATED", "label": "Security Rule Updated", "color": "blue" }, { "seriesName": "CWS_POLICY_DELETED", "label": "Policy Deleted", "color": "redBright" }, { "seriesName": "CWS_SECURITY_RULE_CREATED", "label": "Security Rule Created", "color": "magenta" } ], "showDataPoints": true } }, "customWidth": "30", "name": "CWS Audit Event Summary by Type", "styleSettings": { "margin": "5px", "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(VMware_VECO_EventLogs_CL | summarize min(TimeGenerated));\nlet max_t = toscalar(VMware_VECO_EventLogs_CL | summarize max(TimeGenerated));\nVMware_VECO_EventLogs_CL\n| where event == \"CWS_EVENT\"\n| extend eventType = todynamic(detail).subEvent\n| where eventType contains \"CWS_POLICY\"\n| extend policyName = todynamic(detail).name\n| project-keep TimeGenerated, policyName, eventType\n| summarize policyEvents = count(eventType) by tostring(policyName), tostring(eventType)\n", "size": 0, "title": "CWS Policy Changes by Policy and Change Type", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "policyName", "formatter": 2 }, "leftContent": { "columnMatch": "eventType", "formatter": 1 }, "rightContent": { "columnMatch": "policyEvents", "formatter": 20, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true, "sortCriteriaField": "policyEvents", "sortOrderField": 2, "size": "auto" } }, "customWidth": "35", "name": "CWS Policy Changes by Policy and Change Type", "styleSettings": { "margin": "5px", "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMware_VECO_EventLogs_CL\n| where event == \"CWS_EVENT\"\n| extend eventType = todynamic(detail).subEvent\n| where eventType contains \"CWS_SECURITY_RULE\"\n| extend ruleName = todynamic(detail).name\n| extend policyName = todynamic(detail).policyName\n| project-keep TimeGenerated, policyName, eventType, ruleName\n| summarize policyEvents = count(eventType) by tostring(ruleName), tostring(eventType), tostring(policyName)\n", "size": 0, "title": "CWS Rule Changes by Policy and Change Type", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "ruleName" }, "leftContent": { "columnMatch": "eventType", "formatter": 1 }, "rightContent": { "columnMatch": "policyEvents", "formatter": 20, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "policyName", "formatter": 1 }, "showBorder": true, "sortCriteriaField": "policyEvents", "sortOrderField": 2, "size": "auto" } }, "customWidth": "35", "name": "CWS Rule Changes by Policy and Change Type", "styleSettings": { "margin": "5px", "padding": "5px", "showBorder": true } } ] }, "name": "Audit" } ] }, "name": "VMware SD-WAN Security" } ], "fromTemplateId": "https://sentinelus.hosting.portal.azure.net/sentinelus/Content/1.0.02484.3403-231021-003920/Scenarios/Ecosystem/Content/Workbooks/CustomWorkbook.json", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }