{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**UbiquitiAuditEvent**](https://aka.ms/sentinel-UbiquitiUnifi-parser) which is deployed with the Microsoft Sentinel Solution." }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "dc2f97cf-131b-415b-9871-b1eb9579513c", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\r\n", "size": 0, "title": "Events over time", "color": "greenDark", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart" }, "name": "query - 2" } ] }, "customWidth": "50", "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\n| where isnotempty(EventCategory)\n| summarize TotalEvents = count() by EventCategory\n| order by TotalEvents", "size": 3, "title": "Total events by Category", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "EventCategory", "formatter": 1 }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "60", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where EventCategory == 'firewall'\r\n| summarize count() by DvcAction", "size": 3, "title": "Firewall actions", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DvcAction", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "40", "name": "query - 1" } ] }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(SrcIpAddr)\r\n| summarize count() by SrcIpAddr", "size": 3, "title": "Top sources", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "25", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(DstIpAddr)\r\n| summarize count() by DstIpAddr", "size": 3, "title": "Top destinations", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "25", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let src_mac = UbiquitiAuditEvent\r\n| where isnotempty(SrcMacAddr)\r\n| summarize TotalEvents = count() by SrcMacAddr\r\n| project TotalEvents, MacAddress = SrcMacAddr;\r\nlet dst_mac = UbiquitiAuditEvent\r\n| where isnotempty(DstMacAddr)\r\n| summarize TotalEvents = count() by DstMacAddr\r\n| project TotalEvents, MacAddress = DstMacAddr;\r\nunion src_mac, dst_mac\r\n| summarize Events = sum(TotalEvents) by MacAddress\r\n", "size": 3, "title": "Top devices (MacAddress)", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "25", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(NetworkRuleName)\r\n| summarize Count = count() by NetworkRuleName\r\n| top 10 by Count", "size": 0, "title": "Top 10 Firewall rules", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "query - 3" } ] }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(DstPortNumber)\r\n| where ipv4_is_private(DstIpAddr)\r\n| extend svc_name = case(DstPortNumber in ('20', '21'), 'FTP',\r\n DstPortNumber == '22', 'SSH',\r\n DstPortNumber == '23', 'Telnet',\r\n DstPortNumber == '25', 'SMTP',\r\n DstPortNumber == '53', 'DNS',\r\n DstPortNumber in ('67', '68'), 'DHCP',\r\n DstPortNumber == '110', 'POP3',\r\n DstPortNumber == '123', 'NTP',\r\n DstPortNumber in ('137', '138', '139'), 'NeTBIOS',\r\n DstPortNumber == '143', 'IMAP',\r\n DstPortNumber == '220', 'IMAPv3',\r\n DstPortNumber == '389', 'LDAP',\r\n DstPortNumber == '3389', 'RDP',\r\n DstPortNumber == '514', 'Syslog',\r\n DstPortNumber == '80', 'HTTP',\r\n DstPortNumber == '443', 'HTTPS',\r\n 'Other' )\r\n| summarize Events = count() by svc_name\r\n| project Events, Service = svc_name", "size": 3, "title": "Top internal services", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "40", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(DstPortNumber)\r\n| where ipv4_is_private(DstIpAddr) == 'False'\r\n| extend svc_name = case(DstPortNumber in ('20', '21'), 'FTP',\r\n DstPortNumber == '22', 'SSH',\r\n DstPortNumber == '23', 'Telnet',\r\n DstPortNumber == '25', 'SMTP',\r\n DstPortNumber == '53', 'DNS',\r\n DstPortNumber in ('67', '68'), 'DHCP',\r\n DstPortNumber == '110', 'POP3',\r\n DstPortNumber == '123', 'NTP',\r\n DstPortNumber in ('137', '138', '139'), 'NeTBIOS',\r\n DstPortNumber == '143', 'IMAP',\r\n DstPortNumber == '220', 'IMAPv3',\r\n DstPortNumber == '389', 'LDAP',\r\n DstPortNumber == '3389', 'RDP',\r\n DstPortNumber == '514', 'Syslog',\r\n DstPortNumber == '80', 'HTTP',\r\n DstPortNumber == '443', 'HTTPS',\r\n 'Other' )\r\n| summarize Events = count() by svc_name\r\n| project Events, Service = svc_name", "size": 3, "title": "Top external services", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "40", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "UbiquitiAuditEvent\r\n| where isnotempty(DnsQuery)\r\n| extend replaced = replace(@'(.*)\\.$', @'\\1', DnsQuery)\r\n| extend Domain = extract(@'([^\\.](\\w+)\\.\\w+)$', 1, replaced)\r\n| summarize TotalRequests = count() by Domain", "size": 3, "title": "Top domains", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "20", "name": "query - 0" } ] }, "name": "group - 5" } ], "fromTemplateId": "sentinel-UbiquitiUniFiWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }