{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "8525bad9-91d6-46a7-9328-334b4c168950", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Indicator Overview", "subTarget": "indicator", "style": "link" }, { "id": "6f66c275-a657-4fef-9249-645f9b0006ac", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Correlation Overview", "subTarget": "correlation_overview", "style": "link" }, { "id": "5c75f38f-c393-49a3-bf80-5fa5df29774d", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Ad Hoc Enrichment", "subTarget": "ad_hoc", "style": "link" }, { "id": "558de07b-567b-453d-a1e7-fb2c587d1ee2", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Domain Monitor", "subTarget": "domain_monitor", "style": "link" }, { "id": "42092821-7c88-470a-bce6-dc8045081bf1", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Data Breaches", "subTarget": "data_breaches", "style": "link" } ] }, "name": "links - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Indicator Overview\n---" }, "name": "text - 24" }, { "type": 1, "content": { "json": "This tab depends on the **Cyjax IOC Data Connector**.
\nPlease configure the Data Connector (Function App) to enable indicator ingestion and allow this tab to visualize the data.\n", "style": "info" }, "name": "text - 25" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4aade22f-6e5d-4eac-be8c-4a15c744d45f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "d3d2830a-5abd-41a9-bc58-058408bc2206", "version": "KqlParameterItem/1.0", "name": "Indicator_Type", "label": "Indicator Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CyjaxThreatIndicator\n| distinct IndicatorType", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "251c49c9-445e-4ad0-a11a-b647d1a1d38c", "version": "KqlParameterItem/1.0", "name": "Indicator_Value", "label": "Indicator Value", "type": 1, "isRequired": true, "query": "print \"*\"", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 1, "content": { "json": "

Total Indicator

" }, "customWidth": "20", "name": "text - 4" }, { "type": 1, "content": { "json": "

Indicator Handling Condition Matrix

" }, "customWidth": "80", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| distinct CyjaxIOCUUID \n| count\n| extend Count_Title = \"Count\"", "size": 3, "showAnalytics": true, "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count_Title", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "Total_Indicator", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where TLPLevel =~ \"white\"\n| distinct CyjaxIOCUUID\n| count\n| extend HandlingCondition = \"White\"\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "HandlingCondition", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "gray" } }, "showBorder": false } }, "customWidth": "25", "name": "tlp_white", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where TLPLevel =~ \"amber\"\n| distinct CyjaxIOCUUID\n| count\n| extend HandlingCondition = \"Amber\"\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "HandlingCondition", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "orange" } }, "showBorder": false } }, "customWidth": "25", "name": "tlp_white - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where TLPLevel =~ \"green\"\n| distinct CyjaxIOCUUID\n| count\n| extend HandlingCondition = \"Green\"\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "HandlingCondition", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "25", "name": "tlp_white - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where TLPLevel =~ \"red\"\n| distinct CyjaxIOCUUID\n| count\n| extend HandlingCondition = \"Red\"\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "HandlingCondition", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "redBright" } }, "showBorder": false } }, "customWidth": "25", "name": "tlp_white - Copy - Copy - Copy", "styleSettings": { "showBorder": true } } ] }, "customWidth": "80", "name": "Indicators_by_handling_condition" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| summarize Count = count(CyjaxIOCUUID) by IndicatorType", "size": 3, "showAnalytics": true, "title": "Indicator Type Distribution", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "IndicatorType1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": false } }, "customWidth": "50", "name": "Indicator_type_distribution " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| summarize Count = count(CyjaxIOCUUID) by TLPLevel", "size": 3, "showAnalytics": true, "title": "Handling Condition