{
"version": "Notebook/1.0",
"items": [
{
"type": 1,
"content": {
"json": "\r\n"
},
"customWidth": "0",
"name": "text - 17",
"styleSettings": {
"margin": "0px 0px 0px 30px",
"maxWidth": "20%"
}
},
{
"type": 1,
"content": {
"json": "# Data Security - Sensitive data Impact Assessment\r\nUse this Workbook to accelerate the investigation and impact assessment of incidents that involve sensitive data such as PII, PCI, PHI, or Intellectual Property present in Azure Blob Storage data source.\r\nThis solution is in its Private Preview stage and will correlate Azure Blob Storage resource audit logs and data sensitivity logs from Azure Purview - to create sensitive data impact assessment report (i.e. Who accessed, What sensitive data, from Where and When).\r\n\r\n Please take time to answer a quick survey,\r\n[ click here. ](https://aka.ms/PrivatePreviewFeedback)\r\n\r\n"
},
"customWidth": "0",
"name": "text - 16",
"styleSettings": {
"padding": "0px",
"maxWidth": "70%"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "5e28d027-8f7a-40c4-a1ee-0424648c6f94",
"cellValue": "TabName",
"linkTarget": "parameter",
"linkLabel": "Summary",
"subTarget": "Summary",
"style": "link"
},
{
"id": "e09caa82-1657-4927-b776-916bcb7918dd",
"cellValue": "TabName",
"linkTarget": "parameter",
"linkLabel": "User account",
"subTarget": "UserAccount",
"style": "link"
},
{
"id": "bc68a7f4-0783-4ec2-ae6c-052cafcbed05",
"cellValue": "TabName",
"linkTarget": "parameter",
"linkLabel": "IP address",
"subTarget": "IPAddress",
"style": "link"
}
]
},
"name": "Tabs",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "c5d3cca3-1c66-4dc7-8ef3-5986c66b3bff",
"version": "KqlParameterItem/1.0",
"name": "LinkName",
"type": 1,
"isGlobal": true,
"query": "print('default')",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - LinkName"
},
{
"type": 1,
"content": {
"json": "----\r\n## Investigation scope"
},
"name": "break - Copy",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "8957770d-ea80-4383-8fda-e7a3ac4a45aa",
"version": "KqlParameterItem/1.0",
"name": "TimeRange_IS",
"label": "During",
"type": 4,
"isRequired": true,
"value": {
"durationMs": 3600000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 3600000
},
{
"durationMs": 86400000
},
{
"durationMs": 604800000
},
{
"durationMs": 2592000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
}
},
{
"id": "96377586-679c-4081-b68d-119b06380ade",
"version": "KqlParameterItem/1.0",
"name": "Subcriptions_IS",
"label": "Subscription",
"type": 6,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "//drop down parameter, list of subscriptions.\r\nDSMAzureBlobStorageLogs\r\n| where AggregationLastEventTime {TimeRange_IS} or TimeGenerated {TimeRange_IS}\r\n| project ResourceSubscriptionId , AggregationLastEventTime , TimeGenerated \r\n| distinct ResourceSubscriptionId\r\n",
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "db2fcd85-cd0a-4ae5-a2fc-0c8d43eedec9",
"version": "KqlParameterItem/1.0",
"name": "ResourceGroup_IS",
"label": "Resource group",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "//dropdown parameter, list of Resource groups according to Subscriptions_IS parameter\r\nDSMAzureBlobStorageLogs | project ResourceSubscriptionId, ResourceGroup, AggregationLastEventTime, TimeGenerated \r\n| where AggregationLastEventTime {TimeRange_IS} or TimeGenerated {TimeRange_IS}\r\n| where \"{Subcriptions_IS}\" == \"'*'\" or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| distinct ResourceGroup",
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "15fe75b2-3ebc-417a-8c65-0216d32ceef6",
"version": "KqlParameterItem/1.0",
"name": "UserAccount_IS",
"label": "User account",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "let AuthenticationData = DSMAzureBlobStorageLogs\r\n| where AggregationLastEventTime {TimeRange_IS} or TimeGenerated {TimeRange_IS}\r\n| where \"{Subcriptions_IS}\" == \"'*'\" or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where \"{ResourceGroup_IS}\" == \"'*'\" or ResourceGroup in ({ResourceGroup_IS})\r\n| distinct RequesterAppId, RequesterObjectId, AuthenticationType;\r\nAuthenticationData\r\n| join kind = leftouter (SigninLogs | project UserId, UserDisplayName | where UserId != UserDisplayName | distinct UserId, UserDisplayName) on $left.RequesterObjectId == $right.UserId\r\n| project RequesterAppId, RequesterObjectId, group = AuthenticationType, UserDisplayName\r\n| join kind=leftouter (AADManagedIdentitySignInLogs | project AppId, ServicePrincipalName | distinct AppId, ServicePrincipalName) on $left.RequesterAppId == $right.AppId\r\n| project RequesterAppId, RequesterObjectId, group, UserDisplayName, ServicePrincipalName\r\n| extend UserId = iff(isempty(UserDisplayName), RequesterAppId, RequesterObjectId),AccountDisplayName = iff(isempty(UserDisplayName), iff(isempty(ServicePrincipalName), \"Anonymous\", ServicePrincipalName), UserDisplayName)\r\n, selected = true\r\n| distinct UserId, AccountDisplayName, selected, group",
"value": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "e652cebc-d5ee-49c2-95dd-d00d18cc7ee7",
"version": "KqlParameterItem/1.0",
"name": "Classification_IS",
"label": "Classification",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "let ClassificationLogs = \r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where isnotempty(Classifications);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n RequesterAppId,\r\n RequesterObjectId,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n CorrelationId = CorrelationId\r\n| where AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| distinct CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n| project Classification_Details = Classifications\r\n| mv-expand Classification_Details\r\n| distinct tostring(Classification_Details)\r\n| order by Classification_Details asc;\r\n\r\ncorrelatedLogs;",
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "91768aeb-8cad-411b-bfcb-7012011468c0",
"version": "KqlParameterItem/1.0",
"name": "SensitivityLabel_IS",
"label": "Sensitivity label",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "//list of sensitivityLabels accoding to all investigation scope parameters.\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId = CorrelationId\r\n | where '*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId = iff(isempty(RequesterAppId), 'Anonymous', RequesterAppId),\r\n RequesterObjectId = iff(isempty(RequesterObjectId), 'Anonymous', RequesterObjectId),\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS});\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId;\r\n\r\ncorrelatedLogs\r\n| distinct SensitivityLabelName\r\n| where isnotempty(SensitivityLabelName)",
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "2318320d-70d3-4dad-a930-10fc51dfe62e",
"version": "KqlParameterItem/1.0",
"name": "IPAddress_IS",
"label": "IP address",
"type": 10,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n {\"value\": \"contains\", \"label\": \"contains\", \"selected\":true},\r\n {\"value\": \"not contains\", \"label\": \"not contains\"}\r\n]",
"value": "not contains"
},
{
"id": "2987875a-e179-431d-93c1-b8540af04fcd",
"version": "KqlParameterItem/1.0",
"name": "IPRange_IS",
"label": "IP range",
"type": 1,
"typeSettings": {
"paramValidationRules": [
{
"regExp": "(^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}(\\/[0-9][0-9]?)?$)|^(?![\\s\\S])$",
"match": true,
"message": "please enter a valid ip range e.g: 10.12.0.0/16"
}
]
},
"value": ""
},
{
"id": "a1470529-ff31-4723-a048-b73a0935805b",
"version": "KqlParameterItem/1.0",
"name": "AssetPath_IS",
"label": "Asset path",
"type": 10,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n {\"value\": \"contains\", \"label\": \"contains\", \"selected\":true},\r\n {\"value\": \"not contains\", \"label\": \"not contains\"}\r\n]"
},
{
"id": "f136c461-4943-47c1-b67c-7bf0cd679d08",
"version": "KqlParameterItem/1.0",
"name": "Path_IS",
"label": "Path",
"type": 1,
"typeSettings": {
"paramValidationRules": [
{
"regExp": "[\\\\]",
"match": false,
"message": "please enter a valid path"
}
]
},
"value": ""
}
],
"style": "above",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "0",
"name": "InvestigationScope",
"styleSettings": {
"maxWidth": "60"
}
}
],
"exportParameters": true
},
"name": "Investigation scope",
"styleSettings": {
"margin": "0px 30px",
"padding": "-30px 0px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let AuthenticationData = DSMAzureBlobStorageLogs\r\n| where AggregationLastEventTime {TimeRange_IS} or TimeGenerated {TimeRange_IS}\r\n| where \"{Subcriptions_IS}\" == \"'*'\" or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where \"{ResourceGroup_IS}\" == \"'*'\" or ResourceGroup in ({ResourceGroup_IS})\r\n| distinct RequesterAppId, RequesterObjectId, AuthenticationType;\r\nAuthenticationData\r\n| join kind = leftouter hint.strategy=shuffle (SigninLogs | project UserId, UserDisplayName | where UserId != UserDisplayName | distinct UserId, UserDisplayName) on $left.RequesterObjectId == $right.UserId\r\n| distinct RequesterAppId, RequesterObjectId, AuthenticationType, UserDisplayName\r\n| join kind=leftouter (AADManagedIdentitySignInLogs | project AppId, ServicePrincipalName | distinct AppId, ServicePrincipalName) on $left.RequesterAppId == $right.AppId\r\n| project RequesterAppId, RequesterObjectId, AuthenticationType, UserDisplayName, ServicePrincipalName\r\n| extend AccountDisplayName = iff(isempty(UserDisplayName), iff(isempty(ServicePrincipalName), \"Anonymous\", ServicePrincipalName), UserDisplayName)\r\n| distinct RequesterAppId, RequesterObjectId, AccountDisplayName",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "EntityLink",
"formatter": 7,
"formatOptions": {
"linkTarget": "Url"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo"
},
"name": "UserAccounts"
},
{
"type": 1,
"content": {
"json": "----\r\n## General Investigation Information\r\n\r\nThis section provides details regarding sensitive data accessed out of total data resources that have been accessed"
},
"name": "break ",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f791d58b-2707-46d4-a4b0-f9c8908d9cee",
"version": "KqlParameterItem/1.0",
"name": "count",
"type": 1,
"query": "DSMAzureBlobStorageLogs\r\n| where TimeGenerated {TimeRange_IS}\r\n| count",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 20"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "789877b3-4d79-4403-bb7e-0dff8e3d8aad",
"version": "KqlParameterItem/1.0",
"name": "WatchListEntities",
"type": 1,
"query": "//get the listof Upn(mail addresses that are part of difault watchlists: VIPUsers, TerminatedEmployees, Terminated Employees\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n CorrelationId)\r\n on CorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project RequesterObjectId, CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId\r\n | project RequesterObjectId;\r\n\r\nlet watchListEntities = _GetWatchlist(\"VIPUsers\") | project UserId = tostring([\"User AAD Object Id\"]) | distinct UserId | union (_GetWatchlist(\"TerminatedEmployees\") | project UserId = tostring([\"User AAD Object Id\"]) | distinct UserId );\r\n\r\nwatchListEntities \r\n| join kind=inner hint.strategy=broadcast\r\ncorrelatedLogs\r\non $left.UserId == $right.RequesterObjectId\r\n| distinct RequesterObjectId",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "56682599-5018-4d5b-8139-57ac8703838d",
"version": "KqlParameterItem/1.0",
"name": "WatchListCount",
"type": 1,
"query": "print(iff(isempty('{WatchListEntities}'), 'No', tostring(array_length(parse_json(split('{WatchListEntities}', ','))))))",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "904c8770-9e80-4d0b-825b-f8f7a917218e",
"version": "KqlParameterItem/1.0",
"name": "TIIPEntities",
"type": 1,
"query": "//query purpose - get count of IP addresses that are part of threat inteligenceIndicator list.\r\nlet TI = ThreatIntelligenceIndicator\r\n| where TimeGenerated <= {TimeRange_IS:end} and ExpirationDateTime > {TimeRange_IS:start}\r\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n// Picking up only IOC's that contain the entities we want\r\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\r\n// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\r\n// Taking the first non-empty value based on potential IOC match availability\r\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity) | distinct TI_ipEntity;\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n CorrelationId)\r\n on CorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, CallerIpAddress;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId\r\n | distinct CallerIpAddress;\r\n\r\nTI\r\n| join kind=inner hint.strategy = broadcast (correlatedLogs)\r\non $left.TI_ipEntity == $right.CallerIpAddress | distinct CallerIpAddress;",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "b43321b8-99d1-4a2b-891d-02374da17074",
"version": "KqlParameterItem/1.0",
"name": "TIIPCount",
"type": 1,
"isRequired": true,
"query": "print(iff(isempty('{TIIPEntities}'), 'no', \r\ntostring(array_length(parse_json(split('{TIIPEntities}', ','))))))\r\n\r\n",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "70277b70-a538-4d81-b60f-1d73cfdc0bb6",
"version": "KqlParameterItem/1.0",
"name": "assetCounts",
"type": 1,
"query": "//Query purpose - present the num of unique assets that were accessed by an IP addres that is part of Threat Inteligence table\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n CorrelationId)\r\n on CorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where '{TIIPEntities}' has CallerIpAddress and iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, Uri, CallerIpAddress;\r\n\r\nClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId\r\n| distinct Uri\r\n| summarize Count = count()\r\n| project Count = iff(Count == 0, \"No\", tostring(Count));\r\n\r\n",
"isHiddenWhenLocked": true,
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "3b3341df-a8fe-42ba-94ee-4d1f4375babb",
"version": "KqlParameterItem/1.0",
"name": "UserAnomalies",
"type": 1,
"query": "//Get number of anomalies from Anomalies table that were matching to upn entities in accessLogs\r\n\r\nlet anomalies = Anomalies | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end}) | distinct UserPrincipalName, Id | where isnotempty(UserPrincipalName);\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId = CorrelationId\r\n | where strlen(ClassificationDetails)>2 and '*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true));\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId\r\n | join kind=leftouter hint.strategy = shuffle SigninLogs on $left.RequesterObjectId == $right.UserId\r\n | distinct UserPrincipalName;\r\n\r\nanomalies\r\n| join kind=inner hint.strategy = shuffle (correlatedLogs)\r\n on UserPrincipalName \r\n| distinct UserPrincipalName, Id\r\n| summarize countPerUser = count(Id) by UserPrincipalName\r\n| summarize sum = sum(countPerUser)\r\n| project TotalSum = iff(sum == 0, \"No\", tostring(sum))",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "81217188-4340-4281-81bb-8b39b6905493",
"version": "KqlParameterItem/1.0",
"name": "IPAnomalies",
"type": 1,
"query": "//Get number of anomalies from Anomalies table that were matching to IP entities in accessLogs\r\n\r\nlet anomalies = Anomalies | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end}) | distinct SourceIpAddress, AnomalyTemplateId | where isnotempty(SourceIpAddress);\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true));\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId\r\n | distinct CallerIpAddress | where isnotempty(CallerIpAddress);\r\n\r\nanomalies\r\n| join kind=innerunique hint.strategy = shuffle (correlatedLogs)\r\n on $left.SourceIpAddress == $right.CallerIpAddress \r\n| distinct CallerIpAddress, AnomalyTemplateId\r\n| summarize countPerIP = count(AnomalyTemplateId) by CallerIpAddress\r\n| summarize sum = sum(countPerIP)\r\n| project TotalSum = iff(sum == 0, \"No\", tostring(sum))",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "8a446749-7b6a-4aab-9818-7d4d75d34e0b",
"version": "KqlParameterItem/1.0",
"name": "TotalAnomalies",
"type": 1,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"operator": "Default",
"resultValType": "expression",
"resultVal": "{UserAnomalies} + {IPAnomalies}"
}
}
]
},
{
"id": "b37715cd-5cde-4146-8fa8-3028e9fb7a16",
"version": "KqlParameterItem/1.0",
"name": "AnomaliesUserEntities",
"type": 1,
"query": "//Get unique count of user entities that are part of the Anomalies table. Quering 5 days before the time range as recommended by Anomalies team\r\n\r\nlet anomalies = Anomalies | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end}) | distinct UserPrincipalName, AnomalyTemplateId | where isnotempty(UserPrincipalName)\r\n| join kind=leftouter hint.strategy = shuffle SigninLogs on UserPrincipalName\r\n| where isnotempty(UserId)\r\n| distinct UserId;\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, Classifications;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project RequesterObjectId, CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId;\r\n\r\nanomalies\r\n| join kind=innerunique hint.strategy = shuffle (correlatedLogs)\r\n on $left.UserId == $right.RequesterObjectId \r\n| distinct RequesterObjectId",
"isHiddenWhenLocked": true,
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "c90199c6-e62d-4222-b0f5-1c5d645a3339",
"version": "KqlParameterItem/1.0",
"name": "AnomaliesIPEntities",
"type": 1,
"query": "//Get list of entities of anomalies from Anomalies table that were matching to IP entities in accessLogs\r\n\r\nlet anomalies = Anomalies | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end}) | distinct SourceIpAddress, AnomalyTemplateId | where isnotempty(SourceIpAddress);\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, Classifications;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, CallerIpAddress;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct CallerIpAddress | where isnotempty(CallerIpAddress);\r\n\r\nanomalies\r\n| join kind=innerunique hint.strategy = shuffle (correlatedLogs)\r\n on $left.SourceIpAddress == $right.CallerIpAddress \r\n| distinct CallerIpAddress",
"isHiddenWhenLocked": true,
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "933924e5-2e79-4e1d-8cb3-bafbc937d8e0",
"version": "KqlParameterItem/1.0",
"name": "AnomaliesUserEntitiesCount",
"type": 1,
"query": "print(iff(isempty('{AnomaliesUserEntities}'), '0', tostring(array_length(parse_json(split('{AnomaliesUserEntities}', ','))))))",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "27fcedd6-dd33-4353-9df3-7c63ed204b73",
"version": "KqlParameterItem/1.0",
"name": "AnomaliesIPEntitiesCount",
"type": 1,
"query": "print(iff(isempty('{AnomaliesIPEntities}'), '0', tostring(array_length(parse_json(split('{AnomaliesIPEntities}', ','))))))",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "7a53c97b-2715-4f39-99dd-f6b452a4ff50",
"version": "KqlParameterItem/1.0",
"name": "TotalAnomaliesEntitiesCount",
"type": 1,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"operator": "Default",
"resultValType": "expression",
"resultVal": "{AnomaliesUserEntitiesCount} + {AnomaliesIPEntitiesCount}"
}
}
]
},
{
"id": "75c05afe-15e8-49ab-88eb-34deee4db129",
"version": "KqlParameterItem/1.0",
"name": "AssetsWatchList",
"type": 1,
"query": "//get the list of storage accounts that are part of high value assets watchlist\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, Classifications;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, AccountName;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project AccountName;\r\n\r\nlet watchListEntities = _GetWatchlist(\"HighValueAssets\") | project AssetName = tostring(split(tostring([\"Asset Id\"]), \"/\")[8]) | distinct AssetName;\r\n\r\nwatchListEntities \r\n| join kind=innerunique hint.strategy = broadcast\r\ncorrelatedLogs\r\non $left.AssetName == $right.AccountName\r\n| distinct AccountName;",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"version": "KqlParameterItem/1.0",
"name": "AssetsWatchListCount",
"type": 1,
"query": "print(iff(isempty('{AssetsWatchList}'), '0', tostring(array_length(parse_json(split('{AssetsWatchList}', ','))))))",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"id": "6c9fd97c-2e59-4d9a-9be4-0be1c9bf0397"
},
{
"id": "43f219da-9e5b-4ebc-b4e3-e2ea394b3fb7",
"version": "KqlParameterItem/1.0",
"name": "AssetsUsersWatchList",
"type": 1,
"query": "//get the list of AAD accounts that accessed high value asstes\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, Classifications;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where isnotempty(RequesterObjectId)\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, AccountName, RequesterObjectId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project AccountName, RequesterObjectId;\r\n\r\nlet watchListEntities = _GetWatchlist(\"HighValueAssets\") | project AssetName = tostring(split(tostring([\"Asset Id\"]), \"/\")[8]) | distinct AssetName;\r\n\r\nwatchListEntities \r\n| join kind=innerunique hint.strategy = broadcast\r\ncorrelatedLogs\r\non $left.AssetName == $right.AccountName\r\n| distinct RequesterObjectId",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "bedb428b-14f7-4749-a566-b70947567942",
"version": "KqlParameterItem/1.0",
"name": "AssetsUsersWatchListCount",
"type": 1,
"query": "print(iff(isempty('{AssetsUsersWatchList}'), '0', tostring(array_length(parse_json(split('{AssetsUsersWatchList}', ','))))))",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "default"
},
"name": "Insightsparameters "
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let AccessLogs = DSMAzureBlobStorageLogs \r\n| extend UserAccount = iff(isnotempty(RequesterObjectId), RequesterObjectId, iff(isempty(RequesterAppId), 'Anonymous', RequesterAppId)) \r\n | project\r\n TimeGenerated,\r\n UserAccount,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n RequesterAppId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or UserAccount in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project ResourceSubscriptionId, ResourceGroup, AccountName, Uri, UserAccount;\r\n\r\n\r\nlet basicTiles = AccessLogs\r\n| summarize dcount(ResourceSubscriptionId), dcount(ResourceGroup), dcount(AccountName), dcount(Uri), dcount(UserAccount)\r\n| project [\"Subscriptions\"] = dcount_ResourceSubscriptionId, [\"Resource Groups\"] = dcount_ResourceGroup, [\"Sensitive data sources accessed\"] = dcount_AccountName, [\"Sensitive data assets accessed\"] = dcount_Uri, [\"User accounts\"] = dcount_UserAccount\r\n| evaluate narrow()\r\n| extend TableName = replace(@\"\\[|\\]|\\'\", @'', Column)\r\n| extend Count = strcat(Value, \" found in total\")\r\n| project TableName, Count;\r\n\r\nbasicTiles;",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo"
},
"name": "basicTiles"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(ClassificationDetails)>2 and '*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n| extend UserAccount = iff(isnotempty(RequesterObjectId), RequesterObjectId, iff(isempty(RequesterAppId), 'Anonymous', RequesterAppId)) \r\n | project\r\n TimeGenerated,\r\n UserAccount,\r\n RequesterAppId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or UserAccount in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true));\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project-away CorrelationId, CorrelationId1, SensitivityCorrelationId;\r\n\r\nlet clasifiedTiles = correlatedLogs\r\n | summarize dcount(ResourceSubscriptionId), dcount(ResourceGroup), dcount(AccountName), dcount(Uri), dcount(UserAccount)\r\n | project [\"Subscriptions\"] = dcount_ResourceSubscriptionId, [\"Resource Groups\"] = dcount_ResourceGroup, [\"Sensitive data sources accessed\"] = dcount_AccountName, [\"Sensitive data assets accessed\"] = dcount_Uri, [\"User accounts\"] = dcount_UserAccount\r\n| evaluate narrow()\r\n| extend TableName = replace(@\"\\[|\\]|\\'\", @'', Column)\r\n| extend ClassifiedCount = Value\r\n| project TableName, ClassifiedCount;\r\n\r\nclasifiedTiles;",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo"
},
"name": "classifiedTiles"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"304b7d1d-4c7c-4978-b875-820e7e7af33d\",\"mergeType\":\"leftouter\",\"leftTable\":\"basicTiles\",\"rightTable\":\"classifiedTiles\",\"leftColumn\":\"TableName\",\"rightColumn\":\"TableName\"}],\"projectRename\":[{\"originalName\":\"[basicTiles].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"304b7d1d-4c7c-4978-b875-820e7e7af33d\"},{\"originalName\":\"[basicTiles].Count\",\"mergedName\":\"Count\",\"fromId\":\"304b7d1d-4c7c-4978-b875-820e7e7af33d\"},{\"originalName\":\"[classifiedTiles].TableName\",\"mergedName\":\"TableName1\",\"fromId\":\"304b7d1d-4c7c-4978-b875-820e7e7af33d\"},{\"originalName\":\"[classifiedTiles].ClassifiedCount\",\"mergedName\":\"ClassifiedCount\",\"fromId\":\"304b7d1d-4c7c-4978-b875-820e7e7af33d\"}]}",
"size": 3,
"color": "blue",
"exportFieldName": "TableName",
"exportParameterName": "TableName",
"queryType": 7,
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "TableName",
"formatter": 1
},
"rightContent": {
"columnMatch": "ClassifiedCount",
"formatter": 12,
"formatOptions": {
"palette": "auto"
}
},
"secondaryContent": {
"columnMatch": "Count",
"formatter": 1
},
"showBorder": false,
"size": "auto"
}
},
"customWidth": "0",
"showPin": false,
"name": "query - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose = represent KPI cards with data about the access logs.\r\n//Unique count of:Subscriptions, Resource Groups, Sensitive data sources accessed, Sensitive data assets accessed, Classifications accessed, Labels accessed and User Accounts.\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where isnotempty(Classifications) and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| distinct CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project-away CorrelationId, CorrelationId1, SensitivityCorrelationId;\r\n\r\nlet totalClassificationCount = correlatedLogs\r\n | project Classification_Details = Classifications\r\n | mv-expand Classification_Details\r\n | distinct tostring(Classification_Details)\r\n | where ('*' in ({Classification_IS}) or Classification_Details has_any({Classification_IS}))\r\n | count;\r\n\r\n\r\nlet basicTiles = correlatedLogs\r\n| project SensitivityLabelName\r\n| where strlen(SensitivityLabelName) > 2\r\n | summarize dcount(SensitivityLabelName)\r\n | project [\"Classifications accessed\"] = toscalar(totalClassificationCount), [\"Labels accessed\"] = dcount_SensitivityLabelName\r\n| evaluate narrow()\r\n| extend TableName = replace(@\"\\[|\\]|\\'\", @'', Column)\r\n| extend ClassifiedCount = Value\r\n| project TableName, ClassifiedCount;\r\n\r\n\r\nbasicTiles\r\n\r\n",
"size": 3,
"color": "blue",
"exportFieldName": "TableName",
"exportParameterName": "TableName",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "TableName",
"formatter": 1,
"tooltipFormat": {
"tooltip": "{0} with classified content"
}
},
"leftContent": {
"columnMatch": "ClassifiedCount",
"formatter": 12,
"formatOptions": {
"palette": "auto"
}
},
"secondaryContent": {
"columnMatch": "Count"
},
"showBorder": false,
"sortOrderField": 1,
"size": "auto"
},
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Subscriptions",
"formatter": 1,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
},
"tooltipFormat": {
"tooltip": "Subscriptions"
}
},
"centerContent": {
"columnMatch": "Subscriptions",
"formatter": 1
},
"nodeIdField": "Subscriptions",
"sourceIdField": "Subscriptions",
"targetIdField": "Subscriptions",
"graphOrientation": 3,
"showOrientationToggles": false,
"edgeLabel": "Subscriptions",
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": null,
"hivesMargin": 5
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Subscriptions",
"sizeAggregation": "Sum",
"legendMetric": "Subscriptions",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Subscriptions",
"heatmapPalette": "greenRed"
}
},
"textSettings": {
"style": "header"
}
},
"customWidth": "0",
"showPin": true,
"name": "KPI cards - Classifications",
"styleSettings": {
"maxWidth": "100"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose = represent KPI cards with data about the access logs.\r\n//Unique count of:Subscriptions, Resource Groups, Sensitive data sources accessed, Sensitive data assets accessed, Classifications accessed, Labels accessed and User Accounts.\r\nlet ExtraTiles = datatable(TableName: string, Count: string, tabName: string, expectedTab: string) \r\n [\r\n \"Watchlist(s) match\", '{WatchListCount}', '{TabName}', 'UserAccount',\r\n \"User Anomalies match\", '{AnomaliesUserEntitiesCount}', '{TabName}', 'UserAccount',\r\n \"IP Anomalies match\", '{AnomaliesIPEntitiesCount}', '{TabName}', 'IPAddress',\r\n \"TI match\", '{TIIPCount}', '{TabName}', 'IPAddress'\r\n ]\r\n | where tabName == expectedTab\r\n | project TableName, Count;\r\n\r\n\r\n\r\nExtraTiles | project TableName, ClassifiedCount = iff(Count =~ \"no\", \"0\", Count)\r\n//| project TableName, Count = iff(isempty(ClassifiedCount), \"\", strcat(Count, \" found in total\")), ClassifiedCount = iff(isnotempty(ClassifiedCount), ClassifiedCount, Count)\r\n\r\n",
"size": 3,
"color": "blue",
"exportFieldName": "TableName",
"exportParameterName": "TableName",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "TableName",
"formatter": 1,
"tooltipFormat": {
"tooltip": "{0} with classified content"
}
},
"leftContent": {
"columnMatch": "ClassifiedCount",
"formatter": 12,
"formatOptions": {
"palette": "auto",
"templateRunContext": {
"componentIdSource": "parameter",
"templateUriSource": "static",
"templateParameters": [],
"titleSource": "static",
"descriptionSource": "static",
"description": "",
"runLabelSource": "static"
},
"bladeOpenContext": {
"bladeParameters": []
}
}
},
"secondaryContent": {
"columnMatch": "Count"
},
"showBorder": false,
"sortOrderField": 1,
"size": "auto"
},
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Subscriptions",
"formatter": 1,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
},
"tooltipFormat": {
"tooltip": "Subscriptions"
}
},
"centerContent": {
"columnMatch": "Subscriptions",
"formatter": 1
},
"nodeIdField": "Subscriptions",
"sourceIdField": "Subscriptions",
"targetIdField": "Subscriptions",
"graphOrientation": 3,
"showOrientationToggles": false,
"edgeLabel": "Subscriptions",
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": null,
"hivesMargin": 5
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Subscriptions",
"sizeAggregation": "Sum",
"legendMetric": "Subscriptions",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Subscriptions",
"heatmapPalette": "greenRed"
}
},
"textSettings": {
"style": "header"
}
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isNotEqualTo",
"value": "Summary"
},
"showPin": true,
"name": "KPI cards - aditional",
"styleSettings": {
"maxWidth": "100"
}
}
],
"exportParameters": true
},
"customWidth": "100",
"name": "Tiles"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n AuthenticationType,\r\n CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, ResourceSubscriptionId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId;\r\n\r\ncorrelatedLogs \r\n| distinct ResourceSubscriptionId",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Nothing"
},
"name": "DSTIMSubscriptions"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resourcecontainers\r\n| project id, subscriptionId, type, tags\r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has subscriptionId\r\n| where type == \"microsoft.resources/subscriptions\"",
"size": 0,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"value::all"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "SubscriptionName",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
}
]
},
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "ResourceSubscriptions"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"74022f16-9973-482c-a7df-962934df00a4\",\"mergeType\":\"innerunique\",\"leftTable\":\"DSTIMSubscriptions\",\"rightTable\":\"ResourceSubscriptions\",\"leftColumn\":\"ResourceSubscriptionId\",\"rightColumn\":\"subscriptionId\"}],\"projectRename\":[{\"originalName\":\"[ResourceSubscriptions].id\",\"mergedName\":\"id\",\"fromId\":\"74022f16-9973-482c-a7df-962934df00a4\"},{\"originalName\":\"[DSTIMSubscriptions].ResourceSubscriptionId\",\"mergedName\":\"ResourceSubscriptionId\",\"fromId\":\"74022f16-9973-482c-a7df-962934df00a4\"},{\"originalName\":\"[ResourceSubscriptions].tags\",\"mergedName\":\"tags\",\"fromId\":\"74022f16-9973-482c-a7df-962934df00a4\"},{\"originalName\":\"[ResourceSubscriptions].name\"},{\"originalName\":\"[ResourceSubscriptions].type\"},{\"originalName\":\"[ResourceSubscriptions].kind\"},{\"originalName\":\"[ResourceSubscriptions].location\"},{\"originalName\":\"[ResourceSubscriptions].resourceGroup\"},{\"originalName\":\"[ResourceSubscriptions].subscriptionId\"},{\"originalName\":\"[ResourceSubscriptions].sku\"},{\"originalName\":\"[ResourceSubscriptions].plan\"},{\"originalName\":\"[ResourceSubscriptions].identity\"},{\"originalName\":\"[ResourceSubscriptions].zones\"},{\"originalName\":\"[ResourceSubscriptions].tenantId\"},{\"originalName\":\"[ResourceSubscriptions].managedBy\"},{\"originalName\":\"[ResourceSubscriptions].properties\"},{\"originalName\":\"[ResourceSubscriptions].extendedLocation\"}]}",
"size": 1,
"title": "Subscription Details",
"showRefreshButton": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "id",
"formatter": 15,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": true,
"showIcon": true
}
}
],
"labelSettings": [
{
"columnId": "id",
"label": "Name"
},
{
"columnId": "ResourceSubscriptionId",
"label": "Id"
}
]
}
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Subscriptions"
},
"name": "SubscriptionsView",
"styleSettings": {
"maxWidth": "50"
}
}
]
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Subscriptions"
},
"name": "SubscriptionViewGroup",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resourcecontainers\r\n| project id, name, type, subscriptionId, location, tags\r\n| where \"'*'\" == \"{ResourceGroup_IS}\" or name in ({ResourceGroup_IS})\r\n| where type == \"microsoft.resources/subscriptions/resourcegroups\"\r\n\r\n",
"size": 0,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"value::all"
],
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "Resourcegroups"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications) > 2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n AuthenticationType,\r\n CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true));\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId;\r\n\r\ncorrelatedLogs \r\n| distinct ResourceGroup",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "DSTIMResourcegroups"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"c7ec72da-8ab1-489f-a46b-d79d6489c082\",\"mergeType\":\"innerunique\",\"leftTable\":\"DSTIMResourcegroups\",\"rightTable\":\"Resourcegroups\",\"leftColumn\":\"ResourceGroup\",\"rightColumn\":\"name\"}],\"projectRename\":[{\"originalName\":\"[Resourcegroups].id\",\"mergedName\":\"Resource Group Name\",\"fromId\":\"c7ec72da-8ab1-489f-a46b-d79d6489c082\"},{\"originalName\":\"[Resourcegroups].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"c7ec72da-8ab1-489f-a46b-d79d6489c082\"},{\"originalName\":\"[Resourcegroups].location\",\"mergedName\":\"location\",\"fromId\":\"c7ec72da-8ab1-489f-a46b-d79d6489c082\"},{\"originalName\":\"[Resourcegroups].tags\",\"mergedName\":\"tags\",\"fromId\":\"c7ec72da-8ab1-489f-a46b-d79d6489c082\"},{\"originalName\":\"[DSTIMResourcegroups].ResourceGroup\"},{\"originalName\":\"[Resourcegroups].name\"},{\"originalName\":\"[Resourcegroups].type\"},{\"originalName\":\"[Resourcegroups].tenantId\"},{\"originalName\":\"[Resourcegroups].kind\"},{\"originalName\":\"[Resourcegroups].resourceGroup\"},{\"originalName\":\"[Resourcegroups].managedBy\"},{\"originalName\":\"[Resourcegroups].sku\"},{\"originalName\":\"[Resourcegroups].plan\"},{\"originalName\":\"[Resourcegroups].properties\"},{\"originalName\":\"[Resourcegroups].identity\"},{\"originalName\":\"[Resourcegroups].zones\"},{\"originalName\":\"[Resourcegroups].extendedLocation\"}]}",
"size": 1,
"title": "Resource Group Details",
"showRefreshButton": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Resource Group Name",
"formatter": 14,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": true,
"showIcon": true
}
},
{
"columnMatch": "subscriptionId",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
}
],
"labelSettings": [
{
"columnId": "Resource Group Name",
"label": "Name"
},
{
"columnId": "subscriptionId",
"label": "Subscription Name"
},
{
"columnId": "location",
"label": "Location"
},
{
"columnId": "tags",
"label": "Tags"
}
]
}
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Resource Groups"
},
"name": "ResourceGroupView",
"styleSettings": {
"maxWidth": "50"
}
}
],
"exportParameters": true
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Resource Groups"
},
"name": "ResourceGroupViewGroup",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Resources\r\n| project id, name, subscriptionId, resourceGroup, type, tags, location\r\n| where '*' == '{Subcriptions_IS:id}' or '{Subcriptions_IS:id}' has subscriptionId\r\n| where \"'*'\" == \"{ResourceGroup_IS}\" or resourceGroup in~ ({ResourceGroup_IS})\r\n| where type =~ 'Microsoft.Storage/storageAccounts'\r\n",
"size": 0,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"value::all"
],
"gridSettings": {
"filter": true,
"sortBy": [
{
"itemKey": "subscriptionId",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "subscriptionId",
"sortOrder": 1
}
]
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "StorageAccounts"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications) > 2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n AuthenticationType,\r\n CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, AccountName;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId;\r\n\r\ncorrelatedLogs \r\n| distinct AccountName",
"size": 0,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "DSTIMStorageAccounts"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\",\"mergeType\":\"innerunique\",\"leftTable\":\"DSTIMStorageAccounts\",\"rightTable\":\"StorageAccounts\",\"leftColumn\":\"AccountName\",\"rightColumn\":\"name\"}],\"projectRename\":[{\"originalName\":\"[StorageAccounts].id\",\"mergedName\":\"Name\",\"fromId\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\"},{\"originalName\":\"[StorageAccounts].location\",\"mergedName\":\"Location\",\"fromId\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\"},{\"originalName\":\"[StorageAccounts].tags\",\"mergedName\":\"Tags\",\"fromId\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\"},{\"originalName\":\"[StorageAccounts].subscriptionId\",\"mergedName\":\"Subscription Name\",\"fromId\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\"},{\"originalName\":\"[StorageAccounts].resourceGroup\",\"mergedName\":\"Resource Group\",\"fromId\":\"131846c4-cbc1-4e64-a5db-b914d56ed094\"},{\"originalName\":\"[StorageAccounts].extendedLocation\"},{\"originalName\":\"[StorageAccounts].zones\"},{\"originalName\":\"[StorageAccounts].identity\"},{\"originalName\":\"[StorageAccounts].properties\"},{\"originalName\":\"[StorageAccounts].plan\"},{\"originalName\":\"[StorageAccounts].sku\"},{\"originalName\":\"[StorageAccounts].managedBy\"},{\"originalName\":\"[StorageAccounts].kind\"},{\"originalName\":\"[StorageAccounts].tenantId\"},{\"originalName\":\"[StorageAccounts].type\"},{\"originalName\":\"[StorageAccounts].name\"},{\"originalName\":\"[DSTIMStorageAccounts].AccountName\"}]}",
"size": 1,
"title": "Data Source Details",
"showRefreshButton": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Name",
"formatter": 13,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": true,
"showIcon": true
}
},
{
"columnMatch": "Subscription Name",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Group",
"formatter": 14,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "subscriptionId",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
}
]
}
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Sensitive data sources accessed"
},
"name": "StorageAccountsView",
"styleSettings": {
"maxWidth": "50"
}
}
],
"exportParameters": true
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Sensitive data sources accessed"
},
"name": "StorageAccountViewGroup",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//get distinct list of user accounts including user authentication or app id authentication.\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId = CorrelationId\r\n | where strlen(Classifications)>2 and '*' in ({Classification_IS}) or Classifications has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n AuthenticationType,\r\n CorrelationId = CorrelationId\r\n | where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| distinct RequesterAppId, RequesterObjectId, AuthenticationType, CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on CorrelationId\r\n | distinct RequesterAppId, RequesterObjectId, AuthenticationType\r\n | summarize AuthenticationTypeSet = make_set(AuthenticationType), RequesterAppId = take_any(RequesterAppId) by RequesterObjectId\r\n | project AuthenticationType = trim(@'\\[|\\]|\\\"', tostring(AuthenticationTypeSet)), RequesterAppId, RequesterObjectId;\r\n\r\ncorrelatedLogs",
"size": 4,
"title": "User Account Details",
"showRefreshButton": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"sortBy": []
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "UserAccountView",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"a9210b06-7611-4a25-8da0-28a5a0f5b4f9\",\"mergeType\":\"innerunique\",\"leftTable\":\"UserAccounts\",\"rightTable\":\"UserAccountView\",\"leftColumn\":\"RequesterObjectId\",\"rightColumn\":\"RequesterObjectId\"}],\"projectRename\":[{\"originalName\":\"[UserAccounts].AccountDisplayName\",\"mergedName\":\"AccountDisplayName\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b4f9\"},{\"originalName\":\"[UserAccountView].AuthenticationType\",\"mergedName\":\"AuthenticationType\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b4f9\"},{\"originalName\":\"[UserAccountView].RequesterAppId\",\"mergedName\":\"RequesterAppId1\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b4f9\"},{\"originalName\":\"[UserAccountView].RequesterObjectId\",\"mergedName\":\"RequesterObjectId1\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b4f9\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\"},{\"originalName\":\"[UserAccounts].RequesterAppId\"}]}",
"size": 3,
"title": "User Account Details",
"showRefreshButton": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "AccountDisplayName",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkIsContextBlade": true,
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "RequesterObjectId1"
}
]
}
}
},
{
"columnMatch": "AuthenticationType",
"formatter": 1,
"formatOptions": {
"aggregation": "Min"
}
}
],
"labelSettings": [
{
"columnId": "AccountDisplayName",
"label": "Name"
},
{
"columnId": "RequesterAppId1",
"label": "App Id"
},
{
"columnId": "RequesterObjectId1",
"label": "AAD Object Id"
}
]
},
"sortBy": []
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "User accounts"
},
"name": "UserAccountViewMerge",
"styleSettings": {
"maxWidth": "50"
}
}
],
"exportParameters": true
},
"customWidth": "0",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "User accounts"
},
"name": "UserAccountViewGroup",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//query purpose - get count of IP addresses that are part of threat inteligenceIndicator list.\r\nlet TIIP = ThreatIntelligenceIndicator\r\n| where TimeGenerated <= {TimeRange_IS:end} and ExpirationDateTime > {TimeRange_IS:start}\r\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n// Picking up only IOC's that contain the entities we want\r\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\r\n// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\r\n// Taking the first non-empty value based on potential IOC match availability\r\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity) \r\n| distinct TI_ipEntity, DomainName, ThreatType, ConfidenceScore, SourceSystem, LatestIndicatorTime, Active, Description, Tags\r\n| where '{TIIPEntities}' has TI_ipEntity\r\n| summarize ConfidenceScore = max(ConfidenceScore), ThreatType = make_set(ThreatType), DomainName = make_set(tostring(DomainName)), Description=make_set(Description), Tags = make_set(Tags), SourceSystem = make_set(SourceSystem) by TI_ipEntity, Active, LatestIndicatorTime\r\n| join hint.strategy = shuffle (SigninLogs) on $left.TI_ipEntity == $right.IPAddress\r\n| extend Geolocation = tostring(LocationDetails.countryOrRegion), Latitude = tostring(LocationDetails.geoCoordinates.latitude), Longitude = tostring(LocationDetails.geoCoordinates.longitude)\r\n| extend Latitude = tostring(LocationDetails.geoCoordinates.latitude)\r\n| extend Longitude = tostring(LocationDetails.geoCoordinates.longitude)\r\n| summarize Geolocation = take_any(Geolocation), Latitude = take_any(Latitude), Longitude = take_any(Longitude), ConfidenceScore = max(ConfidenceScore), ThreatType = replace(@'\\[|\\]|\\\"', @'', take_any(tostring(ThreatType))), DomainName = replace(@'\\[|\\]|\\\"', @'', take_any(tostring(DomainName))), SourceSystem = replace(@'\\[|\\]|\\\"', @'', take_any(tostring(SourceSystem))), Tags = replace(@'\\[|\\]|\\\"', @'', take_any(tostring(Tags))) by TI_ipEntity, Active, LatestIndicatorTime;\r\nTIIP",
"size": 1,
"showAnalytics": true,
"title": "Sensitive data access done by IP address with TI match",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Description",
"formatter": 5
}
],
"sortBy": [
{
"itemKey": "SourceSystem",
"sortOrder": 1
}
],
"labelSettings": [
{
"columnId": "TI_ipEntity",
"label": "IP address"
},
{
"columnId": "ConfidenceScore",
"label": "Confidence"
},
{
"columnId": "ThreatType",
"label": "Threat type"
},
{
"columnId": "DomainName",
"label": "Domain"
},
{
"columnId": "SourceSystem",
"label": "Source"
}
]
},
"sortBy": [
{
"itemKey": "SourceSystem",
"sortOrder": 1
}
]
},
"customWidth": "0",
"conditionalVisibilities": [
{
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "TI match"
},
{
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "IPAddress"
}
],
"name": "TIIPExtendedInfo",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of entities that are part of one or more of this watchlists: \"VIPUsers\", \"TerminatedEmployees\"\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId\r\n| distinct CorrelationId, Uri, RequesterObjectId;\r\n\r\nlet usersCorrelatedLogs = AccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId, Uri, ClassificationDetails;\r\n\r\nlet usersClassifications = usersCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by RequesterObjectId;\r\n\t\r\nlet watchlistUsers = (_GetWatchlist(\"VIPUsers\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"VIP Users\"\r\n | union (_GetWatchlist(\"TerminatedEmployees\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"Terminated Employees\"));\r\n\t \r\nlet usersSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | where Entities has_any(split('{WatchListEntities}', \", \"))\r\n | mv-expand entities = todynamic(Entities)\r\n | project AlertUser = tostring(entities.['DisplayName']), SystemAlertId, IsIncident\r\n | where '{WatchListEntities}' has AlertUser)\r\n | distinct AlertUser, SystemAlertId, IsIncident; \r\n\r\nlet UserAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct UserPrincipalName, Id;\r\n\r\nlet userDispplayName = SigninLogs\r\n | where UserId != UserDisplayName and '{WatchListEntities}' has UserId\r\n | distinct UserId, UserDisplayName, UserPrincipalName;\r\n\r\nlet UserExtendedInsights = usersClassifications\r\n | join kind=inner watchlistUsers\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter userDispplayName\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter UserAnomalies\r\n on $left.UserPrincipalName == $right.UserPrincipalName\r\n | join kind=leftouter usersSecurityAlerts\r\n on $left.UserPrincipalName == $right.AlertUser\r\n | distinct\r\n UserDisplayName,\r\n Instances,\r\n tostring(class_list),\r\n UserId,\r\n watchList,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcountif(Id, isnotempty(Id)),\r\n watchListNames = make_set(watchList),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by UserDisplayName, UserId\r\n | project\r\n Entity = UserDisplayName,\r\n Type = \"User Account\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = trim(@'\\[|\\]|\\\"', iff(watchListNames == '[]', 'N/A', watchListNames)),\r\n ThreatType = 'N/A',\r\n Anomalies,\r\n Alerts,\r\n Incidents, \r\n UserId; \r\n\r\n UserExtendedInsights",
"size": 1,
"title": "Watchlist(s) user entities details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Entity",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkIsContextBlade": true,
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "UserId"
}
]
}
}
},
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "UserId",
"formatter": 5
}
],
"labelSettings": [
{
"columnId": "Entity",
"label": "Name"
},
{
"columnId": "ThreatType",
"label": "Threat type"
}
]
}
},
"customWidth": "0",
"conditionalVisibilities": [
{
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "UserAccount"
},
{
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "Watchlist(s) match"
}
],
"name": "UserWatchList",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of user entities that are part Anomalies table. Correlate with matching watchlist, alerts and incident.\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS});\r\n\r\nlet usersAccessLogs = AccessLogs\r\n | where (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId)\r\n | distinct CorrelationId, Uri, RequesterObjectId;\r\n\r\nlet usersCorrelatedLogs = usersAccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId, Uri, ClassificationDetails;\r\n\r\nlet usersClassifications = usersCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by RequesterObjectId;\r\n\t\r\nlet watchlistUsers = (_GetWatchlist(\"VIPUsers\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"VIP Users\"\r\n | union (_GetWatchlist(\"TerminatedEmployees\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"Terminated Employees\"));\r\n\t \r\nlet usersSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | where Entities has_any(split('{AnomaliesUserEntities}', \", \"))\r\n | mv-expand entities = todynamic(Entities)\r\n | project AlertUser = tostring(entities.['DisplayName']), SystemAlertId, IsIncident\r\n | distinct AlertUser, SystemAlertId, IsIncident\r\n | where '{AnomaliesUserEntities}' has AlertUser);\r\n\r\nlet UserAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct UserPrincipalName, Id;\r\n\r\nlet userDispplayName = SigninLogs\r\n | where UserId != UserDisplayName and '{AnomaliesUserEntities}' has UserId\r\n | distinct UserId, UserDisplayName, UserPrincipalName;\r\n\r\nlet UserExtendedAnomalies = usersClassifications\r\n | join kind=inner (UserAnomalies\r\n | join kind=leftouter userDispplayName\r\n on $left.UserPrincipalName == $right.UserPrincipalName)\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter watchlistUsers\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter usersSecurityAlerts\r\n on $left.UserPrincipalName == $right.AlertUser\r\n | distinct\r\n UserDisplayName,\r\n Instances,\r\n tostring(class_list),\r\n UserId,\r\n watchList,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcountif(Id, isnotempty(Id)),\r\n watchListNames = make_set(watchList),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by UserDisplayName, UserId\r\n | project\r\n Entity = UserDisplayName,\r\n Type = \"User Account\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = trim(@'\\[|\\]|\\\"', iff(watchListNames == '[]', 'N/A', watchListNames)),\r\n ThreatType = 'N/A',\r\n Anomalies,\r\n Alerts,\r\n Incidents, \r\n UserId; \r\n\r\nUserExtendedAnomalies",
"size": 1,
"title": "Anomalies user entities details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Entity",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkIsContextBlade": true,
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "UserId"
}
]
}
}
},
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "UserId",
"formatter": 5
}
]
}
},
"customWidth": "0",
"conditionalVisibilities": [
{
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "UserAccount"
},
{
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "User Anomalies match"
}
],
"name": "UserAnomaliesDetails",
"styleSettings": {
"maxWidth": "50"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of IP entities that are part Anomalies table. Correlate with matching threatIntelligence, alerts and incident.\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS});\r\n\r\nlet ipsAccessLogs = AccessLogs\r\n | where '{AnomaliesIPEntities}' has CallerIpAddress\r\n | distinct CorrelationId, Uri, CallerIpAddress;\r\nlet ipsCorrelatedLogs = ipsAccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct CallerIpAddress, Uri, ClassificationDetails;\r\nlet ipsClassifications = ipsCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by CallerIpAddress;\r\n\t\r\nlet TIIP = ThreatIntelligenceIndicator\r\n| where TimeGenerated <= {TimeRange_IS:end} and ExpirationDateTime > {TimeRange_IS:start}\r\n | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n // Picking up only IOC's that contain the entities we want\r\n | where isnotempty(NetworkIP)\r\n or isnotempty(EmailSourceIpAddress)\r\n or isnotempty(NetworkDestinationIP)\r\n or isnotempty(NetworkSourceIP)\r\n // As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\r\n // Taking the first non-empty value based on potential IOC match availability\r\n | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\r\n | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\r\n | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity) \r\n | distinct TI_ipEntity, ThreatType;\r\n\t \r\nlet ipsSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | mv-expand entities = todynamic(Entities)\r\n | project IpAddress = tostring(todynamic(ExtendedProperties).['IpAddress']), SystemAlertId, IsIncident\r\n | distinct IpAddress, SystemAlertId, IsIncident\r\n | where '{AnomaliesIPEntities}' has IpAddress); \r\n\r\nlet IPAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct SourceIpAddress, Id;\r\n\r\nlet IPExtendedAnomalies = ipsClassifications\r\n | join kind=inner IPAnomalies\r\n on $left.CallerIpAddress == $right.SourceIpAddress\r\n | join kind=leftouter TIIP\r\n on $left.CallerIpAddress == $right.TI_ipEntity\r\n | join kind=leftouter ipsSecurityAlerts\r\n on $left.CallerIpAddress == $right.IpAddress\r\n | distinct\r\n CallerIpAddress,\r\n Instances,\r\n tostring(class_list),\r\n ThreatType,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcountif(Id, isnotempty(Id)),\r\n ThreatType = make_set(ThreatType),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by CallerIpAddress\r\n | project\r\n Entity = CallerIpAddress,\r\n Type = \"IP Address\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = 'N/A',\r\n ThreatType = trim(@'\\[|\\]|\\\"', iff(ThreatType == '[\"\"]', 'N/A', ThreatType)),\r\n Anomalies,\r\n Alerts,\r\n Incidents; \r\n\r\nIPExtendedAnomalies",
"size": 1,
"title": "IP entities matching anomalies",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "0",
"conditionalVisibilities": [
{
"parameterName": "TableName",
"comparison": "isEqualTo",
"value": "IP Anomalies match"
},
{
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "IPAddress"
}
],
"name": "IpAnomaliesDetails",
"styleSettings": {
"maxWidth": "50"
}
}
],
"exportParameters": true
},
"customWidth": "0",
"name": "KPI Cards",
"styleSettings": {
"margin": "0px",
"padding": "0px 30px",
"maxWidth": "100%"
}
},
{
"type": 1,
"content": {
"json": "----\r\n## Insights"
},
"name": "break - Copy",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "####  Insights based on investigation scope"
},
"name": "text - 1",
"styleSettings": {
"padding": "0px 10px"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "28f5ce79-5c16-4482-88b9-298e5377d293",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{TotalAnomaliesEntitiesCount}",
"subTarget": "Anomalies",
"preText": "{TotalAnomalies} anomalies were found pertaining to ",
"postText": "entities",
"style": "link"
},
{
"id": "5f2a4594-a96b-42b6-bdbc-1277b002412d",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{TIIPCount}",
"subTarget": "TIIP",
"preText": "{assetCounts} sensitive files were accessed from ",
"postText": "IP addreses with TI match.",
"style": "link"
},
{
"id": "ff467669-c54e-4e3e-b87d-d4101e7d5fd6",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{WatchListCount}",
"subTarget": "WatchList",
"preText": "",
"postText": " entities are part of Built-in Watchlist(s).",
"style": "link"
},
{
"id": "00af4dee-3943-43c0-bb09-6f26d87c0f43",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{AssetsWatchListCount}",
"subTarget": "HighValueAssets",
"preText": "{AssetsUsersWatchListCount} user accounts accessed sensitive data from",
"postText": "Azure resources that are part of \"High Value Assets\" watchlist.",
"style": "link"
}
]
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "TotalAnomalies",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "99ec4f7a-0b38-4abd-8b62-e88b28ed9b00",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{AnomaliesIPEntitiesCount}",
"subTarget": "Anomalies",
"preText": "{IPAnomalies} anomalies were found pertaining to ",
"postText": "entities",
"style": "link"
},
{
"id": "f46d8efd-0c37-4c73-aea2-a5f7fa0aa4f4",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{TIIPCount}",
"subTarget": "TIIP",
"preText": "{assetCounts} sensitive files were accessed from ",
"postText": "IP addreses with TI match.",
"style": "link"
}
]
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "IPAddress"
},
"name": "IPAnomalies",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "18fc1e15-b469-470d-9144-284e622c9468",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{AnomaliesUserEntitiesCount}",
"subTarget": "Anomalies",
"preText": "{UserAnomalies} anomalies were found pertaining to ",
"postText": "entities",
"style": "link"
},
{
"id": "f8db5ab2-1ec5-4ebf-9fcb-8bff4fc1a0c6",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{WatchListCount}",
"subTarget": "WatchList",
"preText": "",
"postText": " entities are part of Built-in Watchlist(s).",
"style": "link"
},
{
"id": "a3239369-b097-4d40-a904-ced5b55ab121",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "{AssetsWatchListCount}",
"subTarget": "HighValueAssets",
"preText": "{AssetsUsersWatchListCount} user accounts accessed sensitive data from",
"postText": "Azure resources that are part of \"High Value Assets\" watchlist.",
"style": "link"
}
]
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "UserAccount"
},
"name": "UserAccountAnomalies",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "0391b466-1c76-4987-beb2-02253d0d2e13",
"cellValue": "LinkName",
"linkTarget": "parameter",
"linkLabel": "Click here to reset insights filters",
"subTarget": "default",
"style": "secondary"
}
]
},
"name": "links - 5",
"styleSettings": {
"margin": "5px"
}
}
],
"exportParameters": true
},
"name": "InsightsLinks",
"styleSettings": {
"padding": "0px 10px"
}
}
],
"exportParameters": true
},
"customWidth": "25",
"name": "InsightsView",
"styleSettings": {
"padding": "0px",
"maxWidth": "25%"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of entities that are part of one or more of this watchlists: \"VIPUsers\", \"TerminatedEmployees\"\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(tostring(ClassificationDetails))>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId\r\n| distinct CorrelationId, Uri, RequesterObjectId;\r\n\r\nlet usersCorrelatedLogs = AccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId, Uri, ClassificationDetails;\r\n\r\nlet usersClassifications = usersCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by RequesterObjectId;\r\n\t\r\nlet watchlistUsers = (_GetWatchlist(\"VIPUsers\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"VIP Users\"\r\n | union (_GetWatchlist(\"TerminatedEmployees\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"Terminated Employees\"));\r\n\t \r\nlet usersSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | where Entities has_any(split('{WatchListEntities}', \", \"))\r\n | mv-expand entities = todynamic(Entities)\r\n | project AlertUser = tostring(entities.['DisplayName']), SystemAlertId, IsIncident\r\n | where '{WatchListEntities}' has AlertUser)\r\n | distinct AlertUser, SystemAlertId, IsIncident; \r\n\r\nlet UserAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct UserPrincipalName, Id;\r\n\r\nlet userDispplayName = SigninLogs\r\n | where UserId != UserDisplayName and '{WatchListEntities}' has UserId\r\n | distinct UserId, UserDisplayName, UserPrincipalName;\r\n\r\nlet UserExtendedInsights = usersClassifications\r\n | join kind=inner watchlistUsers\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter userDispplayName\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter UserAnomalies\r\n on $left.UserPrincipalName == $right.UserPrincipalName\r\n | join kind=leftouter usersSecurityAlerts\r\n on $left.UserPrincipalName == $right.AlertUser\r\n | distinct\r\n UserDisplayName,\r\n Instances,\r\n tostring(class_list),\r\n UserId,\r\n watchList,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcountif(Id, isnotempty(Id)),\r\n watchListNames = make_set(watchList),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by UserDisplayName, UserId\r\n | project\r\n Entity = UserDisplayName,\r\n Type = \"User Account\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = trim(@'\\[|\\]|\\\"', iff(watchListNames == '[]', 'N/A', watchListNames)),\r\n ThreatType = 'N/A',\r\n Anomalies,\r\n Alerts,\r\n Incidents, \r\n UserId; \r\n\r\n UserExtendedInsights",
"size": 1,
"showAnalytics": true,
"title": "Watchlists Entities Details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Entity",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkIsContextBlade": true,
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "UserId"
}
]
}
}
},
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "UserId",
"formatter": 5
},
{
"columnMatch": "UserProfile",
"formatter": 5
}
],
"labelSettings": [
{
"columnId": "Entity",
"label": "Name"
},
{
"columnId": "ThreatType",
"label": "Threat type"
}
]
}
},
"customWidth": "100",
"conditionalVisibility": {
"parameterName": "LinkName",
"comparison": "isEqualTo",
"value": "WatchList"
},
"name": "WatchListQuery",
"styleSettings": {
"maxWidth": "100%"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of entities that are part Anomalies table, for both user entities and IP entities.Correlate with matching watchlist, threatIntelligence, alerts and incident.\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where '*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS})\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS});\r\n\r\nlet usersAccessLogs = AccessLogs\r\n | where (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId)\r\n | distinct CorrelationId, Uri, RequesterObjectId;\r\n\r\n//broadcast hint is used, consider changing it in case there is a performance degredation.\r\nlet usersCorrelatedLogs = usersAccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId, Uri, ClassificationDetails;\r\n\r\nlet usersClassifications = usersCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by RequesterObjectId;\r\n\t\r\nlet watchlistUsers = (_GetWatchlist(\"VIPUsers\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"VIP Users\"\r\n | union (_GetWatchlist(\"TerminatedEmployees\")\r\n | project UserId = tostring([\"User AAD Object Id\"])\r\n | distinct UserId\r\n | extend watchList = \"Terminated Employees\"));\r\n\t \r\nlet usersSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | where Entities has_any(split('{AnomaliesUserEntities}', \", \"))\r\n | mv-expand entities = todynamic(Entities)\r\n | project AlertUser = tostring(entities.['DisplayName']), SystemAlertId, IsIncident\r\n | distinct AlertUser, SystemAlertId, IsIncident\r\n | where '{AnomaliesUserEntities}' has AlertUser);\r\n\r\nlet UserAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct UserPrincipalName, Id;\r\n\r\nlet userDispplayName = SigninLogs\r\n | where UserId != UserDisplayName and '{AnomaliesUserEntities}' has UserId\r\n | distinct UserId, UserDisplayName, UserPrincipalName;\r\n \r\nlet UserExtendedAnomalies = usersClassifications\r\n | join kind=inner (UserAnomalies\r\n | join kind=leftouter userDispplayName\r\n on $left.UserPrincipalName == $right.UserPrincipalName)\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter watchlistUsers\r\n on $left.RequesterObjectId == $right.UserId\r\n | join kind=leftouter usersSecurityAlerts\r\n on $left.UserPrincipalName == $right.AlertUser\r\n | distinct\r\n UserDisplayName,\r\n Instances,\r\n tostring(class_list),\r\n UserId,\r\n watchList,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcount(Id),\r\n watchListNames = make_set(watchList),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by UserDisplayName, UserId\r\n | project\r\n Entity = UserDisplayName,\r\n Type = \"User Account\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = trim(@'\\[|\\]|\\\"', iff(watchListNames == '[]', 'N/A', watchListNames)),\r\n ThreatType = 'N/A',\r\n Anomalies,\r\n Alerts,\r\n Incidents, \r\n UserId; \r\n\r\nlet ipsAccessLogs = AccessLogs\r\n | where '{AnomaliesIPEntities}' has CallerIpAddress\r\n | distinct CorrelationId, Uri, CallerIpAddress;\r\n\r\n//broadcast hint is used, consider changing it in case there is a performance degredation.\r\nlet ipsCorrelatedLogs = ipsAccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct CallerIpAddress, Uri, ClassificationDetails;\r\n\r\nlet ipsClassifications = ipsCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by CallerIpAddress;\r\n\t\r\nlet TIIP = ThreatIntelligenceIndicator\r\n| where TimeGenerated <= {TimeRange_IS:end} and ExpirationDateTime > {TimeRange_IS:start}\r\n | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n // Picking up only IOC's that contain the entities we want\r\n | where isnotempty(NetworkIP)\r\n or isnotempty(EmailSourceIpAddress)\r\n or isnotempty(NetworkDestinationIP)\r\n or isnotempty(NetworkSourceIP)\r\n // As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\r\n // Taking the first non-empty value based on potential IOC match availability\r\n | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\r\n | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\r\n | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity) \r\n | distinct TI_ipEntity, ThreatType;\r\n\t \r\nlet ipsSecurityAlerts = (SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | mv-expand entities = todynamic(Entities)\r\n | project IpAddress = tostring(todynamic(ExtendedProperties).['IpAddress']), SystemAlertId, IsIncident\r\n | distinct IpAddress, SystemAlertId, IsIncident\r\n | where '{AnomaliesIPEntities}' has IpAddress); \r\n\r\nlet IPAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct SourceIpAddress, Id;\r\n\r\nlet IPExtendedAnomalies = ipsClassifications\r\n | join kind=inner IPAnomalies\r\n on $left.CallerIpAddress == $right.SourceIpAddress\r\n | join kind=leftouter TIIP\r\n on $left.CallerIpAddress == $right.TI_ipEntity\r\n | join kind=leftouter ipsSecurityAlerts\r\n on $left.CallerIpAddress == $right.IpAddress\r\n | distinct\r\n CallerIpAddress,\r\n Instances,\r\n tostring(class_list),\r\n ThreatType,\r\n Id,\r\n SystemAlertId,\r\n IsIncident\r\n | summarize \r\n Anomalies = dcount(Id),\r\n ThreatType = make_set(ThreatType),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by CallerIpAddress\r\n | project\r\n Entity = CallerIpAddress,\r\n Type = \"IP Address\",\r\n Instances,\r\n Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)),\r\n Watchlist = 'N/A',\r\n ThreatType = trim(@'\\[|\\]|\\\"', iff(ThreatType == '[\"\"]', 'N/A', ThreatType)),\r\n Anomalies,\r\n Alerts,\r\n Incidents, \r\n UserId = 'N/A'; \r\n\r\nUserExtendedAnomalies\r\n | where iff('{TabName}' == 'IPAddress', false, true)\r\n | union (IPExtendedAnomalies\r\n | where iff('{TabName}' == 'UserAccount', false, true))",
"size": 1,
"showAnalytics": true,
"title": "Anomalies Entities Details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Entity",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkIsContextBlade": true,
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "UserId"
},
{
"name": "",
"source": "column",
"value": ""
}
]
}
}
},
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "UserId",
"formatter": 5
}
]
}
},
"customWidth": "100",
"conditionalVisibility": {
"parameterName": "LinkName",
"comparison": "isEqualTo",
"value": "Anomalies"
},
"name": "AnomaliesQuery",
"styleSettings": {
"maxWidth": "100%"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - get the list of IP entities that are part of ThreatInteligence table, correlate with matching annomalies, incidents and alerts.\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | where strlen(tostring(ClassificationDetails))>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, tostring(ClassificationDetails);\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '{TIIPEntities}' has CallerIpAddress\r\n| distinct CorrelationId, CallerIpAddress, Uri;\r\n\r\nlet ipsCorrelatedLogs = AccessLogs\r\n | join kind=inner hint.strategy = broadcast ClassificationLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct CallerIpAddress, Uri, ClassificationDetails;\r\n\r\nlet ipsClassifications = ipsCorrelatedLogs\r\n | mv-expand classification = todynamic(ClassificationDetails)\r\n | where isnotempty(classification.['Name']) and classification.['Name'] != \"No classification\"\r\n | extend\r\n clasType = tostring(classification.['Name']),\r\n clasCount = toint(classification.['UniqueCount']) \r\n | summarize\r\n Instances = sum(clasCount),\r\n class_list = make_set(clasType)\r\n by CallerIpAddress;\r\n\t\t\r\nlet TIIP = ThreatIntelligenceIndicator\r\n| where TimeGenerated <= {TimeRange_IS:end} and ExpirationDateTime > {TimeRange_IS:start}\r\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n// Picking up only IOC's that contain the entities we want\r\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\r\n// As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.\r\n// Taking the first non-empty value based on potential IOC match availability\r\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\r\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)\r\n| where '{TIIPEntities}' has TI_ipEntity\r\n| distinct TI_ipEntity, ThreatType, Active;\r\n\r\nlet ipsSecurityAlerts = SecurityAlert\r\n | where TimeGenerated {TimeRange_IS}\r\n | where Entities has_any('{TIIPEntities}')\r\n | mv-expand entities = todynamic(Entities)\r\n | project IpAddress = tostring(todynamic(ExtendedProperties).['IpAddress']), SystemAlertId, IsIncident\r\n | distinct IpAddress, SystemAlertId, IsIncident\r\n | where '{TIIPEntities}' has IpAddress; \r\n\r\nlet IPAnomalies = Anomalies\r\n | where TimeGenerated between(datetime_add(\"day\", -5, {TimeRange_IS:start}) .. {TimeRange_IS:end})\r\n | distinct SourceIpAddress, Id\r\n | where '{TIIPEntities}' has SourceIpAddress;\r\n\r\nlet TIIPView = TIIP\r\n| join kind=inner ipsClassifications\r\n on $left.TI_ipEntity == $right.CallerIpAddress\r\n| join kind=leftouter IPAnomalies\r\n on $left.TI_ipEntity == $right.SourceIpAddress\r\n| join kind=leftouter ipsSecurityAlerts\r\n on $left.TI_ipEntity == $right.IpAddress\r\n| distinct CallerIpAddress, Instances, tostring(class_list), ThreatType, Active, Id, SystemAlertId, IsIncident\r\n | summarize\r\n Anomalies = dcountif(Id, isnotempty(Id)),\r\n ThreatType = make_set(ThreatType),\r\n Alerts = dcountif(SystemAlertId, not(IsIncident)),\r\n Incidents = dcountif(SystemAlertId, IsIncident),\r\n Active = make_set(Active),\r\n take_any(Instances),\r\n take_any(class_list)\r\n by CallerIpAddress\r\n| project Entity = CallerIpAddress, Type = \"IP Address\", Instances, Classifications = trim(@'\\[|\\]|\\\"', iff(isempty(class_list), 'N/A', class_list)), Watchlist = 'N/A', ThreatType = trim(@'\\[|\\]|\\\"', iff(ThreatType =='[\"\"]', 'N/A', ThreatType)),Active = iff(tostring(Active) has 'true', true, false), Anomalies, Alerts, Incidents; \r\n\r\nTIIPView;",
"size": 1,
"showAnalytics": true,
"title": "Threat Intelligence Entities Details",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "class_list",
"formatter": 1
}
]
}
},
"customWidth": "100",
"conditionalVisibility": {
"parameterName": "LinkName",
"comparison": "isEqualTo",
"value": "TIIP"
},
"name": "TIIPQuery",
"styleSettings": {
"maxWidth": "100%"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//get the list of assets(storage accounts) that are part of high value assets watchlist\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n Classifications,\r\n CorrelationId\r\n | where strlen(Classifications)>2 and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project CorrelationId, Classifications;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{AssetsWatchList}' has AccountName\r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| project CorrelationId, AccountName, RequesterObjectId;\r\n\r\nlet CorrelatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | distinct RequesterObjectId, tostring(Classifications), AccountName;\r\n\r\nCorrelatedLogs\r\n| join kind = leftouter (SigninLogs | where UserId != UserDisplayName) on $left.RequesterObjectId == $right.UserId\r\n| project UserId, AccountDisplayName = iff(isempty(UserDisplayName), RequesterObjectId, UserDisplayName), Classifications, AccountName\r\n| distinct UserId, AccountDisplayName, Classifications, AccountName\r\n| mv-expand Classification_Details = todynamic(Classifications)\r\n| extend classificationString = tostring(Classification_Details)\r\n| distinct classificationString, AccountDisplayName, AccountName\r\n| where '*' in ({Classification_IS}) or classificationString has_any({Classification_IS})\r\n| where isnotempty(AccountDisplayName)\r\n| summarize UserAccounts=trim(@'\\[|\\]|\\\"', tostring(makeset(AccountDisplayName))), Classifications= trim(@'\\[|\\]|\\\"', tostring(makeset(classificationString))) by AccountName",
"size": 1,
"showAnalytics": true,
"title": "High Value Assets - Storage Accounts",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "AccountName",
"formatter": 13,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": true,
"showIcon": true
}
},
{
"columnMatch": "UserAccounts",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "Classifications",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
}
],
"labelSettings": [
{
"columnId": "AccountName",
"label": "Storage Account"
},
{
"columnId": "UserAccounts",
"label": "User Accounts"
},
{
"columnId": "Classifications",
"label": "Classifications"
}
]
}
},
"customWidth": "100",
"conditionalVisibility": {
"parameterName": "LinkName",
"comparison": "isEqualTo",
"value": "HighValueAssets"
},
"name": "HighValueAssetsQuery",
"styleSettings": {
"maxWidth": "100%"
}
},
{
"type": 1,
"content": {
"json": "To get insights details view, select a link in the Entities insights section shown on the left.",
"style": "info"
},
"customWidth": "100",
"conditionalVisibilities": [
{
"parameterName": "LinkName",
"comparison": "isNotEqualTo",
"value": "Anomalies"
},
{
"parameterName": " WatchListVisible",
"comparison": "isNotEqualTo",
"value": "true"
},
{
"parameterName": "LinkName",
"comparison": "isNotEqualTo",
"value": "TIIP"
},
{
"parameterName": "LinkName",
"comparison": "isNotEqualTo",
"value": "WatchList"
},
{
"parameterName": "LinkName",
"comparison": "isNotEqualTo",
"value": "HighValueAssets"
}
],
"name": "noInfoText",
"styleSettings": {
"maxWidth": "100%"
}
}
],
"exportParameters": true
},
"customWidth": "75",
"name": "EntitiesDetailsGroup",
"styleSettings": {
"margin": "0px",
"maxWidth": "100"
}
}
],
"exportParameters": true
},
"customWidth": "100",
"name": "Insights",
"styleSettings": {
"margin": "0px 30px",
"maxWidth": "100%"
}
},
{
"type": 1,
"content": {
"json": "----\r\n## Classification details\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "break",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "c0307511-30f8-4dcc-b128-bcb247141db6",
"version": "KqlParameterItem/1.0",
"name": "Classifications_f",
"label": "Classifications",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "\"",
"delimiter": ",",
"query": "//Get list of classification types discovered.\r\nlet ClassificationLogs = \r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff('{LinkName}' =~ 'Watchlist', isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId, true)\r\n| where iff('{LinkName}' =~ 'TIIP', '{TIIPEntities}' has CallerIpAddress, true)\r\n| where iff('{LinkName}' =~ 'HighValueAssets', '{AssetsWatchList}' has AccountName, true)\r\n| where iff('{LinkName}' =~ 'Anomalies', ('{AnomaliesIPEntities}' has CallerIpAddress) or (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId), true)\r\n| distinct CorrelationId;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n| project ClassificationDetails\r\n| mv-expand Classifications = ClassificationDetails\r\n| where isnotempty(Classifications.['Name']) and iff(\"{Classification_IS:id}\" == '*', true, Classifications.['Name'] in({Classification_IS}))\r\n| project Classification=tostring(Classifications.['Name'])\r\n| distinct Classification\r\n| order by Classification asc;\r\n\r\ncorrelatedLogs;",
"typeSettings": {
"limitSelectTo": 5,
"additionalResourceOptions": [
"value::all"
],
"selectAllValue": "*",
"showDefault": false
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": [
"value::all"
]
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "GraphParameter"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//Query purpose - present a timechart of access to classification types over time, with 1d bin, per asset(Uri/path)\r\n//Classification types can be filtered by \"Classification_f\" parameter.\r\n\r\nlet granularity = toscalar(iff({TimeRange_IS:seconds} <= 3600, 10m, iff({TimeRange_IS:seconds} <= 86400, 1h , 1d)));\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n CorrelationId,\r\n Classifications\r\n | where strlen(Classifications)>2 and ('*' in ({Classification_IS}) or Classifications has_any({Classification_IS})) and (\"{Classifications_f:id}\" == '*' or Classifications has_any({Classifications_f}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| where iff('{LinkName}' =~ 'Watchlist', isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId, true)\r\n| where iff('{LinkName}' =~ 'TIIP', '{TIIPEntities}' has CallerIpAddress, true)\r\n| where iff('{LinkName}' =~ 'HighValueAssets', '{AssetsWatchList}' has AccountName, true)\r\n| where iff('{LinkName}' =~ 'Anomalies', ('{AnomaliesIPEntities}' has CallerIpAddress) or (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId), true)\r\n| project CorrelationId, TimeGenerated;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project-away CorrelationId, CorrelationId1, SensitivityCorrelationId;\r\n\r\nlet clasCount = materialize(correlatedLogs\r\n| mv-expand Classification_Details = Classifications\r\n| where iff(\"{Classification_IS:id}\" == '*', true, Classification_Details in ({Classification_IS})) and iff(\"{Classifications_f:id}\" == '*', true, Classification_Details in ({Classifications_f}))\r\n| summarize hint.strategy=shuffle TotalAssets=count() by tostring(Classification_Details), bin(TimeGenerated, granularity));\r\n\r\nlet top5 = clasCount | summarize sum = sum(TotalAssets) by Classification_Details | top 5 by sum desc | project Classification_Details;\r\n\r\nclasCount | join kind=inner top5 on Classification_Details\r\n",
"size": 1,
"showAnnotations": true,
"showAnalytics": true,
"title": "Access count over time - top 5",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "timechart",
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "Classification",
"formatter": 1
},
"centerContent": {
"columnMatch": "count_",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"showLegend": true
}
},
"customWidth": "60",
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "AccessOverTime",
"styleSettings": {
"maxWidth": "100%"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//query purpose - Get the access details per classification type.\r\n//TotalAccess - total accesses to this classification type, including the aggregation count.\r\n//DataSource - total unique storage accounts that were accessed per classification type.\r\n//TotalAssets - total unique assets(Uri/path) that were accessed per classification type.\r\n//TotalInstances - total classification instnces per type that were accesed. this is calculated by unique count * aggregation count per access.\r\n\r\nlet ClassificationLogs = (\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId = CorrelationId\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS})) and ('*' == \"{Classifications_f:id}\" or ClassificationDetails has_any({Classifications_f}))\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n CorrelationId)\r\n on CorrelationId)\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS})\r\n | project ClassificationDetails, CorrelationId;\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n Uri,\r\n CallerIpAddress,\r\n AggregationLastEventTime,\r\n AggregationCount,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| where iff('{LinkName}' =~ 'Watchlist', isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId, true)\r\n| where iff('{LinkName}' =~ 'TIIP', '{TIIPEntities}' has CallerIpAddress, true)\r\n| where iff('{LinkName}' =~ 'HighValueAssets', '{AssetsWatchList}' has AccountName, true)\r\n| where iff('{LinkName}' =~ 'Anomalies', ('{AnomaliesIPEntities}' has CallerIpAddress) or (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId), true)\r\n| project CorrelationId, AggregationCount, AccountName, Uri;\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project ClassificationDetails, AggregationCount, AccountName, Uri;\r\n\r\ncorrelatedLogs\r\n| mv-expand classification = ClassificationDetails\r\n| where isnotempty(classification.['Name']) and iff(\"{Classification_IS:id}\" == '*', true, classification.['Name'] in({Classification_IS})) and iff('*' == \"{Classifications_f:id}\", true, classification.['Name'] in({Classifications_f}))\r\n| summarize hint.strategy=shuffle\r\n TotalAccess=sum(toint(AggregationCount))\r\n by tostring(classification.['Name']), Uri,toint(classification.['UniqueCount']), AccountName, AggregationCount\r\n| summarize \r\n TotalAccess=sum(TotalAccess),\r\n DataSource=dcount(AccountName),\r\n TotalAssets=dcount(Uri),\r\n TotalInstances = sum(classification_UniqueCount * toint(AggregationCount))\r\n by classification_Name\r\n| project\r\n Classification=classification_Name,\r\n DataSource,\r\n TotalAssets=min_of(TotalAccess, TotalAssets),\r\n TotalAccess,\r\n Instances = TotalInstances\r\n| order by TotalAccess desc",
"size": 1,
"showAnalytics": true,
"title": "Access by classification",
"exportMultipleValues": true,
"exportedParameters": [
{
"fieldName": "Classification",
"parameterName": "ClassificationFilter",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Classification",
"formatter": 0,
"tooltipFormat": {}
},
{
"columnMatch": "DataSource",
"formatter": 0,
"tooltipFormat": {
"tooltip": "{0} data sources(storage accounts) found with this classification."
}
},
{
"columnMatch": "Instances",
"formatter": 0,
"tooltipFormat": {
"tooltip": "Number of occurrences of classification found in accessed assets"
}
},
{
"columnMatch": "TotalInstances",
"formatter": 0,
"tooltipFormat": {
"tooltip": "{0} instances of this classification type were accessed "
}
}
],
"filter": true,
"sortBy": [
{
"itemKey": "Classification",
"sortOrder": 1
}
],
"labelSettings": [
{
"columnId": "DataSource",
"label": "Data Source"
},
{
"columnId": "TotalAssets",
"label": "Assets"
},
{
"columnId": "TotalAccess",
"label": "Accesses"
}
]
},
"sortBy": [
{
"itemKey": "Classification",
"sortOrder": 1
}
]
},
"customWidth": "40",
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "AccessPerClassificationView",
"styleSettings": {
"margin": "0px",
"maxWidth": "40%"
}
}
],
"exportParameters": true
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "Graphs",
"styleSettings": {
"margin": "0px 30px 0px 30px"
}
},
{
"type": 1,
"content": {
"json": "----\r\n## Access Details"
},
"name": "break",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "8be86c8b-b566-44c2-8cc7-d7c3b501a060",
"version": "KqlParameterItem/1.0",
"name": "FilterParam",
"type": 1,
"isGlobal": true,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "ClassificationFilter",
"operator": "isNotNull",
"rightValType": "static",
"rightVal": "*",
"resultValType": "static",
"resultVal": "{ClassificationFilter:label}"
}
},
{
"criteriaContext": {
"leftOperand": "Classifications_f",
"operator": "!=",
"rightValType": "static",
"rightVal": "*",
"resultValType": "static",
"resultVal": "{Classifications_f:label}"
}
},
{
"criteriaContext": {
"leftOperand": "Classification_IS",
"operator": "!=",
"rightValType": "static",
"rightVal": "*",
"resultValType": "static",
"resultVal": "{Classification_IS:label}"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "static",
"resultVal": "All"
}
}
],
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "FilterParameter"
},
{
"type": 1,
"content": {
"json": "Filtered by -\r\nSubscriptions: {Subcriptions_IS:label}, Resource groups: {ResourceGroup_IS:label}, User accounts: {UserAccount_IS:label}, Insights: {LinkName}, IP range {IPAddress_IS} {IPRange_IS}, Asset path {AssetPath_IS} {Path_IS}, Classification type: {FilterParam:label}",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "FilteredByText",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 1,
"content": {
"json": "Filtered by -\r\nSubscriptions: {Subcriptions_IS:label}, Resource groups: {ResourceGroup_IS:label}, User accounts: {UserAccount_IS:label}, Insights: {LinkName}, IP range {IPAddress_IS} {IPRange_IS}, Asset path {AssetPath_IS} {Path_IS}",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "UserAccount"
},
"name": "FilteredByText - UserTab",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 1,
"content": {
"json": "Filtered by -\r\nSubscriptions: {Subcriptions_IS:label}, Resource groups: {ResourceGroup_IS:label}, User accounts: {UserAccount_IS:label}, Insights: {LinkName}, IP range {IPAddress_IS} {IPRange_IS}, Asset path {AssetPath_IS} {Path_IS}",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "IPAddress"
},
"name": "FilteredByText - ipTab",
"styleSettings": {
"margin": "0px 30px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//this query will be joined with: UserAccountNameMapping query to get matching account names\r\nlet clasFilter = dynamic([{ClassificationFilter}]);\r\n\r\nlet ClassificationLogs = ((\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails,\r\n CorrelationId\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId))\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | where '*' in ({Classifications_f}) or ClassificationDetails has_any({Classifications_f})\r\n | where iff(array_length(clasFilter) == 0 , true, ClassificationDetails has_any(clasFilter))\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n Uri, \r\n Location,\r\n CallerIpAddress, \r\n AuthenticationType, \r\n OperationName, \r\n Category, \r\n StatusCode, \r\n UserAgentHeader, \r\n AggregationLastEventTime, \r\n AggregationCount,\r\n CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| where iff('{LinkName}' =~ 'Watchlist', isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId, true)\r\n| where iff('{LinkName}' =~ 'TIIP', '{TIIPEntities}' has CallerIpAddress, true)\r\n| where iff('{LinkName}' =~ 'HighValueAssets', '{AssetsWatchList}' has AccountName, true)\r\n| where iff('{LinkName}' =~ 'Anomalies', ('{AnomaliesIPEntities}' has CallerIpAddress) or (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId), true);\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project-away CorrelationId, CorrelationId1, SensitivityCorrelationId;\r\n\r\n correlatedLogs \r\n| project ResourceSubscriptionId, ResourceGroup, AccountName, Uri, Location, TimeGenerated, CallerIpAddress, AuthenticationType, RequesterObjectId, RequesterAppId, ClassificationDetails, SensitivityLabelName, OperationName, Category, StatusCode, UserAgentHeader, AggregationLastEventTime, AggregationCount",
"size": 3,
"showAnalytics": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "$gen_group",
"formatter": 13,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "ResourceSubscriptionId",
"formatter": 5
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "AccountName",
"formatter": 5
},
{
"columnMatch": "Uri",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "ClassificationDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AggregationLastEventTime",
"formatter": 5
},
{
"columnMatch": "AggregationCount",
"formatter": 5
},
{
"columnMatch": "Classification",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"ResourceSubscriptionId",
"ResourceGroup",
"AccountName"
],
"expandTopLevel": true
},
"labelSettings": [
{
"columnId": "ResourceSubscriptionId",
"label": "Subscription"
},
{
"columnId": "ResourceGroup",
"label": "Resource Group"
},
{
"columnId": "AccountName",
"label": "Storage Account Name"
},
{
"columnId": "CallerIpAddress",
"label": "Caller IP Address"
},
{
"columnId": "AuthenticationType",
"label": "Authentication Type"
},
{
"columnId": "RequesterObjectId",
"label": "Requester Object Id"
},
{
"columnId": "RequesterAppId",
"label": "Requester App Id"
},
{
"columnId": "ClassificationDetails",
"label": "Classification Details"
},
{
"columnId": "SensitivityLabelName",
"label": "Sensitivity Label Name"
},
{
"columnId": "OperationName",
"label": "Operation"
},
{
"columnId": "Category",
"label": "Category"
},
{
"columnId": "StatusCode",
"label": "Status Code"
},
{
"columnId": "UserAgentHeader",
"label": "User Agent Header"
}
]
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "Access Logs",
"styleSettings": {
"margin": "0px 40px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\",\"mergeType\":\"leftouter\",\"leftTable\":\"Access Logs\",\"rightTable\":\"UserAccounts\",\"leftColumn\":\"RequesterObjectId\",\"rightColumn\":\"RequesterObjectId\"}],\"projectRename\":[{\"originalName\":\"[Access Logs].ResourceSubscriptionId\",\"mergedName\":\"Subscription\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].ResourceGroup\",\"mergedName\":\"Resource Group\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].AccountName\",\"mergedName\":\"Storage Account Name\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].Uri\",\"mergedName\":\"Uri\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].Location\",\"mergedName\":\"Location\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].TimeGenerated\",\"mergedName\":\"TimeGenerated\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].CallerIpAddress\",\"mergedName\":\"Caller IP Address\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].AuthenticationType\",\"mergedName\":\"Authentication Type\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[UserAccounts].AccountDisplayName\",\"mergedName\":\"AccountDisplayName\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].RequesterObjectId\",\"mergedName\":\"Requester Object Id\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].RequesterAppId\",\"mergedName\":\"Requester App Id\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].ClassificationDetails\",\"mergedName\":\"Classification Details\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].SensitivityLabelName\",\"mergedName\":\"Sensitivity Label Name\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].OperationName\",\"mergedName\":\"Operation\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].Category\",\"mergedName\":\"Category\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].StatusCode\",\"mergedName\":\"Status Code\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[Access Logs].UserAgentHeader\",\"mergedName\":\"User Agent Header\",\"fromId\":\"a9210b06-7611-4a25-8da0-28a5a0f5b516\"},{\"originalName\":\"[UserAccounts].EntityLink\",\"mergedName\":\"EntityLink\",\"fromId\":\"unknown\"},{\"originalName\":\"[UserAccounts].AuthenticationType\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\"},{\"originalName\":\"[UserAccounts].RequesterAppId\"},{\"originalName\":\"[Access Logs].AggregationCount\"},{\"originalName\":\"[Access Logs].AggregationLastEventTime\"}]}",
"size": 3,
"showAnalytics": true,
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "$gen_group",
"formatter": 13,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Subscription",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Group",
"formatter": 14,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Storage Account Name",
"formatter": 13,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Uri",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "AccountDisplayName",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"bladeOpenContext": {
"bladeName": "UserDetailsMenuBlade",
"extensionName": "Microsoft_AAD_IAM",
"bladeParameters": [
{
"name": "Profile",
"source": "static",
"value": "userId"
},
{
"name": "userId",
"source": "column",
"value": "Requester Object Id"
}
]
}
}
},
{
"columnMatch": "Classification Details",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "ResourceSubscriptionId",
"formatter": 5
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "AccountName",
"formatter": 5
},
{
"columnMatch": "ClassificationDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AggregationLastEventTime",
"formatter": 5
},
{
"columnMatch": "AggregationCount",
"formatter": 5
},
{
"columnMatch": "Classification",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"Subscription",
"Resource Group",
"Storage Account Name"
],
"expandTopLevel": true
},
"labelSettings": [
{
"columnId": "AccountDisplayName",
"label": "Account name"
},
{
"columnId": "Category",
"label": "Category"
}
]
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "Summary"
},
"name": "Access LogsMerge",
"styleSettings": {
"margin": "0px 40px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "//this query will be joined with: UserAccountNameMapping query to get matching account names\r\nlet ClassificationLogs = ((\r\n DSMDataClassificationLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n ClassificationDetails = ClassificationDetails,\r\n CorrelationId = CorrelationId\r\n | join kind=leftouter hint.strategy = shuffle (\r\n DSMDataLabelingLogs\r\n | where TimeGenerated <= {TimeRange_IS:end}\r\n | project\r\n SensitivityLabelName = replace(@'\\[|\\]|\\\"', @'', SensitivityLabelName),\r\n SensitivityCorrelationId = CorrelationId)\r\n on $left.CorrelationId == $right.SensitivityCorrelationId))\r\n | where strlen(ClassificationDetails)>2 and ('*' in ({Classification_IS}) or ClassificationDetails has_any({Classification_IS}))\r\n | where '*' in ({SensitivityLabel_IS}) or SensitivityLabelName in ({SensitivityLabel_IS});\r\n\r\nlet AccessLogs = DSMAzureBlobStorageLogs \r\n | project\r\n TimeGenerated,\r\n RequesterAppId,\r\n RequesterObjectId,\r\n ResourceSubscriptionId,\r\n ResourceGroup,\r\n AccountName,\r\n Uri, \r\n Location,\r\n CallerIpAddress, \r\n AuthenticationType, \r\n OperationName, \r\n Category, \r\n StatusCode, \r\n UserAgentHeader, \r\n AggregationLastEventTime, \r\n AggregationCount,\r\n CorrelationId = CorrelationId\r\n| where TimeGenerated between ({TimeRange_IS:start} .. {TimeRange_IS:end}) or AggregationLastEventTime between ({TimeRange_IS:start} .. {TimeRange_IS:end}) \r\n| where '{Subcriptions_IS:id}' == '*' or '{Subcriptions_IS:id}' has ResourceSubscriptionId\r\n| where ResourceGroup in ({ResourceGroup_IS}) or '*' in ({ResourceGroup_IS})\r\n| where '*' in ({UserAccount_IS}) or RequesterAppId in ({UserAccount_IS}) or RequesterObjectId in ({UserAccount_IS})\r\n| where iff(isnotempty('{IPRange_IS}') and '{IPAddress_IS}' == \"contains\", ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\"), iff(isnotempty('{IPRange_IS}'), ipv4_is_in_range(CallerIpAddress, \"{IPRange_IS:value}\") == false, true))\r\n| where iff(isnotempty(\"{Path_IS}\") and '{AssetPath_IS}' == \"contains\", Uri has \"{Path_IS}\", iff(isnotempty(\"{Path_IS}\"), Uri !has \"{Path_IS}\", true))\r\n| where iff('{LinkName}' =~ 'Watchlist', isnotempty(RequesterObjectId) and '{WatchListEntities}' has RequesterObjectId, true)\r\n| where iff(('{LinkName}' =~ 'Anomalies' and '{TabName}' =~ 'UserAccount'), (isnotempty(RequesterObjectId) and '{AnomaliesUserEntities}' has RequesterObjectId), true)\r\n| where iff('{LinkName}' =~ 'HighValueAssets', '{AssetsWatchList}' has AccountName, true)\r\n| where iff('{LinkName}' =~ 'TIIP', '{TIIPEntities}' has CallerIpAddress, true)\r\n| where iff(('{LinkName}' =~ 'Anomalies' and '{TabName}' =~ 'IPAddress'), ('{AnomaliesIPEntities}' has CallerIpAddress), true);\r\n\r\nlet correlatedLogs = ClassificationLogs\r\n | join kind=inner hint.strategy = broadcast AccessLogs\r\n on $left.CorrelationId == $right.CorrelationId\r\n | project-away CorrelationId, CorrelationId1, SensitivityCorrelationId;\r\n\r\n\r\n correlatedLogs \r\n| project ResourceSubscriptionId, ResourceGroup, AccountName, Uri, Location, TimeGenerated, CallerIpAddress, AuthenticationType, RequesterObjectId, RequesterAppId, ClassificationDetails, SensitivityLabelName, OperationName, Category, StatusCode, UserAgentHeader, AggregationLastEventTime, AggregationCount\r\n",
"size": 3,
"showAnalytics": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "ResourceSubscriptionId",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "AccountName",
"formatter": 5
},
{
"columnMatch": "Uri",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "RequesterObjectId",
"formatter": 5
},
{
"columnMatch": "ClassificationDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "AggregationLastEventTime",
"formatter": 5
},
{
"columnMatch": "AggregationCount",
"formatter": 5
},
{
"columnMatch": "UserId",
"formatter": 1
},
{
"columnMatch": "expandDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
}
],
"filter": true,
"labelSettings": [
{
"columnId": "ResourceSubscriptionId",
"label": "Resource Subscription Id"
},
{
"columnId": "ResourceGroup",
"label": "Resource Group"
},
{
"columnId": "AccountName",
"label": "Storage Account Name"
},
{
"columnId": "TimeGenerated",
"label": "Time Generated"
},
{
"columnId": "CallerIpAddress",
"label": "Caller IP Address"
},
{
"columnId": "AuthenticationType",
"label": "Authentication Type"
},
{
"columnId": "RequesterObjectId",
"label": "Requester Upn"
},
{
"columnId": "RequesterAppId",
"label": "Requester App Id"
},
{
"columnId": "SensitivityLabelName",
"label": "Sensitivity Label Name"
},
{
"columnId": "OperationName",
"label": "Operation Name"
},
{
"columnId": "StatusCode",
"label": "Status Code"
},
{
"columnId": "UserAgentHeader",
"label": "User Agent Header"
},
{
"columnId": "AggregationLastEventTime",
"label": "Aggregation Last Event Time"
},
{
"columnId": "AggregationCount",
"label": "Aggregation Count"
}
]
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "nothing"
},
"name": "Access Logs - Users",
"styleSettings": {
"margin": "0px 40px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e419e4de-b74e-4851-be57-39500c2c41e4\",\"mergeType\":\"leftouter\",\"leftTable\":\"Access Logs - Users\",\"rightTable\":\"UserAccounts\",\"leftColumn\":\"RequesterObjectId\",\"rightColumn\":\"RequesterObjectId\"}],\"projectRename\":[{\"originalName\":\"[Access Logs - Users].ResourceSubscriptionId\",\"mergedName\":\"Resource Subscription Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].ResourceGroup\",\"mergedName\":\"Resource Group\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AccountName\",\"mergedName\":\"Storage Account Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Uri\",\"mergedName\":\"Uri\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Location\",\"mergedName\":\"Location\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].TimeGenerated\",\"mergedName\":\"Time Generated\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].CallerIpAddress\",\"mergedName\":\"Caller IP Address\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AuthenticationType\",\"mergedName\":\"Authentication Type\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].RequesterObjectId\",\"mergedName\":\"Requester Object Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].RequesterAppId\",\"mergedName\":\"Requester App Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].ClassificationDetails\",\"mergedName\":\"ClassificationDetails\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].SensitivityLabelName\",\"mergedName\":\"Sensitivity Label Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].OperationName\",\"mergedName\":\"Operation Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Category\",\"mergedName\":\"Category\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].StatusCode\",\"mergedName\":\"Status Code\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].UserAgentHeader\",\"mergedName\":\"User Agent Header\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AggregationLastEventTime\",\"mergedName\":\"Aggregation Last Event Time\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AggregationCount\",\"mergedName\":\"Aggregation Count\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterAppId\",\"mergedName\":\"RequesterAppId\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\",\"mergedName\":\"RequesterObjectId\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].AuthenticationType\",\"mergedName\":\"AuthenticationType\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].AccountDisplayName\",\"mergedName\":\"AccountDisplayName\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterAppId\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\"},{\"originalName\":\"[UserAccounts].AuthenticationType\"},{\"originalName\":\"[Access Logs - Users].AggregationLastEventTime\"},{\"originalName\":\"[Access Logs - Users].AggregationCount\"}]}",
"size": 3,
"showAnalytics": true,
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "$gen_group",
"formatter": 13,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Subscription Id",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Group",
"formatter": 14,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Uri",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "ClassificationDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "RequesterObjectId",
"formatter": 5
},
{
"columnMatch": "ResourceSubscriptionId",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "AccountName",
"formatter": 5
},
{
"columnMatch": "UserId",
"formatter": 1
},
{
"columnMatch": "AggregationLastEventTime",
"formatter": 5
},
{
"columnMatch": "AggregationCount",
"formatter": 5
},
{
"columnMatch": "expandDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
}
],
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"AccountDisplayName",
"Resource Group",
"Storage Account Name"
],
"expandTopLevel": true
}
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "UserAccount"
},
"name": "Access Logs - UsersMerge",
"styleSettings": {
"margin": "0px 40px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e419e4de-b74e-4851-be57-39500c2c41e4\",\"mergeType\":\"leftouter\",\"leftTable\":\"Access Logs - Users\",\"rightTable\":\"UserAccounts\",\"leftColumn\":\"RequesterObjectId\",\"rightColumn\":\"RequesterObjectId\"}],\"projectRename\":[{\"originalName\":\"[Access Logs - Users].ResourceSubscriptionId\",\"mergedName\":\"Resource Subscription Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].ResourceGroup\",\"mergedName\":\"Resource Group\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AccountName\",\"mergedName\":\"Storage Account Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Uri\",\"mergedName\":\"Uri\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Location\",\"mergedName\":\"Location\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].TimeGenerated\",\"mergedName\":\"Time Generated\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].CallerIpAddress\",\"mergedName\":\"Caller IP Address\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AuthenticationType\",\"mergedName\":\"Authentication Type\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].RequesterObjectId\",\"mergedName\":\"Requester Object Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].RequesterAppId\",\"mergedName\":\"Requester App Id\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].ClassificationDetails\",\"mergedName\":\"ClassificationDetails\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].SensitivityLabelName\",\"mergedName\":\"Sensitivity Label Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].OperationName\",\"mergedName\":\"Operation Name\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].Category\",\"mergedName\":\"Category\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].StatusCode\",\"mergedName\":\"Status Code\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].UserAgentHeader\",\"mergedName\":\"User Agent Header\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AggregationLastEventTime\",\"mergedName\":\"Aggregation Last Event Time\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[Access Logs - Users].AggregationCount\",\"mergedName\":\"Aggregation Count\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterAppId\",\"mergedName\":\"RequesterAppId\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\",\"mergedName\":\"RequesterObjectId\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].AuthenticationType\",\"mergedName\":\"AuthenticationType\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].AccountDisplayName\",\"mergedName\":\"AccountDisplayName\",\"fromId\":\"e419e4de-b74e-4851-be57-39500c2c41e4\"},{\"originalName\":\"[UserAccounts].RequesterAppId\"},{\"originalName\":\"[UserAccounts].RequesterObjectId\"},{\"originalName\":\"[UserAccounts].AuthenticationType\"},{\"originalName\":\"[Access Logs - Users].AggregationLastEventTime\"},{\"originalName\":\"[Access Logs - Users].AggregationCount\"}]}",
"size": 3,
"showAnalytics": true,
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "$gen_group",
"formatter": 13,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Subscription Id",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Resource Group",
"formatter": 14,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "Uri",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "ClassificationDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "RequesterObjectId",
"formatter": 5
},
{
"columnMatch": "ResourceSubscriptionId",
"formatter": 15,
"formatOptions": {
"linkTarget": null,
"showIcon": true
}
},
{
"columnMatch": "ResourceGroup",
"formatter": 5
},
{
"columnMatch": "AccountName",
"formatter": 5
},
{
"columnMatch": "UserId",
"formatter": 1
},
{
"columnMatch": "AggregationLastEventTime",
"formatter": 5
},
{
"columnMatch": "AggregationCount",
"formatter": 5
},
{
"columnMatch": "expandDetails",
"formatter": 7,
"formatOptions": {
"linkTarget": "GenericDetails",
"linkIsContextBlade": true
}
}
],
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"Caller IP Address",
"Resource Group",
"Storage Account Name"
],
"expandTopLevel": true
}
}
},
"conditionalVisibility": {
"parameterName": "TabName",
"comparison": "isEqualTo",
"value": "IPAddress"
},
"name": "Access Logs - IPMerge",
"styleSettings": {
"margin": "0px 40px"
}
}
],
"styleSettings": {
"paddingStyle": "none",
"spacingStyle": "none"
},
"fromTemplateId": "sentinel-DSTIMWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}