Breakdown", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "TLPLevel1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Green", "color": "green" }, { "seriesName": "Amber", "color": "orange" }, { "seriesName": "Red", "color": "redBright" }, { "seriesName": "White", "color": "gray" } ] } }, "customWidth": "50", "name": "Indicator_type_distribution - Copy" }, { "type": 1, "content": { "json": "_Click on the sections in the above panel **Indicator Type Distribution** to view more information._", "style": "info" }, "customWidth": "50", "name": "text - 14" }, { "type": 1, "content": { "json": "_Click on the sections in the above panel **Handling Condition Breakdown** to view more information._", "style": "info" }, "customWidth": "50", "name": "text - 14 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where IndicatorType == '{IndicatorType1}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for Type : {IndicatorType1}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "IndicatorType1", "comparison": "isNotEqualTo" }, "name": "query - 16", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where TLPLevel == '{TLPLevel1}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for Handling Condition : {TLPLevel1}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "TLPLevel1", "comparison": "isNotEqualTo" }, "name": "query - 16 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRange:end}, {TimeRange:start});\nlet interval_in_days= datetime_diff('day', {TimeRange:end}, {TimeRange:start});\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\nCyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| make-series Count = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step bin_duration by IndicatorType\n\n", "size": 0, "showAnalytics": true, "title": "Indicator Over Time", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "Indicator_timeline", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| project\n TimeGenerated,\n CreatedAt,\n IndicatorType,\n IndicatorValue,\n IndicatorName,\n Description,\n StixPattern,\n PatternType,\n PatternVersion,\n IndicatorCategories,\n CyjaxIOCUUID,\n CyjaxSource,\n CyjaxTTP,\n CyjaxIndustryType,\n CyjaxHandlingCondition,\n EnrichmentIOCType,\n EnrichmentIPAddress,\n EnrichmentCity,\n EnrichmentCountryName,\n EnrichmentCountryCode,\n EnrichmentASNOrg,\n EnrichmentASNNumber,\n EnrichmentSightingsCount,\n EnrichmentSightings,\n EnrichmentLastSeen,\n ModifiedAt,\n ValidFrom,\n ValidUntil,\n ObservableKey,\n ObservableValue,\n StixConfidence,\n Confidence,\n IsActive,\n IsDeleted,\n Revoked,\n TLPLevel,\n Labels,\n SourceName,\n SourceDescription,\n ReportURL,\n SourceSystem", "size": 0, "showAnalytics": true, "title": "Indicator Overview with Enrichment Details", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "Indicator_overview", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| extend CyjaxTTP = split(CyjaxTTP, \", \")\n| mv-expand CyjaxTTP\n| where isnotempty(CyjaxTTP)\n| summarize Count = count() by tostring(CyjaxTTP)\n| top 10 by Count\n\n", "size": 3, "showAnalytics": true, "title": "Top 10 TTP", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "CyjaxTTP", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "top_ttp" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where isnotempty(EnrichmentASNOrg) \n| summarize Count = count() by EnrichmentASNOrg\n| top 10 by Count\n", "size": 3, "showAnalytics": true, "title": "Top 10 ASN", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "EnrichmentASNOrg", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "top_asn" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| extend CyjaxIndustryType = split(CyjaxIndustryType, \", \")\n| project CyjaxIndustryType\n| mv-expand CyjaxIndustryType\n| where isnotempty(CyjaxIndustryType) and CyjaxIndustryType != \"Unknown\"\n| summarize Count = count() by tostring(CyjaxIndustryType)\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Industry Breakdown", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "CyjaxIndustryType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "LocationInfo", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "industry_breakdown" }, { "type": 1, "content": { "json": "_Click on the sections in the above panels **Top 10 TTP, Top 10 ASN, Industry Breakdown** to view more information._", "style": "info" }, "name": "text - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where CyjaxTTP contains '{CyjaxTTP}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for TTP : {CyjaxTTP}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CyjaxTTP", "comparison": "isNotEqualTo" }, "name": "query - 21", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where EnrichmentASNOrg == '{EnrichmentASNOrg}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for ASN Org : {EnrichmentASNOrg}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "EnrichmentASNOrg", "comparison": "isNotEqualTo" }, "name": "query - 21 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where CyjaxIndustryType contains '{CyjaxIndustryType}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for Industry : {CyjaxIndustryType}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CyjaxIndustryType", "comparison": "isNotEqualTo" }, "name": "query_industry_drilldown", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where isnotempty(EnrichmentCountryName) \n| summarize Count = count() by EnrichmentCountryName\n| top 10 by Count\n\n", "size": 0, "showAnalytics": true, "title": "Top 10 Country", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Country", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 10 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "EnrichmentCountryName", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "top_countries", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where isnotempty(EnrichmentCountryCode) \n| summarize Count = count() by EnrichmentCountryCode\n| project-rename LocationInfo = EnrichmentCountryCode\n| top 10 by Count\n\n", "size": 0, "showAnalytics": true, "title": "Geographic Country Distribution (Top 10)", "noDataMessage": "No Data Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "chartSettings": { "createOtherGroup": 10 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "LocationInfo", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "top_countries_map", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "_Click on the bar in the above panel **Top 10 Country** to view more information._", "style": "info" }, "customWidth": "50", "name": "text - 14 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxThreatIndicator\n| where (\"*\" in ({Indicator_Type:value}) or IndicatorType in ({Indicator_Type:value})) and (('*' == ('{Indicator_Value}') or IndicatorValue contains ('{Indicator_Value}')))\n| where EnrichmentCountryName == '{Country}'", "size": 0, "showAnalytics": true, "title": "Indicator Details for Country : {Country}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Country", "comparison": "isNotEqualTo" }, "name": "query - 16 - Copy - Copy", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "indicator" }, "name": "indicator_overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Correlation Overview\r\n---" }, "name": "text - 1" }, { "type": 1, "content": { "json": "This tab depends on the **ASIM Parsers** and **ThreatIntelligenceIndicators**.
\r\nPlease configure ASIM Parsers in the workspace and create/upload some indicators in ThreatIntelligence to visualize data in this tab.\r\n", "style": "info" }, "name": "text - 10" }, { "type": 1, "content": { "json": "## Steps to perform Correlation using this workbook\r\n- This workbook is intended to help perform Correlation of Indicators (**Indicator Type:** IP, Domain, FileHashes and URL).\r\n- Select **Time Range** for which you want to perform correlation of other sources data with Cyjax data.\r\n- Select **Indicator Type** from Indicator Type filter. Default All is selected.\r\n- Select **Search Matching Algorithm** based on which you want to perform correlation of other sources data with Cyjax Data.\r\n\t- **ThreatIntelligenceIndicator**: Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. \r\n\t- **ASIM Parsers**: The Advanced Security Information Model (ASIM) provides a seamless experience for handling various sources in uniform, normalized views. ASIM allows for predictable entities correlation across normalized tables\r\n- If you select **ASIM Parsers** in \"Search Matching Algorithm\", filter for ASIM Parsers will be visible.\r\n\t- Select ASIM Parsers schema from **ASIM Parsers** filter. Default All is selected.\r\n- Based on selected filters, correlated data will be visible in below panles.\r\n
\r\n
\r\n**Note** :
\r\n\t* If data is not populated, \r\n\t\t- Check ASIM Parsers schema is available in workspace and does not have any error. \r\n\t\t- Check ThreatIntelligenceIndicator table has indicators available from other sources.", "style": "upsell" }, "name": "text - 9" }, { "type": 1, "content": { "json": "## Steps to configure ASIM Parsers in workspace\r\n- Go to **[ASIM](https://github.com/Azure/Azure-Sentinel/tree/master/ASIM)** folder in Azure-Sentinel Repository.\r\n- Select Schema you want to add from list of available schema in README.md. e.g. *NetworkSession*\r\n- Click on the **Deploy to Azure** button besides NetworkSession Schema.\r\n- You will be redirected to the custom deployment page where you need to provide information for **Resource group**, **Region**, **Workspace name** and **Workspace Region**.\r\n- Click on the **Review+Create** button. \r\n- Review the next dialog from Azure, and then click on **Create** to install the ASIM parser.\r\n- Follow the same steps to deploy the ASIM Parsers for below schemas:\r\n\t- *NetworkSession*\r\n\t- *WebSession*\r\n\t- *DNS*\r\n\t- *DHCP*\r\n\t- *AuditEvent*\r\n\t- *Authentication*\r\n\t- *FileEvent*\r\n\t- *ProcessEvent*\r\n\t- *AlertEvent*\r\n
", "style": "upsell" }, "name": "text - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7901b4ce-ad76-418d-8ff2-4d79a07f08d7", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 2592000000 } }, { "id": "8d03e2ce-4f87-4475-ab03-7ec851147151", "version": "KqlParameterItem/1.0", "name": "TypeIndicator", "label": "Indicator Type", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\"IP\",\r\n\"Domain\",\r\n\"FileHash\",\r\n\"URL\"]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all" }, { "id": "cf53799f-d9a6-41ab-94d3-06118f237555", "version": "KqlParameterItem/1.0", "name": "SearchMatchingAlgorithm", "label": "Search Matching Algorithm", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n \"ASIM Parsers\",\r\n \"ThreatIntelligenceIndicator\"\r\n]", "timeContext": { "durationMs": 86400000 }, "value": "ASIM Parsers" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9f6f860e-9eca-4af4-a638-2cf912745e3f", "version": "KqlParameterItem/1.0", "name": "ASIMParsers", "label": "ASIM Parsers", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n \"NetworkSession\",\r\n \"WebSession\",\r\n \"DNS\",\r\n \"DHCP\",\r\n \"AuditEvent\",\r\n \"Authentication\",\r\n \"FileEvent\",\r\n \"ProcessEvent\",\r\n \"AlertEvent\"\r\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "SearchMatchingAlgorithm", "comparison": "isEqualTo", "value": "ASIM Parsers" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n | summarize Count = dcount(IndicatorValue)", "size": 1, "showAnalytics": true, "title": "Total Matched Indicators", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "Count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "rightContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": true, "size": "auto" } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string, IndicatorType: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| extend IndicatorType = column_ifexists(\"IndicatorType\", \"\")\r\n| extend IndicatorType1 = column_ifexists(\"IndicatorType1\", \"\")\r\n| extend IndicatorType = coalesce(IndicatorType, IndicatorType1)\r\n| summarize Count=dcount(IndicatorValue) by IndicatorType", "size": 3, "showAnalytics": true, "title": "Matched Indicators by Type", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Type", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "query - 3", "styleSettings": { "maxWidth": "50%" } }, { "type": 1, "content": { "json": "#### Click on the count in panel **Total Matched Indicators** above to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 13" }, { "type": 1, "content": { "json": "#### Click on the section in panel **Matched Indicators by Type** above to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string, TimeGenerated: datetime, IndicatorType: string, EventVendor: string, EventProduct: string, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by IndicatorValue\r\n| extend IndicatorType = column_ifexists(\"IndicatorType\", \"\")\r\n| extend IndicatorType1 = column_ifexists(\"IndicatorType1\", \"\")\r\n| extend IndicatorType = coalesce(IndicatorType, IndicatorType1)\r\n| project IndicatorValue, TimeGenerated, IndicatorType, Source", "size": 3, "showAnalytics": true, "title": "Details for Total Matched Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| extend IndicatorType = column_ifexists(\"IndicatorType\", \"\")\r\n| extend IndicatorType1 = column_ifexists(\"IndicatorType1\", \"\")\r\n| extend IndicatorType = coalesce(IndicatorType, IndicatorType1)\r\n| extend IndicatorType = tostring(IndicatorType)\r\n| where IndicatorType == '{Type}'\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by IndicatorValue\r\n| project IndicatorValue, TimeGenerated, IndicatorType, Source", "size": 3, "showAnalytics": true, "title": "Details for Matched Indicators of Type : {Type}", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "Type", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nlet correlateddata = union isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata);\r\nlet indicatorcount = correlateddata\r\n | summarize Count=count() by IndicatorValue;\r\ncorrelateddata\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by IndicatorValue\r\n| join kind=inner(indicatorcount) on IndicatorValue\r\n| extend IndicatorType = column_ifexists(\"IndicatorType\", \"\")\r\n| extend IndicatorType1 = column_ifexists(\"IndicatorType1\", \"\")\r\n| extend IndicatorType = coalesce(IndicatorType, IndicatorType1)\r\n| project IndicatorValue, IndicatorType, Source, TimeGenerated, Count", "size": 0, "showAnalytics": true, "title": "Matched Indicators Details", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "IndicatorValue", "exportParameterName": "Indicator", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the cell in grid panel **Matched Indicators Details** above to view more information related to Indicator from Other Source.", "style": "info" }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(IndicatorValue: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCyjaxCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| where IndicatorValue == '{Indicator}'\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| extend IndicatorType = column_ifexists(\"IndicatorType\", \"\")\r\n| extend IndicatorType1 = column_ifexists(\"IndicatorType1\", \"\")\r\n| extend IndicatorType = coalesce(IndicatorType, IndicatorType1)\r\n| project-reorder IndicatorValue, IndicatorType, TimeGenerated, Source", "size": 0, "showAnalytics": true, "title": "Details for Matched Indicator '{Indicator}' from Other Source", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Indicator", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 12" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "correlation_overview" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Ad Hoc Enrichment\n---" }, "name": "text - 0" }, { "type": 1, "content": { "json": "This workbook depends on the **CyjaxAdHocEnrichment** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Ad-Hoc IOC Enrichment Workbook\n\n**Purpose**: Quickly fetch and investigate IOC data from Cyjax using IOC Enrichment API without creating incidents or alerts.\n\n### Quick Setup (2 steps)\n1. **Select Environment**: Choose Subscription ID and Resource Group\n2. **Enter Indicator Value**: Input the IOC you want to investigate\n\n**Indicator Format Examples:**\n- **IPs:** `192.168.1.100` or `2001:0db8:85a3:0000:0000:8a2e:0370:7334`\n- **Domains:** `example.com` or `malicious-site.net`\n- **FileHashes:** `MD5`, `SHA1`, `SSDEEP`, or `SHA256` hash values\n- **Emails:** `user@example.com`\n- **URLs:** `https://example.com/path` or `http://malicious-site.net`\n\n### Run IOC Enrichment\n1. Click **Submit**\n2. In side panel, click **Get Ad Hoc Enrichment Data**\n3. Wait for **Click on refresh icon to check data availability** message\n4. Click refresh icon until you see **Click here to populate data**\n5. Click the message to view all indicator data panels\n\n\n### Important Notes\n- **New Environments**: First-time lookups take 10-20 minutes (Microsoft Sentinel delay)\n- **Hard Refresh**: Required before each new IOC value for proper panel population\n- **Data Range**: Results include last 1 hour only\n- **Progress Tracking**: Monitor CyjaxAdHocEnrichment Logic App run status for real-time progress updates\n\n", "style": "upsell" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "3f184823-0373-4bfd-ad7a-2b33a53ad2fe", "version": "KqlParameterItem/1.0", "name": "ioc_value", "label": "IOC Value", "type": 1, "description": "IOC Value for which data should be fetched from Cyjax", "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "31d6eb07-0e8f-4ea0-abc3-8d43171f2f27", "linkTarget": "ArmAction", "linkLabel": "Submit", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CyjaxAdHocEnrichment/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\n \"ioc_value\": \"{ioc_value}\"\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Ad Hoc Enrichment Data" } } ] }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "ioc_value", "comparison": "isNotEqualTo" } ], "name": "links - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, ioc_value_s: string) [];\nunion isfuzzy=true dummy_table, \n(CyjaxAdHocEnrichment_CL | where ioc_value_s == '\"{ioc_value}\"')\n| summarize count()\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "ioc_value", "comparison": "isNotEqualTo" } ], "name": "query - 6", "styleSettings": { "margin": "28px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxAdHocEnrichment_CL\n| where ioc_value_s == '\"domainca.top\"'\n| project \n TimeGenerated,\n IOCValue = coalesce(trim('\"', ioc_value_s), \"N/A\"),\n Type = coalesce(type_s, \"N/A\"),\n LastSeenTimestamp = coalesce(tostring(last_seen_timestamp_t), \"N/A\"),\n CountryCode = coalesce(column_ifexists(\"geoip_country_code_s\", \"\"), \"N/A\"),\n CountryName = coalesce(column_ifexists(\"geoip_country_name_s\", \"\"), \"N/A\"),\n City = coalesce(column_ifexists(\"geoip_city_s\", \"\"), \"N/A\"),\n IPAddress = coalesce(column_ifexists(\"geoip_ip_address_s\", \"\"), \"N/A\"),\n ASNOrganization = coalesce(asn_organization_s, \"N/A\"),\n ASNNumber = coalesce(tostring(asn_number_s), \"N/A\"),\n Sightings = coalesce(sightings_s, \"N/A\"),\n TableType = coalesce(Type, \"N/A\")", "size": 0, "showAnalytics": true, "title": "Ad Hoc Enrichment", "noDataMessage": "No data found", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Event History", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "View Host History" } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, "name": "Ad Hoc Enrichment" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "ad_hoc" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Domain Monitor\n---" }, "name": "text - 0" }, { "type": 1, "content": { "json": "This workbook depends on the **CyjaxDomainMonitor** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Domain Monitor Lookup Workbook\n\n**Purpose**: Fetch and investigate potentially malicious domains using Domain Monitor API.\n\n### Quick Setup (2 steps)\n1. **Select Environment**: Choose Subscription ID and Resource Group\n2. **Provide Parameters**: Enter Since, Until, and Query (all fields are optional)\n\n**Parameter Format Examples:**\n- **Since**: `2026-01-01T00:00:00Z` (ISO 8601 format: YYYY-MM-DDT00:00:00Z)\n- **Until**: `2026-01-02T00:00:00Z` (ISO 8601 format: YYYY-MM-DDT00:00:00Z)\n- **Query**: Keyword or domain you would like to find malicious information (e.g., example.com or malware)\n\n### Run Domain Monitor Lookup\n1. Click **Submit**\n2. In side panel, click **Get Domain Monitor Data**\n3. Wait for **Click on refresh icon to check data availability** message\n4. Click refresh icon until you see **Click here to populate data**\n5. Click the message to view all indicator data panels\n\n\n\n### Important Notes\n- **New Environments**: First-time lookups take 10-20 minutes (Microsoft Sentinel delay)\n- **Hard Refresh**: Required before each new input value for proper panel population\n- **Data Range**: Results include last 1 hour only based on provided Query input\n- **Progress Tracking**: Monitor CyjaxDomainMonitor Logic App run status for real-time progress updates\n\n", "style": "upsell" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "e61a3f63-e4de-4c36-83f4-de9270494867", "version": "KqlParameterItem/1.0", "name": "since", "label": "Since", "type": 1, "description": "Start Time from where domain monitor data lookup should be started", "timeContext": { "durationMs": 86400000 } }, { "id": "9ab5b736-7cf3-4df8-96fe-f320a86b20bb", "version": "KqlParameterItem/1.0", "name": "until", "label": "Until", "type": 1, "description": "End Time from where domain monitor data lookup should be ended", "timeContext": { "durationMs": 86400000 } }, { "id": "3f184823-0373-4bfd-ad7a-2b33a53ad2fe", "version": "KqlParameterItem/1.0", "name": "query", "label": "Query", "type": 1, "description": "Query for which Domain Monitor Data filtered", "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "31d6eb07-0e8f-4ea0-abc3-8d43171f2f27", "linkTarget": "ArmAction", "linkLabel": "Submit", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CyjaxDomainMonitor/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\n \"since\": \"{since}\",\n \"until\": \"{until}\",\n \"query\": \"{query}\"\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Domain Monitor Data" } } ] }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" } ], "name": "links - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, query_s: string, discovery_date_t:datetime) [];\nunion isfuzzy=true dummy_table, \n(CyjaxDomainMonitor_CL | where query_s == '{query}')\n| summarize count()\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" } ], "name": "query - 6", "styleSettings": { "margin": "28px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxDomainMonitor_CL\n| where query_s == \"{query}\"\n| project\n TimeGenerated,\n Query = iff(query_s == \"\", \"N/A\", query_s),\n MatchedDomains = matched_domains_s,\n UnMatchedDomains = unmatched_domains_s,\n Domains = domains_s,\n RecordType = type_s,\n Source = source_s,\n Keywords = keyword_s,\n DiscoveryDate = discovery_date_t,\n ExpirationDate = expiration_timestamp_t", "size": 0, "showAnalytics": true, "title": "Domain Monitor", "noDataMessage": "No data found", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Event History", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "View Host History" } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, "name": "Domain Monitor" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "domain_monitor" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Data Breaches \n---" }, "name": "text - 0" }, { "type": 1, "content": { "json": "This workbook depends on the **CyjaxDataBreaches** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "# Cyjax Data Breaches Investigation Workbook\n\nThis workbook helps you investigate potential email credential compromises using the Cyjax Data Breaches API.\n\n## How to Use\n\n### 1. Basic Setup\n- **Subscription ID**: Select your Azure subscription\n- **Resource Group**: Choose the resource group where your Log Analytics workspace is located\n\n### 2. Search Parameters\n- **Query** (Required): Enter an email address, domain, or partial search term\n - Examples: `user@example.com`, `@company.com`, `example`\n- **Since** (Optional): Start date for your search (format: `YYYY-MM-DDT00:00:00Z`)\n - Example: `2026-01-01T00:00:00Z` for January 1, 2026\n- **Until** (Optional): End date for your search (format: `YYYY-MM-DDT00:00:00Z`)\n - Example: `2026-01-02T00:00:00Z` for January 2, 2026\n\n### 3. Run the Investigation\n1. Fill in your search parameters (Query is required, Since and Until are optional)\n2. Click the **Submit** button (appears when required values are provided)\n3. Click **Get Breach Data** in the side panel that opens\n\n### 4. What Happens Next\n- The CyjaxDataBreaches Logic App runs automatically in the background\n- Results are added to your Log Analytics workspace\n- You can track progress by checking the Logic App run status\n\n---\n\n**Note**: This tool helps identify if your email credentials have been found in known data breaches, enabling quick security response.", "style": "upsell" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "e61a3f63-e4de-4c36-83f4-de9270494867", "version": "KqlParameterItem/1.0", "name": "since", "label": "Since", "type": 1, "description": "Start Time from where domain monitor data lookup should be started", "timeContext": { "durationMs": 86400000 } }, { "id": "9ab5b736-7cf3-4df8-96fe-f320a86b20bb", "version": "KqlParameterItem/1.0", "name": "until", "label": "Until", "type": 1, "description": "End Time from where domain monitor data lookup should be ended", "timeContext": { "durationMs": 86400000 } }, { "id": "3f184823-0373-4bfd-ad7a-2b33a53ad2fe", "version": "KqlParameterItem/1.0", "name": "query", "label": "Query", "type": 1, "description": "Query for which Domain Monitor Data filtered", "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "31d6eb07-0e8f-4ea0-abc3-8d43171f2f27", "linkTarget": "ArmAction", "linkLabel": "Submit", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CyjaxDataBreaches/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\n \"since\": \"{since}\",\n \"until\": \"{until}\",\n \"query\": \"{query}\"\n}", "httpMethod": "POST", "title": "Get Breach data", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Breach data" } } ] }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" } ], "name": "links - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, query_s: string, discovery_date_t:datetime) [];\nunion isfuzzy=true dummy_table, \n(CyjaxDataBreaches_CL | where query_s == '{query}')\n| summarize count()\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" } ], "name": "query - 6", "styleSettings": { "margin": "28px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CyjaxDataBreaches_CL\n| where query_s == \"{query}\"\n| project \n TimeGenerated,\n ['Id'] = id_s,\n ['Email'] = email_s,\n ['Source'] = source_s,\n ['DataBreachId'] = data_breach_id_d,\n ['DataBreachName'] = data_breach_name_s,\n ['DataBreachUrl'] = data_breach_url_s,\n ['DataClasses'] = data_classes_s,\n ['Discovered'] = discovered_at_t,\n ['Query'] = query_s\n| order by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Data Breaches", "noDataMessage": "No data found", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Event History", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "View Host History" } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, "name": "Data Breaches" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "data_breaches" }, "name": "data_breaches" } ], "fromTemplateId": "Cyjax", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }