{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": ">**NOTE:** This workbook depends on a parser based on a Kusto Function to work as expected [**Corelight**](https://aka.ms/sentinel-Corelight-parser) which is deployed with the Microsoft Sentinel Solution." }, "name": "text - 23" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c64d5d3d-90c6-484a-ab88-c70652b75b6e", "version": "KqlParameterItem/1.0", "name": "GlobalTimeRestriction", "label": "Global Time Restriction", "type": 4, "description": "Select Time Range", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "a076210e-a47c-43c2-97e1-1f663fedbd01", "version": "KqlParameterItem/1.0", "name": "Sensor", "label": "Corelight Sensor", "type": 2, "description": "Select Corelight Sensor", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "corelight_conn\n| distinct sensor_name\n| sort by sensor_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "3ec6573a-6d2e-4a3b-ac76-b4f76da9bba7", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Alert Aggregations", "subTarget": "AlertAggregation", "style": "link" }, { "id": "c974d247-9b2b-4889-8c08-4909953940a3", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Intel", "subTarget": "Intel", "style": "link" }, { "id": "f96cbe2a-9eb2-4222-b4f5-4d76abc57a97", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "IP Interrogation", "subTarget": "IPInterrogation", "style": "link" }, { "id": "6a54eeac-7ec8-469e-a002-3b2b5579a2a0", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Log Hunting", "subTarget": "LogHunting", "style": "link" }, { "id": "0544f880-2e8b-44ab-a405-55c8c425faa1", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Notices", "subTarget": "Notices", "style": "link" }, { "id": "458c9ad4-de32-4629-a33c-bd6e24126dd8", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Security Posture", "subTarget": "SecurityPosture", "style": "link" }, { "id": "c7bb3f67-a0cc-4733-b20c-d08552132b21", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "RDP Inferences Overview", "subTarget": "RDPInferencesOverview", "style": "link" }, { "id": "398eaf8c-089f-4455-9ca0-c9df6b9d4b6d", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "SSH Inferences Overview", "subTarget": "SSHInferencesOverview", "style": "link" }, { "id": "875a7fa0-96ea-4ec1-b88a-08264bd24d0a", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Corelight Suricata IDS Alert Overview", "subTarget": "CorelightSuricataIDSAlertOverview", "style": "link" }, { "id": "c08c75a7-7b15-4dc3-bcc0-9a2fb012dfee", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "VPN Insights", "subTarget": "VPNInsights", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Alert Aggregations: Streamlined Security Intelligence" }, "name": "text - 15" }, { "type": 1, "content": { "json": "## Importing CSV Data into Watchlists\r\n\r\nThis workbook requires you to import two CSV files into specific Watchlists:\r\n1. [**CorelightAggregationsEnrichment1.csv**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment1.csv) -> CorelightAggregationsEnrichment1 Watchlist\r\n2. [**CorelightAggregationsEnrichment2.csv**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment2.csv) -> CorelightAggregationsEnrichment2 Watchlist\r\n\r\n## Import Process\r\n- Navigate to Microsoft Sentinel\r\n- Access the Watchlists section\r\n- Select the appropriate Watchlist (**CorelightAggregationsEnrichment1** or **CorelightAggregationsEnrichment2**)\r\n- Choose **Update watchlist** -> **Bulk update**\r\n- Upload the corresponding CSV file\r\n- Proceed through **Next: Review + create**\r\n- Finalize by clicking **Update**\r\n\r\nRepeat these steps for both Watchlists to ensure all data is properly imported.", "style": "upsell" }, "name": "text - 15" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "200f46f2-a573-4d60-b2f7-5a8c38227709", "version": "KqlParameterItem/1.0", "name": "Entity", "type": 1, "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "809c41ab-35ed-4052-9f41-83d0b2b887e2", "version": "KqlParameterItem/1.0", "name": "ImpactScore", "label": "Impact Score", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "corelight_suri_aggregations\r\n| mv-expand sid\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}')) and isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist ('CorelightAggregationsEnrichment2')) on sid\r\n| where isnotempty(impact_score)\r\n| distinct impact_score\r\n| sort by impact_score desc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "2e98349b-57ed-4ec4-bce7-85a452c2fea1", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_suri_aggregations\r\n| mv-expand sid\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}')) and isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist ('CorelightAggregationsEnrichment2')) on sid\r\n| where isnotempty(category)\r\n| distinct category\r\n| sort by category asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}')) and\r\n isnotempty(did)\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| distinct did\r\n| count", "size": 3, "showAnalytics": true, "title": "Alert Groupings", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}')) and\r\n isnotempty(uid)\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| distinct uid\r\n| count", "size": 3, "showAnalytics": true, "title": "Impacted Connections", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| where local_resp == \"true\"\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| count", "size": 3, "showAnalytics": true, "title": "Impacted Internal Hosts", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n isnotempty(technique_number)\r\n| distinct technique_number\r\n| count", "size": 3, "showAnalytics": true, "title": "MITRE Techniques", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| summarize impact_score = max(impact_score)\r\n| extend impact_score = iif(isempty(impact_score), \"N/A\", impact_score)", "size": 3, "showAnalytics": true, "title": "Highest Impact Score", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "impact_score", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n isnotempty(category)\r\n| summarize Count = count() by category\r\n| top 1 by Count", "size": 3, "showAnalytics": true, "title": "Most Seen Category", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "category", "formatter": 4, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| count", "size": 3, "showAnalytics": true, "title": "Alerts/Signatures", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n isnotempty(cve_number)\r\n| count", "size": 3, "showAnalytics": true, "title": "Alerts with CVEs", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| extend cve_creation_date = todatetime(cve_creation_date)\r\n| summarize Oldest_CVE_Date = min(cve_creation_date)\r\n| extend Oldest_CVE_Date = iff(isempty(Oldest_CVE_Date), \"N/A\", format_datetime(Oldest_CVE_Date, 'yyyy-MM-dd'))", "size": 3, "showAnalytics": true, "title": "Oldest CVE Date", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Oldest_CVE_Date", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal" } }, "dateFormat": { "showUtcTime": true, "formatName": "shortDatePattern" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}'))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n isnotempty(impact_score)\r\n| summarize avg_impact_score = avg(toreal(impact_score))\r\n| project avg_impact_score = iff(isnan(avg_impact_score), toreal(0), round(avg_impact_score, 2))", "size": 3, "showAnalytics": true, "title": "Average Impact Score", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "avg_impact_score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "7", "representation": "brown", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "4", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "representation": "green", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "avg_impact_score", "color": "lightBlue" } ] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false, "size": "auto" } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1) or did == ('{Entity}')) and\r\n isnotempty(did)\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| summarize [\"MITRE Technique\"] = make_set_if(technique_name, isnotempty(technique_name)), Categories = make_set_if(category, isnotempty(category)), Signatures = make_set_if(signatures, isnotempty(signatures)), Impact = make_set_if(impact_score, isnotempty(impact_score)), Connections = dcount(uid) by did\r\n| extend [\"MITRE Technique\"] = strcat_array([\"MITRE Technique\"], \", \"), Categories = strcat_array(Categories, \", \"), Signatures = strcat_array(Signatures, \", \"),\r\n Impact = strcat_array(Impact, \", \")\r\n| project-rename [\"Aggregation ID\"] = did", "size": 0, "showAnalytics": true, "title": "Alert Aggregations Data", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Aggregation ID", "exportParameterName": "agg_id", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 11", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on above Aggregation ID to view *Alert Aggregation Details*", "style": "info" }, "name": "text - 14" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Alert Aggregation Details", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "print '{agg_id}'", "size": 3, "showAnalytics": true, "title": "Aggregation ID", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 4, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "print \"Suricata\"", "size": 3, "showAnalytics": true, "title": "Alert Type", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "print_0", "formatter": 4, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}' and isnotempty(uid)\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| distinct uid\r\n| count", "size": 3, "showAnalytics": true, "title": "Total Connections", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid, id_orig_h = orig_h\r\n| where isnotempty(sid) and isnotempty(id_orig_h)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| distinct tostring(id_orig_h)\r\n| count", "size": 3, "showAnalytics": true, "title": "Unique Sources", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid, id_resp_h = resp_h\r\n| where isnotempty(sid) and isnotempty(id_resp_h)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| distinct tostring(id_resp_h)\r\n| count", "size": 3, "showAnalytics": true, "title": "Unique Destinations", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| where isnotempty(cve_number)\r\n| distinct cve_number\r\n| count", "size": 3, "showAnalytics": true, "title": "Noted CVEs", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| summarize cve_impact_score = max(cve_impact_score)\r\n| extend cve_impact_score = iif(isempty(cve_impact_score), \"N/A\", cve_impact_score)", "size": 3, "showAnalytics": true, "title": "Highest CVE Impact Score", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "cve_impact_score", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| summarize impact_score = max(impact_score)\r\n| extend impact_score = iif(isempty(impact_score), \"N/A\", impact_score)", "size": 3, "showAnalytics": true, "title": "Highest Impact Score", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "impact_score", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n isnotempty(attack_reason)\r\n| distinct [\"Attack Reason\"] = attack_reason", "size": 0, "showAnalytics": true, "title": "Alert Insight", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "textSettings": { "style": "editor" } }, "customWidth": "50", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| summarize arg_max(TimeGenerated, *) by did\r\n| mv-expand sid\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}')) \r\n| project SID = sid, Signature = substring(signatures, 1, strlen(signatures)-2), [\"Impact Score\"] = impact_score, [\"MITRE Attack Phase\"] = attack_phase,\r\n Category = category, [\"MITRE Technique\"] = technique_name, [\"Technique #\"] = technique_number, [\"Traffic Direction\"] = traffic_direction", "size": 0, "showAnalytics": true, "title": "Associated Suricata Alerts", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SID", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' == ('{Entity}') or (array_index_of(orig_h,('{Entity}')) != -1) or (array_index_of(resp_h,('{Entity}')) != -1))\r\n| where did == '{agg_id}'\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(sid)\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where ('*' in ({ImpactScore}) or impact_score in ({ImpactScore})) and\r\n ('*' == ('{Category}') or category == ('{Category}'))\r\n| extend orig_h = strcat_array(orig_h, \",\"), resp_h = strcat_array(resp_h, \",\")\r\n| project UID = uid, Timestamp = format_datetime(todatetime((array_sort_desc(ts))[0]), 'MM-dd-yyyy HH:mm:ss'), Source = orig_h, Destination = resp_h\r\n", "size": 0, "showAnalytics": true, "title": "Associated Connections", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "UID", "exportParameterName": "uid", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click a connection from above to see the associated logs. Log types with data are highlighted green. If a Suricata payload is found for a given session, it will appear in the lower panel labeled Payload.", "style": "info" }, "name": "text - 25" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Connection Details by UIDs", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(uid: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where uid == ('{uid}')\r\n| project-away TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId\r\n", "size": 0, "showAnalytics": true, "title": "All Logs per UID", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suricata_corelight\r\n | where uid == ('{uid}')\r\n | project verify = iif(isnotempty(payload), 1, 0)\r\n);\r\nprint \"Payload\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "payload_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(paths contains \"conn\", 1, 0)\r\n);\r\nprint \"Conn\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "conn_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(paths contains \"http\", 1, 0)\r\n);\r\nprint \"HTTP\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "http_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(paths contains \"ssl\", 1, 0)\r\n);\r\nprint \"SSL\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "ssl_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(paths contains \"dns\", 1, 0)\r\n);\r\nprint \"DNS\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "dns_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(array_index_of(paths, \"files\") != -1, 1, 0)\r\n);\r\nprint \"Files\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "files_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let check = toscalar(\r\n corelight_suri_aggregations\r\n | where uid == ('{uid}')\r\n | project verify = iif(paths contains \"smb\", 1, 0)\r\n);\r\nprint \"SMB\", check", "size": 3, "timeContextFromParameter": "GlobalTimeRestriction", "exportFieldName": "print_1", "exportParameterName": "smb_value", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "print_0", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green", "text": "{0}{1}" }, { "sourceColumn": "print_1", "operator": "Default", "representation": "gray", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_1", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "13", "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_conn\r\n| where uid == ('{uid}')\r\n| project spcap_url", "size": 3, "showAnalytics": true, "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "spcap_url", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "SPCAP Viewer" } }, "showBorder": false, "size": "auto" }, "statSettings": { "valueField": "print_0", "valueAggregation": "None", "linkSettings": { "linkTarget": "Url" }, "colorSettings": { "type": "thresholds", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "sourceColumn": "print_2", "operator": "==", "thresholdValue": "1", "representation": "green" }, { "sourceColumn": "print_2", "operator": "==", "thresholdValue": "0", "representation": "gray" } ] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "9", "conditionalVisibility": { "parameterName": "conn_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 27" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let base64conversion = dynamic({'=': '000000',\r\n'A': '000000',\r\n'B': '000001',\r\n'C': '000010',\r\n'D': '000011',\r\n'E': '000100',\r\n'F': '000101',\r\n'G': '000110',\r\n'H': '000111',\r\n'I': '001000',\r\n'J': '001001',\r\n'K': '001010',\r\n'L': '001011',\r\n'M': '001100',\r\n'N': '001101',\r\n'O': '001110',\r\n'P': '001111',\r\n'Q': '010000',\r\n'R': '010001',\r\n'S': '010010',\r\n'T': '010011',\r\n'U': '010100',\r\n'V': '010101',\r\n'W': '010110',\r\n'X': '010111',\r\n'Y': '011000',\r\n'Z': '011001',\r\n'a': '011010',\r\n'b': '011011',\r\n'c': '011100',\r\n'd': '011101',\r\n'e': '011110',\r\n'f': '011111',\r\n'g': '100000',\r\n'h': '100001',\r\n'i': '100010',\r\n'j': '100011',\r\n'k': '100100',\r\n'l': '100101',\r\n'm': '100110',\r\n'n': '100111',\r\n'o': '101000',\r\n'p': '101001',\r\n'q': '101010',\r\n'r': '101011',\r\n's': '101100',\r\n't': '101101',\r\n'u': '101110',\r\n'v': '101111',\r\n'w': '110000',\r\n'x': '110001',\r\n'y': '110010',\r\n'z': '110011',\r\n'0': '110100',\r\n'1': '110101',\r\n'2': '110110',\r\n'3': '110111',\r\n'4': '111000',\r\n'5': '111001',\r\n'6': '111010',\r\n'7': '111011',\r\n'8': '111100',\r\n'9': '111101',\r\n'+': '111110',\r\n'/': '111111',\r\n'00001010': '`',\r\n'00100000': '~',\r\n'00100001': '!',\r\n'00100010': '\"',\r\n'00100011': '#',\r\n'00100100': '$',\r\n'00100101': '%',\r\n'00100110': '&',\r\n'00100111': \"'\",\r\n'00101000': '(',\r\n'00101001': ')',\r\n'00101010': '*',\r\n'00101011': '+',\r\n'00101100':',',\r\n'00101101': '-',\r\n'00101110': '.',\r\n'00101111': '/',\r\n'00110000': '0',\r\n'00110001': '1',\r\n'00110010': '2',\r\n'00110011': '3',\r\n'00110100': '4',\r\n'00110101': '5',\r\n'00110110': '6',\r\n'00110111': '7',\r\n'00111000': '8',\r\n'00111001': '9',\r\n'00111010': ':',\r\n'00111011': ';',\r\n'00111100': '<',\r\n'00111101': '=',\r\n'00111110': '>',\r\n'00111111': '?',\r\n'01000000': '@',\r\n'01000001': 'A',\r\n'01000010': 'B',\r\n'01000011': 'C',\r\n'01000100': 'D',\r\n'01000101': 'E',\r\n'01000110': 'F',\r\n'01000111': 'G',\r\n'01001000': 'H',\r\n'01001001': 'I',\r\n'01001010': 'J',\r\n'01001011': 'K',\r\n'01001100': 'L',\r\n'01001101': 'M',\r\n'01001110': 'N',\r\n'01001111': 'O',\r\n'01010000': 'P',\r\n'01010001': 'Q',\r\n'01010010': 'R',\r\n'01010011': 'S',\r\n'01010100': 'T',\r\n'01010101': 'U',\r\n'01010110': 'V',\r\n'01010111': 'W',\r\n'01011000': 'X',\r\n'01011001': 'Y',\r\n'01011010': 'Z',\r\n'01011011': '[',\r\n'01011100': '\\\\',\r\n'01011101': ']',\r\n'01011110': '^',\r\n'01011111': '_',\r\n'01100000': '@',\r\n'01100001': 'a',\r\n'01100010': 'b',\r\n'01100011': 'c',\r\n'01100100': 'd',\r\n'01100101': 'e',\r\n'01100110': 'f',\r\n'01100111': 'g',\r\n'01101000': 'h',\r\n'01101001': 'i',\r\n'01101010': 'j',\r\n'01101011': 'k',\r\n'01101100': 'l',\r\n'01101101': 'm',\r\n'01101110': 'n',\r\n'01101111': 'o',\r\n'01110000': 'p',\r\n'01110001': 'q',\r\n'01110010': 'r',\r\n'01110011': 's',\r\n'01110100': 't',\r\n'01110101': 'u',\r\n'01110110': 'v',\r\n'01110111': 'w',\r\n'01111000': 'x',\r\n'01111001': 'y',\r\n'01111010': 'z '});\r\n\r\ncorelight_suricata_corelight\r\n| where uid == ('{uid}') and isnotempty(signature_id)\r\n| extend decoded_payload = iif(isempty(payload), \"No payload available\", \"\"), len = strlen(payload)\r\n| mv-expand char_index = range(0, len-1, 1) to typeof(int)\r\n| extend bin_combined = base64conversion[substring(payload, char_index, 1)]\r\n| summarize bin_combined = make_list(bin_combined) by decoded_payload, signature_id\r\n| extend bin_chunked = split(replace_regex(strcat_array(bin_combined, \"\"), \"(.{8})\", @\"\\1,\"),\",\")\r\n| mv-expand bin_chunked\r\n| extend ascii = base64conversion[tostring(bin_chunked)]\r\n| summarize ascii = make_list(ascii) by decoded_payload, signature_id\r\n| extend ascii = replace(\"~\", \" \", strcat_array(ascii, \"\"))\r\n| extend decoded_payload = iif(isempty(decoded_payload), ascii, decoded_payload)\r\n| project [\"Signature ID\"] = signature_id, [\"Decoded Payload\"] = decoded_payload\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Payload Found in UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "payload_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 26", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_conn\r\n| where uid == ('{uid}')\r\n| extend tunnel_parents = strcat_array(todynamic(tunnel_parents), \", \"), suri_ids = strcat_array(todynamic(suri_ids), \", \"),\r\n apps = strcat_array(todynamic(apps), \", \"), app = strcat_array(app, \", \"), id_orig_h_n_vals = strcat_array(todynamic(id_orig_h_n_vals), \", \"),\r\n id_resp_h_n_vals = strcat_array(todynamic(id_resp_h_n_vals), \", \")\r\n", "size": 0, "showAnalytics": true, "title": "Connection Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "conn_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_http\r\n| where uid == ('{uid}')\r\n| extend proxied = strcat_array(todynamic(proxied), \", \"), orig_mime_types = strcat_array(todynamic(orig_mime_types), \", \"),\r\n orig_fuids = strcat_array(todynamic(orig_fuids), \", \"), resp_fuids = strcat_array(todynamic(resp_fuids), \", \"),\r\n tags = strcat_array(todynamic(tags), \", \"), resp_mime_types = strcat_array(todynamic(resp_mime_types), \", \"),\r\n http_content_type = strcat_array(todynamic(http_content_type), \", \"), server_headers = strcat_array(todynamic(server_headers), \", \"),\r\n client_headers = strcat_array(todynamic(client_headers), \", \"), resp_filenames = strcat_array(todynamic(resp_filenames), \", \"),\r\n orig_filenames = strcat_array(todynamic(orig_filenames), \", \"), object = strcat_array(todynamic(object), \", \")", "size": 0, "showAnalytics": true, "title": "HTTP Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "http_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where uid == ('{uid}')\r\n| extend cert_chain_fps = strcat_array(todynamic(cert_chain_fps), \",\"), client_cert_chain_fps = strcat_array(todynamic(client_cert_chain_fps), \",\"), fingerprint = strcat_array(todynamic(fingerprint), \",\")", "size": 0, "showAnalytics": true, "title": "SSL Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "ssl_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where uid == ('{uid}')\r\n| extend TTLs = strcat_array(todynamic(TTLs), \",\"), answers = strcat_array(todynamic(answers), \",\"), ttl = strcat_array(todynamic(ttl), \",\")", "size": 0, "showAnalytics": true, "title": "DNS Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "dns_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_files\r\n| where uid == ('{uid}')\r\n| extend analyzers = strcat_array(todynamic(analyzers), \", \"), tx_hosts = strcat_array(todynamic(tx_hosts), \", \"),\r\n rx_hosts = strcat_array(todynamic(rx_hosts), \", \"), conn_uids = strcat_array(todynamic(conn_uids), \", \"), \r\n extracted = strcat_array(todynamic(extracted), \", \"), dest_host = strcat_array(todynamic(dest_host), \", \"),\r\n src_host = strcat_array(todynamic(src_host), \", \")", "size": 0, "showAnalytics": true, "title": "Files Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "files_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy = true corelight_smb_files, corelight_smb_mapping\r\n| where uid == ('{uid}')", "size": 0, "showAnalytics": true, "title": "SMB Details For UID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "smb_value", "comparison": "isEqualTo", "value": "1" }, "name": "query - 19", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "Connection Details by UIDs" } ] }, "conditionalVisibility": { "parameterName": "agg_id", "comparison": "isNotEqualTo" }, "name": "Alert Aggregation Details" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "AlertAggregation" }, "name": "Alert Aggregations" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Intel" }, "name": "text - 2" }, { "type": 1, "content": { "json": "#### Intel Framework is only available for data extracted by Corelight Sensors (open source Zeek sensors not supported)\r\n\r\n" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4de51ac9-cad5-423b-8dbf-ab6c9cf52012", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "description": "Select Indicator Type", "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(category)\r\n| distinct category\r\n| sort by category asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f61b9bb7-6749-4947-b233-70fd886ebb9c", "version": "KqlParameterItem/1.0", "name": "Filter", "label": "Filter (IP, Port, Indicator)", "type": 1, "description": "Enter value for ip, port, indicator or type", "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction" }, { "id": "dcf8c058-bd1e-4ba8-8a38-b7a915791b6e", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "description": "Enter a keyword to search", "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == ('{Filter}') or dest_port == ('{Filter}') or seen_indicator == ('{Filter}'))\r\n| where isnotempty(path)\r\n| extend sourcetype = strcat(\"corelight_\", path)\r\n| make-series Count = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by sourcetype\r\n", "size": 0, "showAnalytics": true, "title": "Intel Logs Over Time (\"Additional Filter\", \"Indicator Type\" filters do not apply)", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == ('{Filter}') or dest_port == ('{Filter}') or seen_indicator == ('{Filter}'))\r\n| where ('*' == ('{IndicatorType}') or category == ('{IndicatorType}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(category)\r\n| summarize Count = count() by category\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "category", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Indicators** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == ('{Filter}') or dest_port == ('{Filter}') or seen_indicator == ('{Filter}'))\r\n| where category == ('{category}')\r\n| search '{AdditionalFilter}'\r\n| extend sources = strcat_array(todynamic(sources), \",\"), matched = strcat_array(todynamic(matched), \",\")\r\n| project-away $table\r\n", "size": 0, "showAnalytics": true, "title": "Details for Indicator : {category}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "category", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == ('{Filter}') or dest_port == ('{Filter}') or seen_indicator == ('{Filter}'))\r\n| where ('*' == ('{IndicatorType}') or category == ('{IndicatorType}'))\r\n| search '{AdditionalFilter}'\r\n| summarize [\"Total Events\"] = count() by src, dest, dest_port, category, seen_indicator, seen_where\r\n| project-rename [\"Source IP\"] = src, [\"Destination IP\"] = dest, Port = dest_port, [\"Indicator Type\"] = category, Indicator = seen_indicator, Where = seen_where\r\n| top 5 by [\"Total Events\"] ", "size": 0, "showAnalytics": true, "title": "Intel Details", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == ('{Filter}') or dest_port == ('{Filter}') or seen_indicator == ('{Filter}'))\r\n| where ('*' == ('{IndicatorType}') or category == ('{IndicatorType}'))\r\n| search '{AdditionalFilter}'\r\n| extend sources = strcat_array(todynamic(sources), \",\"), matched = strcat_array(todynamic(matched), \",\")\r\n| sort by TimeGenerated desc\r\n| project-away $table\r\n", "size": 0, "showAnalytics": true, "title": "Log Data", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "seen_where", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "seen_where", "sortOrder": 1 } ] }, "name": "query - 5", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Intel" }, "name": "Intel" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## IP Interrogation" }, "name": "text - 20" }, { "type": 1, "content": { "json": "**Corelight data for IP under investigation**" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "817d2c86-9997-4226-91e3-740e99b9e064", "version": "KqlParameterItem/1.0", "name": "OriginatingIP", "label": "IP", "type": 1, "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and\r\n dest_port !in (80, 8080, 443)\r\n| extend tp = iff(isempty(proto), tostring(toint(dest_port)) , iff(isempty(dest_port), proto , strcat(proto, \"/\", tostring(toint(dest_port)))))\r\n| where isnotempty(tp)\r\n| summarize Count = count() by tp\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Connections - Top Non-Web Protocol Usage", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "tp", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "name": "query - 2" }, { "type": 1, "content": { "json": "#### Click on the bars in the above panel **Connections - Top Non-Web Protocol Usage** to view more information.", "style": "info" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend proto_bar = tostring(split('{tp}', \"/\")[0]),\r\n dest_port_bar = toint(split('{tp}', \"/\")[1])\r\n| where (isempty(dest_port_bar) and (isempty(proto) and proto_bar == tostring(toint(dest_port))) or (isempty(dest_port) and proto_bar == proto)) or\r\n (isnotempty(dest_port_bar) and proto_bar == proto and dest_port_bar == tostring(toint(dest_port)))", "size": 0, "showAnalytics": true, "title": "Details of Protocol: {tp}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "tp", "comparison": "isNotEqualTo" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, system_name: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where ('*' == ('{OriginatingIP}') or id_orig_h == ('{OriginatingIP}') or id_resp_h == ('{OriginatingIP}'))\r\n| extend is_dest_internal_ip = iff(ipv4_is_in_any_range(id_resp_h, \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\"), \"true\", \"false\"), sensor_name = coalesce(system_name, \"unknown\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend ie = iff(is_dest_internal_ip == \"true\", \"Internal\", \"External\")\r\n| summarize Count = count() by ie", "size": 3, "showAnalytics": true, "title": "Connections - Internal vs External", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "ie", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "38", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where isnotempty(id_orig_h) and\r\n isnotempty(id_resp_h) and\r\n isnotempty(uid) and\r\n is_broadcast == \"false\" and\r\n id_orig_h != \"192.168.0.255\" and\r\n id_resp_h != \"192.168.0.255\" and\r\n ('*' == ('{OriginatingIP}') or id_orig_h == ('{OriginatingIP}') or id_resp_h == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend pr = iff(isempty(proto), tostring(toint(id_resp_p)) , iff(isempty(id_resp_p), proto , strcat(proto, \"/\", tostring(toint(id_resp_p))))),\r\n tbytes=(bytes_in + bytes_out)\r\n| summarize \r\n Service = make_set(pr),\r\n Bytes = sum(tbytes)\r\n by id_orig_h, id_resp_h, uid\r\n| top 10 by Bytes\r\n| extend iplocation = geo_info_from_ip_address(id_resp_h),\r\n Service = strcat_array(Service, \", \")\r\n| project \r\n [\"Source IP\"] = id_orig_h, \r\n [\"Destination IP\"] = id_resp_h, \r\n Service, \r\n UID = uid, \r\n Country = iplocation.country,\r\n Bytes", "size": 0, "showAnalytics": true, "title": "Connections - Top Connections/Services by Bytes Transferred", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportParameterName": "Top_Bytes_Fields", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Bytes", "formatter": 0, "formatOptions": { "aggregation": "Count" }, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": true } } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "62", "name": "query - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Connections - Internal vs External** to view more information.", "style": "info" }, "customWidth": "38", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Connections - Top Connections/Services by Bytes Transferred** to view more information.", "style": "info" }, "customWidth": "62", "name": "text - 1" } ] }, "name": "group - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, system_name: string, $table: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where ('*' == ('{OriginatingIP}') or id_orig_h == ('{OriginatingIP}') or id_resp_h == ('{OriginatingIP}'))\r\n| extend is_dest_internal_ip = iff(ipv4_is_in_any_range(id_resp_h, \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\"), \"true\", \"false\"), sensor_name = coalesce(system_name, \"unknown\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend is_dest_internal_ip_pie = iff('{ie}' == \"Internal\", \"true\", \"false\")\r\n| where is_dest_internal_ip_pie == is_dest_internal_ip\r\n| project-away $table, TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId", "size": 0, "showAnalytics": true, "title": "Details of {ie} Destination IP", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "ie", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where is_broadcast == \"false\" and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend Top_Bytes_Fields = todynamic('{Top_Bytes_Fields}')\r\n| where id_orig_h == Top_Bytes_Fields[\"Source IP\"] and\r\n id_resp_h == Top_Bytes_Fields[\"Destination IP\"] and\r\n uid == Top_Bytes_Fields[\"UID\"]\r\n| project-away Top_Bytes_Fields", "size": 0, "showAnalytics": true, "title": "Details of Connections/Services", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Top_Bytes_Fields", "comparison": "isNotEqualTo" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_http\r\n| where isnotempty(dest) and\r\n isnotempty(src) and \r\n isnotempty(method) and \r\n isnotempty(uri) and\r\n ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by dest, src, method, uri\r\n| project [\"Destination IP\"] = dest, [\"Source IP\"] = src, Method = method, URI = uri, Count\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "HTTP - Top Destination IP, Method & URI", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportParameterName": "Top_DMU", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **HTTP - Top Destination IP, Method & URI** to view more information.", "style": "info" }, "customWidth": "100", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_http\r\n| where ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend Top_DMU = todynamic('{Top_DMU}')\r\n| where src == Top_DMU[\"Source IP\"] and dest == Top_DMU[\"Destination IP\"] and method == Top_DMU[\"Method\"] and uri == Top_DMU[\"URI\"]\r\n| extend proxied = strcat_array(todynamic(proxied), \", \"), orig_mime_types = strcat_array(todynamic(orig_mime_types), \", \"),\r\n orig_fuids = strcat_array(todynamic(orig_fuids), \", \"), resp_fuids = strcat_array(todynamic(resp_fuids), \", \"),\r\n tags = strcat_array(todynamic(tags), \", \"), resp_mime_types = strcat_array(todynamic(resp_mime_types), \", \"),\r\n http_content_type = strcat_array(todynamic(http_content_type), \", \"), server_headers = strcat_array(todynamic(server_headers), \", \"),\r\n client_headers = strcat_array(todynamic(client_headers), \", \")\r\n| project-away Top_DMU", "size": 0, "showAnalytics": true, "title": "Details of Top Destination IP, Method & URI", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Top_DMU", "comparison": "isNotEqualTo" }, "showPin": false, "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, Type: string, system_name: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where isnotempty(Type) and\r\n ('*' == ('{OriginatingIP}') or id_orig_h == ('{OriginatingIP}') or id_resp_h == ('{OriginatingIP}')) and\r\n Type !in (\"Corelight_v3_dns_CL\", \"Corelight_v3_dns_red_CL\", \"Corelight_v3_conn_CL\", \"Corelight_v3_conn_red_CL\",\r\n \"Corelight_v3_conn_long_CL\", \"Corelight_v3_http_CL\", \"Corelight_v3_http_red_CL\", \"Corelight_v3_http2_CL\", \"Corelight_v3_files_CL\", \"Corelight_v3_files_red_CL\", \"Corelight_v3_smtp_CL\", \"Corelight_v3_ssl_CL\", \"Corelight_v3_ssl_red_CL\")\r\n| extend sensor_name = coalesce(system_name, \"unknown\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend Type = iif(Type endswith \"_CL\", substring(Type, 0, strlen(Type) - 3), Type)\r\n| summarize Count = count() by Type\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Corelight Supporting Data Sources For Source", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Pie_Type", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_http\r\n| where isnotempty(user_agent) and\r\n ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by tostring(user_agent)\r\n| sort by Count asc\r\n| limit 10", "size": 3, "showAnalytics": true, "title": "HTTP - Rare User Agents", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "user_agent", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where dest_port in (80, 8080, 443) and\r\n ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by tostring(toint(dest_port))", "size": 3, "showAnalytics": true, "title": "HTTP - Web Ports Breakdown", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "dest_port_pie", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 14" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Corelight Supporting Data Sources For Source** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **HTTP - Rare User Agents** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **HTTP - Web Ports Breakdown** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" } ] }, "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, Type: string, system_name: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\ntable('{Pie_Type}_CL'), dummy_table\r\n| where ('*' == ('{OriginatingIP}') or id_orig_h == ('{OriginatingIP}') or id_resp_h == ('{OriginatingIP}'))\r\n| extend sensor_name = coalesce(system_name, \"unknown\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| project-away TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId", "size": 0, "showAnalytics": true, "title": "Log Data of Type: {Pie_Type}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Pie_Type", "comparison": "isNotEqualTo" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_http\r\n| where ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and\r\n user_agent == ('{user_agent}')\r\n| extend proxied = strcat_array(todynamic(proxied), \", \"), orig_mime_types = strcat_array(todynamic(orig_mime_types), \", \"),\r\n orig_fuids = strcat_array(todynamic(orig_fuids), \", \"), resp_fuids = strcat_array(todynamic(resp_fuids), \", \"),\r\n tags = strcat_array(todynamic(tags), \", \"), resp_mime_types = strcat_array(todynamic(resp_mime_types), \", \"),\r\n http_content_type = strcat_array(todynamic(http_content_type), \", \"), server_headers = strcat_array(todynamic(server_headers), \", \"),\r\n client_headers = strcat_array(todynamic(client_headers), \", \")\r\n ", "size": 0, "showAnalytics": true, "title": "Details of Rare User Agent: {user_agent}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "user_agent", "comparison": "isNotEqualTo" }, "name": "query - 16", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_dns, corelight_conn, corelight_http, corelight_files, corelight_smtp, corelight_ssl\r\n| where ('*' == ('{OriginatingIP}') or src == ('{OriginatingIP}') or dest == ('{OriginatingIP}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and\r\n dest_port == ('{dest_port_pie}')", "size": 0, "showAnalytics": true, "title": "Details of Web Port: {dest_port_pie}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "dest_port_pie", "comparison": "isNotEqualTo" }, "showPin": false, "name": "query - 17", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "IPInterrogation" }, "name": "IP Interrogation" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Log Hunting" }, "name": "text - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a5c88c17-12c6-4155-90f6-57830654a1f3", "version": "KqlParameterItem/1.0", "name": "SourceType", "label": "Source Type", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "let dummy_table = datatable(Type: string, system_name: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where isnotempty(Type)\r\n| extend Type = iif(Type endswith \"_CL\", substring(Type, 0, strlen(Type) - 3), Type), sensor_name = coalesce(system_name, \"unknown\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| distinct Type\r\n| sort by Type asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "8dfa3a0e-dcae-4bf7-9ef9-3523cf1eb949", "version": "KqlParameterItem/1.0", "name": "IDs", "label": " IP, uid, fuid, or community_id", "type": 1, "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction" }, { "id": "6049d300-c858-46a2-9be4-9d322cd02e64", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, uid: string, fuid: string, community_id: string, resp_fuids: dynamic, uids: dynamic, Type: string, system_name: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where isnotempty(Type) and\r\n Type !startswith \"Corelight_v3_corelight\"\r\n| extend Type = iif(Type endswith \"_CL\", substring(Type, 0, strlen(Type) - 3), Type), sensor_name = coalesce(system_name, \"unknown\"),\r\n uids = split(uids, \",\")\r\n| where ('*' == ('{SourceType}') or Type == ('{SourceType}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and \r\n ('*' == ('{IDs}') or id_orig_h == ('{IDs}') or id_resp_h == ('{IDs}') or uid == ('{IDs}') or fuid == ('{IDs}') or community_id == ('{IDs}') or\r\n (array_index_of(column_ifexists(\"resp_fuids\", dynamic([])), ('{IDs}')) != -1) or (array_index_of(uids, ('{IDs}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by Type\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Filtered Corelight Data For This Unique Entity", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Pie_Type", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, uid: string, fuid: string, community_id: string, resp_fuids: dynamic, uids: dynamic, Type: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where isnotempty(Type)\r\n| extend Type = iif(Type endswith \"_CL\", substring(Type, 0, strlen(Type) - 3), Type)\r\n| summarize Count = count() by Type\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "All Corelight Data For This Unique Entity (ONLY Time Range filter applies to this graph)", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "Bar_Type", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "query - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Filtered Corelight Data For This Unique Entity** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the bars in the above panel **All Corelight Data For This Unique Entity** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 1" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, uid: string, fuid: string, community_id: string, resp_fuids: dynamic, uids: dynamic, Type: string, system_name: string, $table: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\ntable('{Pie_Type}_CL'), dummy_table\r\n| extend sensor_name = coalesce(system_name, \"unknown\"), uids = split(uids, \",\")\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor})) and \r\n ('*' == ('{IDs}') or id_orig_h == ('{IDs}') or id_resp_h == ('{IDs}') or uid == ('{IDs}') or fuid == ('{IDs}') or community_id == ('{IDs}') or\r\n (array_index_of(column_ifexists(\"resp_fuids\", dynamic([])), ('{IDs}')) != -1) or (array_index_of(uids, ('{IDs}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| project-away $table, TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId", "size": 0, "showAnalytics": true, "title": "Log Data of Type: {Pie_Type}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Pie_Type", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, uid: string, fuid: string, community_id: string, resp_fuids: dynamic, uids: dynamic, Type: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\ntable('{Bar_Type}_CL'), dummy_table\r\n| project-away TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId", "size": 0, "showAnalytics": true, "title": "Log Data of Type: {Bar_Type}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Bar_Type", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(id_orig_h: string, id_resp_h: string, uid: string, fuid: string, community_id: string, resp_fuids: dynamic, uids: dynamic, Type: string, system_name: string, TimeGenerated: datetime, id_resp_p: int)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where isnotempty(Type) and\r\n Type !startswith \"Corelight_v3_corelight\"\r\n| extend Type = iif(Type endswith \"_CL\", substring(Type, 0, strlen(Type) - 3), Type), sensor_name = coalesce(system_name, \"unknown\"),\r\n uids = split(uids, \",\")\r\n| where ('*' == ('{SourceType}') or Type == ('{SourceType}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and \r\n ('*' == ('{IDs}') or id_orig_h == ('{IDs}') or id_resp_h == ('{IDs}') or uid == ('{IDs}') or fuid == ('{IDs}') or community_id == ('{IDs}') or\r\n (array_index_of(column_ifexists(\"resp_fuids\", dynamic([])), ('{IDs}')) != -1) or (array_index_of(uids, ('{IDs}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| project TimeGenerated, Type, [\"Source IP\"] = id_orig_h, [\"Destination IP\"] = id_resp_h, [\"Destination Port\"] = id_resp_p", "size": 0, "showAnalytics": true, "title": "Log Data", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "LogHunting" }, "name": "Log Hunting" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Notices" }, "name": "text - 0" }, { "type": 1, "content": { "json": "#### Intel and Notice events\r\n\r\n" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "605fd8b1-9e6f-4039-90e2-8ada3c05aece", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "description": "Select Severity", "isRequired": true, "quote": "'", "delimiter": ",", "query": "let SeverityDetails = datatable(\r\n severity_name: string,\r\n severity_id: long,\r\n severity_description: string,\r\n severity_syslog_definition: string\r\n )[\r\n \"emergencies\",0,\"System unstable\",\"LOG_EMERG\",\r\n \"alerts\",1,\"Immediate action needed\",\"LOG_ALERT\",\r\n \"critical\",2,\"Critical conditions\",\"LOG_CRIT\",\r\n \"error\",3,\"Error conditions\",\"LOG_ERR\",\r\n \"warnings\",4,\"Warning conditions\",\"LOG_WARNING\",\r\n \"notifications\",5,\"Normal but significant condition\",\"LOG_NOTICE\",\r\n \"informational\",6,\"Informational messages only\",\"LOG_INFO\",\r\n \"debugging\",7,\"Debugging messages\",\"LOG_DEBUG\"\r\n ];\r\nunion SeverityDetails, (corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor})))\r\n| where isnotempty(severity_id)\r\n| distinct severity_id\r\n| lookup SeverityDetails on severity_id\r\n| extend severity_display = iff(isnotempty(severity_name), strcat(severity_name, \" (\", toint(severity_id), \")\"), tostring(toint(severity_id)))\r\n| project severity_id, severity_display\r\n| sort by severity_id asc\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "3fc89bfd-f16c-4531-88a5-9074dbfcf4f4", "version": "KqlParameterItem/1.0", "name": "Filter", "label": "Filter (IP, Port, Protocol)", "type": 1, "description": "Enter value for ip, port or protocol", "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "a5b2f643-ff71-401c-bfbc-3593a94da094", "version": "KqlParameterItem/1.0", "name": "Message", "type": 2, "description": "Select Message", "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by msg\r\n| top 100 by Count\r\n| project msg\r\n| sort by msg asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a0019089-66f5-41d8-a49a-da3f553aa8da", "version": "KqlParameterItem/1.0", "name": "Note", "type": 2, "description": "Select Note", "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by note\r\n| top 100 by Count\r\n| project note\r\n| sort by note asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "2fe097ca-e1d0-4823-bf44-93784b6b9e72", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "description": "Enter a keyword to search", "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| where isnotempty(path)\r\n| extend sourcetype = strcat(\"corelight_\", path)\r\n| make-series Count = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by sourcetype\r\n", "size": 0, "showAnalytics": true, "title": "Notices Over Time (Additional Filter or Severity does not apply)", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(note)\r\n| summarize Total = count() by note\r\n| top 10 by Total", "size": 3, "showAnalytics": true, "title": "Notices", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "selected_note", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Notices** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| search '{AdditionalFilter}'\r\n| where note == '{selected_note}'\r\n| extend actions = strcat_array(todynamic(actions), \",\"),action = strcat_array(todynamic(action), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Notice : {selected_note}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_note", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| search '{AdditionalFilter}'\r\n| extend severity_display = iff(isnotempty(severity_name),strcat(severity_name, \" (\", toint(severity_id), \")\"),tostring(toint(severity_id)))\r\n| where isnotempty(severity_display)\r\n| summarize Count = count() by severity_display\r\n| top 10 by Count\r\n", "size": 3, "showAnalytics": true, "title": "Severities", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "selected_severity", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(note)\r\n| extend severity_display = iff(isnotempty(severity_name),strcat(severity_name, \" (\", toint(severity_id), \")\"),tostring(toint(severity_id)))\r\n| extend pp = iff(isnotempty(proto) and isnotempty(p), strcat(proto, \"/\", toint(p)), coalesce(proto, tostring(toint(p))))\r\n| summarize ProtocolList = make_set(pp) by note, severity_display\r\n| extend Protocol = strcat_array(ProtocolList, \",\")\r\n| project Notes = note, Severity = severity_display, Protocol\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Notice Details", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Notes", "exportParameterName": "selected_notes", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 5" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Severities** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Notice Details** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| search '{AdditionalFilter}'\r\n| extend severity_display = iff(isnotempty(severity_name),strcat(severity_name, \" (\", toint(severity_id), \")\"),tostring(toint(severity_id)))\r\n| where severity_display == '{selected_severity}'\r\n| extend actions = strcat_array(todynamic(actions), \",\"),action = strcat_array(todynamic(action), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Severity : {selected_severity}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_severity", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| search '{AdditionalFilter}'\r\n| where note == '{selected_notes}'\r\n| extend pp = strcat(proto, \"/\", toint(p)), actions = strcat_array(todynamic(actions), \",\"), action = strcat_array(todynamic(action), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Notice : {selected_notes}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_notes", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{Severity}') or severity_id == ('{Severity}'))\r\n| where ('*' == ('{Filter}') or src == ('{Filter}') or dest == '{Filter}' or proto == '{Filter}' or p == '{Filter}')\r\n| where ('*' == ('{Message}') or msg == ('{Message}'))\r\n| where ('*' == ('{Note}') or note == ('{Note}'))\r\n| search '{AdditionalFilter}'\r\n| extend severity_display = iff(isnotempty(severity_name),strcat(severity_name, \" (\", toint(severity_id), \")\"),tostring(toint(severity_id))), sourcetype = strcat(\"corelight_\", path), actions = strcat_array(todynamic(actions), \",\"), action = strcat_array(todynamic(action), \",\")\r\n| sort by TimeGenerated asc \r\n| project-away $table\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Log Data", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 6", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "Notices" }, "name": "Notices" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Security Posture" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Alert Insights\r\n---" }, "name": "text - 6" }, { "type": 1, "content": { "json": "## Importing CSV Data into Watchlists\r\n\r\nThis workbook requires you to import two CSV files into specific Watchlists:\r\n1. [**CorelightAggregationsEnrichment1.csv**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment1.csv) -> CorelightAggregationsEnrichment1 Watchlist\r\n2. [**CorelightAggregationsEnrichment2.csv**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment2.csv) -> CorelightAggregationsEnrichment2 Watchlist\r\n\r\n## Import Process\r\n- Navigate to Microsoft Sentinel\r\n- Access the Watchlists section\r\n- Select the appropriate Watchlist (**CorelightAggregationsEnrichment1** or **CorelightAggregationsEnrichment2**)\r\n- Choose **Update watchlist** -> **Bulk update**\r\n- Upload the corresponding CSV file\r\n- Proceed through **Next: Review + create**\r\n- Finalize by clicking **Update**\r\n\r\nRepeat these steps for both Watchlists to ensure all data is properly imported.", "style": "upsell" }, "name": "text - 15" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs=datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days=datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\nlet AggregationRecords=corelight_suri_aggregations\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(sid)\r\n| summarize TimeGenerated = max(TimeGenerated) by did;\r\n\r\nlet trendline=toscalar(\r\n AggregationRecords\r\n | make-series Trend = count(did) default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration | project Trend);\r\n \r\nAggregationRecords\r\n| count\r\n| extend Trend = trendline\r\n ", "size": 3, "showAnalytics": true, "title": "Suricata Aggregations (From Suricata Alerts)", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "showPin": false, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(toint(sid))\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where isnotempty(technique_number)\r\n| distinct technique_number\r\n| count", "size": 3, "showAnalytics": true, "title": "Mitre Techniques", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(toint(sid))\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| summarize Max = max(impact_score)\r\n| extend Max = iff(isempty(Max),'0', Max)", "size": 3, "showAnalytics": true, "title": "Highest Score", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Max", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand sid\r\n| where isnotempty(sid)\r\n| extend sid = tostring(toint(sid))\r\n| lookup (union isfuzzy=true _GetWatchlist('CorelightAggregationsEnrichment1'), _GetWatchlist('CorelightAggregationsEnrichment2')) on sid\r\n| where isnotempty(cve_number)\r\n| count\r\n", "size": 3, "showAnalytics": true, "title": "Detections With CVEs", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suri_aggregations\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(sid) and local_resp == \"true\"\r\n| count", "size": 3, "showAnalytics": true, "title": "Internal Hosts Affected", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } } ] }, "customWidth": "28", "name": "Alert Insights - Suricata Aggregations" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs=datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days=datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet SuricataRecords=corelight_suricata_corelight\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}));\r\nlet trendline=toscalar(\r\nSuricataRecords\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration \r\n| project Trend);\r\nSuricataRecords\r\n| summarize Count=count()\r\n| extend Trend = trendline", "size": 3, "showAnalytics": true, "title": "Suricata Alerts (All Suricata Alerts)", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(src_ip)\r\n| distinct src_ip\r\n| count\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Unique Source IPs", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(dest_ip)\r\n| distinct dest_ip\r\n| count\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Unique Destination IPs", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(alert_signature_id)\r\n| distinct alert_signature_id\r\n| count\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Unique Signatures", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "customWidth": "24", "name": "Alert Insights - Suricata Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs=datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days=datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet NoticeRecords=corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(id_orig_h) and note !startswith \"Intel\";\r\nlet trendline=toscalar(\r\nNoticeRecords\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration \r\n| project Trend);\r\nNoticeRecords\r\n| summarize Count=count()\r\n| extend Trend = trendline\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Notices (Messages excluding Intel)", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(id_orig_h) \r\n| where note startswith \"ATTACK::\"\r\n| count\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Attack Count", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where note == \"MeterpreterDetection::Meterpreter_Detected\"\r\n| count", "size": 3, "showAnalytics": true, "title": "Meterpreter Count", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where note in (\"SSL::Certificate_Expired\", \"SSL::Invalid_Server_Cert\", \"SSL::Old_Version\")\r\n| count", "size": 3, "showAnalytics": true, "title": "SSL Certificate Issues", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_notice\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(note)\r\n| distinct note\r\n| count", "size": 3, "showAnalytics": true, "title": "Unique Note Count", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } } ] }, "customWidth": "24", "name": "Alert Insights-Notices" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs=datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days=datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet IntelRecords=corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}));\r\nlet trendline=toscalar(\r\nIntelRecords\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration \r\n| project Trend);\r\nIntelRecords\r\n| summarize Count=count()\r\n| extend Trend = trendline\r\n", "size": 3, "showAnalytics": true, "title": "Threat Intel (Intel Indicators)", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(seen_indicator)\r\n| distinct seen_indicator\r\n| count", "size": 3, "showAnalytics": true, "title": "Unique Indicators", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Records = (corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n);\r\nlet TotalAlerts = toscalar(Records\r\n| count);\r\nRecords\r\n| summarize ['Unique Indicators'] = dcountif(seen_indicator, isnotempty(seen_indicator))\r\n| project ['Avg Alerts Per Indicator'] = iff(['Unique Indicators'] != 0, round(toreal(TotalAlerts)/['Unique Indicators'], 2),toreal(0))\r\n", "size": 3, "showAnalytics": true, "title": "Avg Alerts Per Indicator", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Avg Alerts Per Indicator", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Records = (corelight_intel\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n);\r\nlet TotalAlerts = toscalar(Records\r\n| count);\r\nRecords\r\n| summarize ['Unique Source IPs'] = dcountif(id_orig_h, isnotempty(id_orig_h))\r\n| project ['Avg Alerts Per Source IP'] = iff(['Unique Source IPs'] != 0,round(toreal(TotalAlerts)/['Unique Source IPs'], 2), toreal(0))\r\n", "size": 3, "showAnalytics": true, "title": "Avg Alerts Per Source IP", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Avg Alerts Per Source IP", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "customWidth": "24", "name": "Alert Insights - Intel" } ] }, "name": "Alert Insights" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Encrypted Traffic Hygiene\r\n---" }, "name": "text - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet SSL=corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where is_self_signed==\"yes\" and is_dest_internal_ip==\"true\";\r\nlet trendline=toscalar(\r\nSSL\r\n| summarize arg_max(TimeGenerated, *) by ssl_subject_common_name\r\n| make-series Trend = dcount(ssl_subject_common_name) default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration\r\n| project Trend);\r\nSSL\r\n| summarize Count=dcount(ssl_subject_common_name)\r\n| extend Trend = trendline", "size": 4, "showAnalytics": true, "title": "Self Signed Certs", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet X509=corelight_x509\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend key_length = toint(certificate_key_length)\r\n| where key_length < 2048;\r\nlet trendline=toscalar(\r\nX509\r\n| summarize arg_max(TimeGenerated, *) by ssl_hash\r\n| make-series Trend = dcount(ssl_hash) default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration\r\n| project Trend);\r\nX509\r\n| summarize Count = dcount(ssl_hash)\r\n| extend Trend = trendline\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Certs w/ Low Keys", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "greenDark" } }, "showBorder": true } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_x509\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where days_to_expiry > 0 and days_to_expiry <= 15\r\n| summarize [\"Distinct Certs\"] = dcount(ssl_hash)\r\n", "size": 4, "showAnalytics": true, "title": "Expiring Certs.", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Distinct Certs", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": true } }, "name": "query - 2" } ] }, "customWidth": "25", "name": "Encrypted Traffic Hygiene Tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series ['Encrypted Traffic Volume']=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration", "size": 2, "showAnalytics": true, "title": "Encrypted Traffic Over Time", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "xAxis": "TimeGenerated", "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Count", "color": "green" }, { "seriesName": "Encrypted Traffic Volume", "color": "green" } ], "xSettings": { "label": "Time" }, "ySettings": { "label": "Encrypted traffic Volume" } } }, "customWidth": "75", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend version_status=case(version==\"TLSv13\", \"Most Secure\", \r\n version==\"TLSv12\", \"Secure\", \r\n version==\"DTLSv12\", \"Secure\", \r\n version==\"unknown-64282\", \"Unknown\", \r\n \"Old Version\")\r\n| summarize Count= count() by version_status\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "TLS Versions", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "version_status", "createOtherGroup": 0 } }, "customWidth": "40", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend src_internal=iff(isnull(is_src_internal_ip) or is_src_internal_ip==\"false\", \"External\", \"Internal\"), dest_internal=iff(isnull(is_dest_internal_ip) or is_dest_internal_ip==\"false\", \"External\", \"Internal\")\r\n| where src_internal==\"Internal\" \r\n| extend version_status=case(version==\"TLSv13\", \"Most Secure\", \r\n version==\"TLSv12\", \"Secure\", \r\n version==\"DTLSv12\", \"Secure\", \r\n version==\"unknown-64282\", \"Unknown\", \r\n \"Old Version\")\r\n| summarize Count= count() by version_status\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Internal TLS Version Profile", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true, "xSettings": { "label": "TLS Version" }, "ySettings": { "label": "Count" } } }, "customWidth": "60", "name": "query - 5" } ] }, "name": "Encrypted Traffic Hygiene" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Unencrypted Traffic Hygiene - Indicators\r\n---" }, "name": "text - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet UnencryptedConnection=corelight_etc_viz\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where viz_stat in (\"C\", \"Cc\", \"C!\", \"cc\");\r\nlet trendline=toscalar(\r\nUnencryptedConnection \r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by server_a, server_p\r\n| project Trend);\r\nUnencryptedConnection \r\n| summarize Count = count() by server_a, server_p\r\n| summarize Sum = sum(Count)\r\n| extend Trend=trendline\r\n", "size": 3, "showAnalytics": true, "title": "Unencrypted Connections", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Sum", "exportParameterName": "sum", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Sum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": true } }, "name": "query - 0" }, { "type": 1, "content": { "json": "#### Click on the count in the above panel **Unencrypted Connections** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_http,\r\ncorelight_conn,\r\ncorelight_dns,\r\ncorelight_ssl,\r\ncorelight_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where id_resp_p == 23\r\n| summarize Count = count()\r\n", "size": 3, "showAnalytics": true, "title": "Telnet Sessions", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "telnet_count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } } }, "showBorder": true } }, "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the count in the above panel **Telnet Sessions** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_smb_mapping,\r\ncorelight_smb_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| count\r\n", "size": 3, "showAnalytics": true, "title": "SMB V1 Connections", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "smb_count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } } }, "showBorder": true } }, "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the count in the above panel **SMB V1 Connections** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ftp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count()\r\n", "size": 3, "showAnalytics": true, "title": "FTP Sessions", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "ftp_count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the count in the above panel **FTP Sessions** to view more information.", "style": "info" }, "name": "text - 3" } ], "exportParameters": true }, "customWidth": "25", "name": "Unencrypted Traffic Hygiene - Indicators - Tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nunion isfuzzy=true\r\ncorelight_http,\r\ncorelight_conn,\r\ncorelight_dns,\r\ncorelight_ssl,\r\ncorelight_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(service) and service !in ('ssl', 'tls', 'dns', \"ssl,http\", \"http,ssl\")\r\n| make-series [\"Unencrypted Traffic Volume\"]=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by service", "size": 2, "showAnalytics": true, "title": "Top Unencrypted Protocols Used", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "service", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "group": "service", "createOtherGroup": 0, "showLegend": true } }, "customWidth": "75", "name": "query - 2" }, { "type": 1, "content": { "json": "#### Click on the datapoints in the above panel **Top Unencrypted Protocols Used** to view more information.\r\n", "style": "info" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_etc_viz\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where viz_stat in (\"C\", \"Cc\", \"C!\", \"cc\") \r\n| summarize Count = count() by server_a, server_p\r\n", "size": 0, "showAnalytics": true, "title": "Details of Unencrypted Connections", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "sum", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_http,\r\ncorelight_conn,\r\ncorelight_dns,\r\ncorelight_ssl,\r\ncorelight_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where id_resp_p == 23\r\n", "size": 0, "showAnalytics": true, "title": "Details of Telnet Sessions", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "telnet_count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_smb_mapping,\r\ncorelight_smb_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n", "size": 0, "showAnalytics": true, "title": "Details of SMB V1 Connections", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "smb_count", "comparison": "isNotEqualTo" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ftp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n", "size": 0, "showAnalytics": true, "title": "Details of FTP Sessions", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "ftp_count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\ncorelight_http,\r\ncorelight_conn,\r\ncorelight_dns,\r\ncorelight_ssl,\r\ncorelight_files\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where service == '{service}'\r\n", "size": 0, "showAnalytics": true, "title": "Details of Top Unencrypted Protocols Used", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "service", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "name": "Unencrypted Traffic Hygiene - Indicators" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### DNS Hygiene\r\n---" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet FailedDNS=corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where rcode_name in ('SERVFAIL', 'REFUSED', 'FORMERR' ,'NOTIMP' ,'NOTAUTH');\r\nlet trendline=toscalar(\r\nFailedDNS\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration\r\n| project Trend);\r\nFailedDNS\r\n| summarize dns_fails = count()\r\n| extend Trend = trendline\r\n", "size": 3, "showAnalytics": true, "title": "Failed DNS Queries", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "rcode_name", "formatter": 1 }, "leftContent": { "columnMatch": "dns_fails", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": true } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet UnusualQtypes=corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where qtype_name in (\"AXFR\", \"IXFR\", \"ANY\", \"TXT\");\r\nlet trendline=toscalar(\r\nUnusualQtypes\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration\r\n);\r\nUnusualQtypes\r\n| summarize failed_q=count() by bin(TimeGenerated, 1d)\r\n| summarize total = sum(failed_q) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = case(nextyesterday == 0 and today == 0, 0.0, \r\n nextyesterday == 0 and today !=0, todouble(today)*100, \r\n (todouble(today-nextyesterday)/nextyesterday)*100)", "size": 3, "showAnalytics": true, "title": "Unusual Qtypes", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "failed_q", "exportParameterName": "failed_count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "rightContent": { "columnMatch": "percentage", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": true, "size": "full" } }, "customWidth": "25", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nlet NxdomainResponses=corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where rcode_name in ('NXDOMAIN', 'NOERROR');\r\nlet trendline=toscalar(\r\nNxdomainResponses\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration\r\n);\r\nNxdomainResponses\r\n| summarize Count=count() by bin(TimeGenerated, 1d)\r\n| summarize total = sum(Count) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = case(nextyesterday == 0 and today == 0, 0.0, \r\n nextyesterday == 0 and today !=0, todouble(today)*100, \r\n (todouble(today-nextyesterday)/nextyesterday)*100)", "size": 3, "showAnalytics": true, "title": "NXDOMAIN Responses", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "rightContent": { "columnMatch": "percentage", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": true, "size": "full" } }, "customWidth": "25", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(dest_ip) and dest_port in (53, 5353) and is_dest_internal_ip==\"true\"\r\n| summarize NumberOfInternalDnsServers = dcount(dest_ip)", "size": 3, "showAnalytics": true, "title": "Internal DNS Servers", "noDataMessage": "Nodata found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "NumberOfInternalDnsServers", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "25", "name": "query - 3" }, { "type": 1, "content": { "json": "#### Click on the count in the above panel **Unusual Qtypes** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where qtype_name in (\"AXFR\", \"IXFR\", \"ANY\", \"TXT\")\r\n| summarize unique_sessions=dcount(uid), query_list = strcat_array(make_list(query), \", \"), qtype_names = strcat_array(make_list(qtype_name), \", \") by id_orig_h, id_resp_h\r\n", "size": 0, "showAnalytics": true, "title": "Details of Unusual Qtypes", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "failed_count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend iplocation=geo_info_from_ip_address(dest_ip)\r\n| extend latitude=iplocation.latitude, longitude=iplocation.longitude\r\n| extend Country = coalesce(iplocation.country, \"No Country\")\r\n| summarize Count = count() by tostring(latitude), tostring(longitude), Country\r\n| extend coordinates= iff(Country!=\"No Country\", strcat(\"Country: \",Country, \"\\nLatitude: \", latitude, \"\\nLongitude:\", longitude), Country)\r\n", "size": 3, "showAnalytics": true, "title": "Geolocation of DNS Responses", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "Count", "sizeAggregation": "Max", "labelSettings": "coordinates", "legendMetric": "Count", "numberOfMetrics": 0, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "name": "query - 0" } ] }, "name": "DNS Hygiene" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Remote Management Hygiene\r\n---" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let TopVPN=corelight_vpn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend iplocation=geo_info_from_ip_address(dest_ip)\r\n| extend country=iplocation.country\r\n| extend Country=coalesce(country, \"No Country\")\r\n| summarize arg_max(TimeGenerated, *) by dest_ip, tostring(Country)\r\n| summarize Count=count() by Country;\r\nlet totalcount=(\r\nTopVPN\r\n| summarize TotalCount = sum(Count));\r\nTopVPN\r\n| extend Percentage=(Count * 100.0)/toscalar(totalcount)\r\n| sort by Percentage desc", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top VPN destinations by Country", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Country", "yAxis": [ "Percentage", "Count" ], "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Percentage", "color": "green" }, { "seriesName": "Count", "color": "greenDarkDark" } ], "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } }, "label": "Percentage" } } }, "customWidth": "50", "name": "Top VPN destinations by Country" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<90, 7d, 31d);\r\ncorelight_vpn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where is_dest_internal_ip == \"false\"\r\n| make-series [\"Outbound VPN Connections\"]=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "Outbound VPN Connections", "color": "green", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Outbound VPN Connections", "color": "green" } ], "showDataPoints": true, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 1" }, { "type": 1, "content": { "json": "#### Metrics shows the count and percentage for the country with maximum value as default. To view the count or percentage for a particular country hover over the bar in Top VPN destinations by Country Panel.", "style": "upsell" }, "name": "Tooltip for Top VPN destinations by Country Panel" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(auth_success)\r\n| extend auth_result = iff(auth_success==\"true\",\"Success\",\"Failure\") \r\n| make-series Count=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by auth_result", "size": 0, "showAnalytics": true, "title": "RDP Authentication Attempts", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "auth", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "group": "auth_result", "createOtherGroup": 0, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Failure", "color": "redBright" }, { "seriesName": "Success", "color": "green" } ], "showDataPoints": true } }, "name": "query - 2" }, { "type": 1, "content": { "json": "#### Click on the datapoints in the above panel **RDP Authentication Attempts** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend auth_result = iff(auth_success==\"true\",\"Success\",\"Failure\") \r\n| where auth_result == '{auth}'\r\n", "size": 0, "showAnalytics": true, "title": "Details of RDP Authentication Attempts", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "auth", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "name": "Remote Management Hygiene" } ] }, "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "SecurityPosture" }, "name": "Security Posture" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Corelight Suricata IDS Alert Overview" }, "name": "text - 15" }, { "type": 1, "content": { "json": "#### A dashboard for getting a high-level overview of Suricata IDS alerts, the hosts involved, and severity levels, for triage." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "828be945-f477-4e47-9d5e-c66a1b4d20b5", "version": "KqlParameterItem/1.0", "name": "SourceIP", "label": "Source IP", "type": 1, "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "c8054457-4b6f-4811-aa54-96d953ceb35c", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"label\": \"All\", \"value\": \"*\"},\r\n { \"label\": \"Critical\", \"value\": 1},\r\n { \"label\": \"Medium\", \"value\": 2},\r\n { \"label\": \"Low\", \"value\": 3}\r\n]", "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "ef380fc5-8483-4480-86c0-d4fc86fa6370", "version": "KqlParameterItem/1.0", "name": "Category", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_suricata_corelight\r\n| where isnotempty(category) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| distinct category\r\n| sort by category asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_suricata_corelight\r\n| where ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| make-series Count = count() on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration", "size": 0, "showAnalytics": true, "title": "IDS Hits Over Time", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| count", "size": 4, "showAnalytics": true, "title": "Total IDS Hits", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportParameterName": "IDs_Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where isnotempty(signature) and\r\n ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| distinct signature\r\n| count", "size": 4, "showAnalytics": true, "title": "Unique Rules Alerting", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportParameterName": "Signature_Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "50", "name": "query - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "#### Click on the tile in the above panel **Total IDS Hits** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the tile in the above panel **Unique Rules Alerting** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend alert_metadata = strcat_array(todynamic(alert_metadata), \", \"), alert_references = strcat_array(todynamic(alert_references), \", \"),\r\n metadata = strcat_array(todynamic(metadata), \", \"), references = strcat_array(todynamic(references), \", \")", "size": 0, "showAnalytics": true, "title": "Detail of All Suricata Events", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "IDs_Count", "comparison": "isNotEqualTo" }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where isnotempty(signature) and\r\n ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend alert_metadata = strcat_array(todynamic(alert_metadata), \", \"), alert_references = strcat_array(todynamic(alert_references), \", \"),\r\n metadata = strcat_array(todynamic(metadata), \", \"), references = strcat_array(todynamic(references), \", \")", "size": 0, "showAnalytics": true, "title": "Detail of Events with Unique Rules Alerting", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Signature_Count", "comparison": "isNotEqualTo" }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "name": "group - 14" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where isnotempty(category) and\r\n ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by category\r\n| project Category = category, Count\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Category Analysis", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Category", "exportParameterName": "category", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Category Analysis** to view more information.", "style": "info" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where isnotempty(src_ip) and\r\n ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize [\"# Rules\"] = count_distinct(signature), [\"# Hits\"] = count() by src_ip\r\n| project [\"Source IP\"] = src_ip, [\"# Rules\"], [\"# Hits\"]\r\n| sort by [\"# Rules\"] desc, [\"# Hits\"] asc", "size": 0, "showAnalytics": true, "title": "Origin Summary", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Source IP", "exportParameterName": "src_ip", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Origin Summary** to view more information.", "style": "info" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n category == ('{category}') and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend alert_metadata = strcat_array(todynamic(alert_metadata), \", \"), alert_references = strcat_array(todynamic(alert_references), \", \"),\r\n metadata = strcat_array(todynamic(metadata), \", \"), references = strcat_array(todynamic(references), \", \")", "size": 0, "showAnalytics": true, "title": "Details of Category: {category}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "category", "comparison": "isNotEqualTo" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where src_ip == ('{src_ip}') and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend alert_metadata = strcat_array(todynamic(alert_metadata), \", \"), alert_references = strcat_array(todynamic(alert_references), \", \"),\r\n metadata = strcat_array(todynamic(metadata), \", \"), references = strcat_array(todynamic(references), \", \")", "size": 0, "showAnalytics": true, "title": "Details of Origin: {src_ip}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "src_ip", "comparison": "isNotEqualTo" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where isnotempty(signature_id) and\r\n ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize [\"# Sources\"] = count_distinct(src_ip), Count = count() by severity, signature, signature_id \r\n| project Severity = severity, Signature = signature, [\"Signature ID\"] = signature_id, [\"# Sources\"], Count\r\n| sort by [\"# Sources\"], Count desc", "size": 0, "showAnalytics": true, "title": "Signature Analysis", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Signature ID", "exportParameterName": "signature_id", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Signature Analysis** to view more information.", "style": "info" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_suricata_corelight\r\n| where ('*' == ('{SourceIP}') or src_ip == ('{SourceIP}')) and\r\n ('*' == ('{Severity}') or severity_id == ('{Severity}')) and\r\n ('*' == ('{Category}') or category == ('{Category}')) and\r\n ('*' in ({Sensor}) or sensor_name in ({Sensor})) and\r\n signature_id == ('{signature_id}')\r\n| project [\"Time\"] = ts, [\"Source IP\"] = src_ip, [\"Destination IP\"] = dest_ip, [\"Destination Port\"] = dest_port, Service = service, Severity = severity, Signature = signature, [\"Signature ID\"] = signature_id, [\"Session ID\"] = session_id\r\n", "size": 0, "showAnalytics": true, "title": "Log Details of Signature ID: {signature_id}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Session ID", "exportParameterName": "uid", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "signature_id", "comparison": "isNotEqualTo" }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Log Details** to view more information.", "style": "info" }, "conditionalVisibility": { "parameterName": "signature_id", "comparison": "isNotEqualTo" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(uid: string, TenantId: string, SourceSystem: string, MG: string, ManagementGroupName: string, Computer: string, RawData: string, _ResourceId: string)[];\r\n\r\nunion isfuzzy=true\r\nCorelight*, dummy_table\r\n| where uid == ('{uid}')\r\n| project-away TenantId, SourceSystem, MG, ManagementGroupName, Computer, RawData, _ResourceId", "size": 0, "showAnalytics": true, "title": "Details of Session ID: {uid}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "uid", "comparison": "isNotEqualTo" }, "name": "query - 11", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "CorelightSuricataIDSAlertOverview" }, "name": "Corelight Suricata IDS Alert Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## VPN Insights" }, "name": "text - 14" }, { "type": 1, "content": { "json": "#### VPN Inferences" }, "name": "text - 12" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d96c9726-d5cf-401c-840c-2978cf87698e", "version": "KqlParameterItem/1.0", "name": "VPN_Sensor", "label": "Corelight Sensor", "type": 2, "description": "Corelight VPN Sensor Name", "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_vpn\r\n| where isnotempty(sensor_name)\r\n| distinct sensor_name\r\n| sort by sensor_name asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "GlobalTimeRestriction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "720c46f5-c415-4f4e-9683-e2cd8694c6a4", "version": "KqlParameterItem/1.0", "name": "VPNType", "label": "VPN Type", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_vpn\r\n| where isnotempty(vpn_type)\r\n| distinct vpn_type\r\n| sort by vpn_type asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "73284741-ee52-4f9a-87f5-2d23d8d5201a", "version": "KqlParameterItem/1.0", "name": "Inference", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_vpn\r\n| mv-expand name = Names, inference = Inferences\r\n| where isnotempty(inference)\r\n| extend inference_concated = iff(isnotempty(name), strcat(name, \"(\", inference, \")\"), inference)\r\n| distinct inference_concated, tostring(inference)\r\n| sort by inference_concated asc\r\n| project inference, inference_concated", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a6972852-6429-4fe8-822a-1b7abe1aa9f4", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand inference = Inferences\r\n| where isnotempty(inference) and\r\n ('*' == ('{Inference}') or inference == ('{Inference}')) \r\n| summarize Count = count() by tostring(inference)\r\n| top 10 by Count\r\n", "size": 3, "showAnalytics": true, "title": "Inference Type", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "inference", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where isnotempty(id_orig_h) and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by id_orig_h\r\n| top 10 by Count\r\n", "size": 3, "showAnalytics": true, "title": "Top VPN Users", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "id_orig_h", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where isnotempty(vpn_type) and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by vpn_type\r\n| top 10 by Count\r\n\r\n", "size": 3, "showAnalytics": true, "title": "VPN Type", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "vpn_type", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Inference Type** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Top VPN Users** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **VPN Type** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 1" } ] }, "name": "group - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand inference = Inferences\r\n| where inference == ('{inference}')\r\n| extend Inferences = strcat_array(Inferences, \", \"), services = strcat_array(services, \", \"), Names = strcat_array(Names, \", \"), Descriptions = strcat_array(Descriptions, \", \")\r\n| project-away $table, inference", "size": 0, "showAnalytics": true, "title": "Details of Inference: {inference}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "inference", "comparison": "isNotEqualTo" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where id_orig_h == ('{id_orig_h}') and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \", \"), services = strcat_array(services, \", \"), Names = strcat_array(Names, \", \"), Descriptions = strcat_array(Descriptions, \", \")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details of VPN User: {id_orig_h}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "id_orig_h", "comparison": "isNotEqualTo" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where vpn_type == ('{vpn_type}') and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \", \"), services = strcat_array(services, \", \"), Names = strcat_array(Names, \", \"), Descriptions = strcat_array(Descriptions, \", \")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details of VPN Type: {vpn_type}", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "vpn_type", "comparison": "isNotEqualTo" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\n\r\ncorelight_vpn\r\n| where ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand inference = Inferences\r\n| where isnotempty(inference) and\r\n ('*' == ('{Inference}') or inference == ('{Inference}'))\r\n| make-series Count = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by tostring(inference)\r\n", "size": 0, "showAnalytics": true, "title": "Inferences Over Time", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| mv-expand Service = services\r\n| where tostring(Service) startswith \"spicy\"\r\n| extend Country = geo_info_from_ip_address(id_resp_h).country\r\n| summarize \r\n [\"Sum of Destination Bytes\"] = sum(resp_bytes),\r\n [\"Sum of Source Bytes\"] = sum(orig_bytes),\r\n [\"Number of Connections\"] = count()\r\n by id_orig_h, id_resp_h, id_resp_p, proto, tostring(Country), tostring(Service)\r\n| extend Gigabytes = (([\"Sum of Source Bytes\"] + [\"Sum of Destination Bytes\"]))\r\n| project [\"Source IP\"] = id_orig_h, [\"Destination IP\"] = id_resp_h, [\"Destination Port\"] = id_resp_p, Protocol = proto, [\"Destination Country\"] = tostring(Country), tostring(Service), [\"Sum of Destination Bytes\"], [\"Sum of Source Bytes\"], Gigabytes, [\"Number of Connections\"]\r\n| top 20 by Gigabytes", "size": 0, "showAnalytics": true, "title": "Largest Transfers Between Host Pairs Over VPN", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Sum of Destination Bytes", "formatter": 0, "formatOptions": { "aggregation": "Count" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "Sum of Source Bytes", "formatter": 0, "formatOptions": { "aggregation": "Count" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } }, { "columnMatch": "Gigabytes", "formatter": 0, "formatOptions": { "aggregation": "Count" }, "numberFormat": { "unit": 36, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where isnotempty(ja3) and\r\n isnotempty(ja3s) and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by ja3, ja3s\r\n| project JA3 = ja3, JA3S = ja3s, Count\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "VPN JA3 Finger Prints", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "JA3", "parameterName": "ja3", "parameterType": 1 }, { "fieldName": "JA3S", "parameterName": "ja3s", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **VPN JA3 Finger Prints** to view more information.", "style": "info" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ja3 == ('{ja3}') and\r\n ja3s == ('{ja3s}') and\r\n ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \", \"), services = strcat_array(services, \", \"), Names = strcat_array(Names, \", \"), Descriptions = strcat_array(Descriptions, \", \")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details of VPN JA3 Finger Prints", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "ja3", "comparison": "isNotEqualTo" }, { "parameterName": "ja3s", "comparison": "isNotEqualTo" } ], "name": "query - 11", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' == ('{VPN_Sensor}') or sensor_name == ('{VPN_Sensor}')) and\r\n ('*' == ('{VPNType}') or vpn_type == ('{VPNType}')) and\r\n ('*' == ('{Inference}') or (array_index_of(Inferences, ('{Inference}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \", \"), services = strcat_array(services, \", \"), Names = strcat_array(Names, \", \"), Descriptions = strcat_array(Descriptions, \", \")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "VPN Inference Log Data", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 12", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "VPNInsights" }, "name": "VPN Insights" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## RDP Inferences Overview" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4e90e755-181e-4876-852e-b74575f1583b", "version": "KqlParameterItem/1.0", "name": "SystemName", "label": "System Name", "type": 2, "description": "Select System Name", "isRequired": true, "quote": "'", "delimiter": ",", "query": "corelight_rdp\r\n| where isnotempty(system_name)\r\n| distinct system_name\r\n| sort by system_name asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "3b8429bb-070c-4049-a0f0-d583aeb4f879", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "description": "Enter a keyword to search", "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand todynamic(inferences)\r\n| where isnotempty(inferences)\r\n| summarize Count = count() by tostring(inferences)\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Inferences", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "selected_inference", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand todynamic(inferences)\r\n| where isnotempty(inferences)\r\n| make-series Trend = count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by tostring(inferences)", "size": 0, "showAnalytics": true, "title": "Inferences Over Time", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "inference_code", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 2" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Inferences** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "#### Click on the datapoints in the above panel **Inferences Over Time** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand todynamic(inferences)\r\n| where inferences == ('{selected_inference}')\r\n| extend Code = tostring(inferences)\r\n| lookup (_GetWatchlist(\"CorelightInferencesDesc\")\r\n| summarize InferenceNameList = make_set(Name) by Code) on Code\r\n| summarize inference_code = make_set(Code), inference_name = make_set(InferenceNameList), arg_max(TimeGenerated, *) by uid\r\n| extend inference_code = strcat_array(todynamic(inference_code), \",\"), inference_name = strcat_array(todynamic(inference_name), \",\"), client_channels = strcat_array(todynamic(client_channels), \",\"), InferenceNameList = strcat_array(todynamic(InferenceNameList), \",\")\r\n| project-reorder TimeGenerated\r\n", "size": 0, "showAnalytics": true, "title": "Details for Inference : {selected_inference}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_inference", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand todynamic(inferences)\r\n| where inferences == ('{inference_code}')\r\n| extend client_channels = strcat_array(todynamic(client_channels), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Inference Over Time : {inference_code}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "inference_code", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 15", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where auth_success == true\r\n| count", "size": 3, "showAnalytics": true, "title": "Successful Connections", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "success_count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where auth_success == false\r\n| count", "size": 3, "showAnalytics": true, "title": "Failed Connections", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "failure_count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false } }, "customWidth": "50", "name": "query - 4" }, { "type": 1, "content": { "json": "#### Click on the Count in the above panel **Successful Connections** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "#### Click on the Count in the above panel **Failed Connections** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where auth_success == true\r\n| extend inferences = strcat_array(todynamic(inferences), \",\"), client_channels = strcat_array(todynamic(client_channels), \",\")\r\n| project-away $table\r\n", "size": 0, "showAnalytics": true, "title": "Details for Successful Connections", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "success_count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where auth_success == false\r\n| extend inferences = strcat_array(todynamic(inferences), \",\"), client_channels = strcat_array(todynamic(client_channels), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Failed Connections", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "failure_count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 20", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(cookie)\r\n| extend ['Auth Success'] = coalesce(tolower(tostring(auth_success)), \"no_value\")\r\n| summarize Count = count() by cookie, ['Auth Success']\r\n| top 20 by Count\r\n| project-rename ['Connecting User'] = cookie\r\n", "size": 0, "showAnalytics": true, "title": "Connecting Users", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Connecting User", "parameterName": "connecting_user", "parameterType": 1, "defaultValue": "none" }, { "fieldName": "Auth Success", "parameterName": "auth_success_value", "parameterType": 1, "defaultValue": "none" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Auth Success", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Auth Success", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(security_protocol)\r\n| summarize Count = count() by security_protocol\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Security Protocols Used", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "selected_security_protocol", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 6" }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Connecting Users** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Security Protocols Used** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| extend ['Auth Success'] = coalesce(tolower(tostring(auth_success)), \"no_value\")\r\n| where cookie == '{connecting_user}' and ['Auth Success'] == '{auth_success_value}'\r\n| extend inferences = strcat_array(todynamic(inferences), \",\"), client_channels = strcat_array(todynamic(client_channels), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Connecting User : {connecting_user} and Auth Success : {auth_success_value}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "connecting_user", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "auth_success_value", "comparison": "isNotEqualTo", "value": "none" } ], "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| where security_protocol == '{selected_security_protocol}'\r\n| extend inferences = strcat_array(todynamic(inferences), \",\"), client_channels = strcat_array(todynamic(client_channels), \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Security Protocol : {selected_security_protocol}", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_security_protocol", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 13", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' == ('{SystemName}') or system_name == ('{SystemName}'))\r\n| search '{AdditionalFilter}'\r\n| mv-expand todynamic(inferences)\r\n| extend Code = tostring(inferences)\r\n| summarize Count = count() by TimeGenerated, cookie, system_name, id_orig_h, id_resp_h, id_resp_p, auth_success, Code\r\n| lookup (_GetWatchlist(\"CorelightInferencesDesc\")\r\n| summarize InferenceNameList = make_set(Name) by Code) on Code\r\n| project ['Time Generated'] = TimeGenerated, ['Connecting User'] = cookie, ['System Name'] = system_name, ['Source IP'] = id_orig_h, ['Destination IP'] = id_resp_h, ['Destination Port'] = id_resp_p, ['Auth Success'] = auth_success, Inferences = Code, ['Inferences Name'] = strcat_array(InferenceNameList, \",\")", "size": 0, "showAnalytics": true, "title": "RDP Connection Detail", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 7", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "RDPInferencesOverview" }, "name": "RDPInferencesOverview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## SSH Inferences Overview" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7c5b41a9-cec4-4da6-b7f3-e894bf04d566", "version": "KqlParameterItem/1.0", "name": "SSHInferences", "label": "SSH Inferences", "type": 2, "description": "Select SSH Inference Name", "isRequired": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\"Automated interaction\",\r\n\"Automated Password Authentication\",\r\n\"Client Authentication Bypass Exploit\",\r\n\"Client Bruteforce Guessing\",\r\n\"Client Bruteforce Success\",\r\n\"Client Scanner Authentication\",\r\n\"Client Scanner Capabilities\",\r\n\"Client Scanner Port\",\r\n\"Client Scanner Version\",\r\n\"Client trusted server\",\r\n\"Client untrusted server\",\r\n\"Interactive Password Authentication\",\r\n\"Keystrokes\",\r\n\"Large File Download\",\r\n\"Large File Upload\",\r\n\"Multifactor authentication\",\r\n\"No Remote Command (ssh -N)\",\r\n\"None Authentication\",\r\n\"Public Key Authentication\",\r\n\"Reverse SSH Initiated\",\r\n\"Reverse SSH Initiation Automated\",\r\n\"Reverse SSH Keystrokes\",\r\n\"Reverse SSH Logged in\",\r\n\"Reverse SSH Provisioned (ssh -R)\",\r\n\"Server Banner\",\r\n\"Small File Download\",\r\n\"Small File Upload\",\r\n\"SSH Agent Forwarding Requested\",\r\n\"Unknown authentication\"\r\n]", "timeContext": { "durationMs": 5184000000 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all" }, { "id": "50656155-f23c-47a1-9301-ffead07c2203", "version": "KqlParameterItem/1.0", "name": "AdditionalFilter", "label": "Additional Filter", "type": 1, "description": "Enter a keyword to search", "isRequired": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "*" } } ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand InferenceNames\r\n| where ('*' == ('{SSHInferences}') or InferenceNames == ('{SSHInferences}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(InferenceNames)\r\n| summarize Count = count() by tostring(InferenceNames)\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "SSH Inferences", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "selected_inference", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand InferenceNames\r\n| where ('*' == ('{SSHInferences}') or InferenceNames == ('{SSHInferences}'))\r\n| search '{AdditionalFilter}'\r\n| where isnotempty(InferenceNames)\r\n| make-series ['SSH Inferences']=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by tostring(InferenceNames)", "size": 0, "showAnalytics": true, "title": "SSH Inferences Over Time", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "inference_name", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 2" }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **SSH Inferences** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where array_index_of(InferenceNames, ('{selected_inference}')) != -1\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \",\"), InferenceNames = strcat_array(InferenceNames, \",\") , Descriptions = strcat_array(Descriptions, \",\")\r\n| project-away $table\r\n| project-reorder TimeGenerated, Inferences, InferenceNames, src, hassh, dest, hasshServer\r\n", "size": 0, "showAnalytics": true, "title": "Details for SSH Inference : {selected_inference}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_inference", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend [\"Source IP\"] = coalesce(src, \"unknown\"), [\"Destination IP\"] = coalesce(dest, \"unknown\"), [\"HASSH Client\"] = coalesce(hassh, \"unknown\"), [\"HASSH Server\"] = coalesce(hasshServer, \"unknown\")\r\n| summarize Count = count() by [\"Source IP\"], [\"HASSH Client\"], [\"Destination IP\"], [\"HASSH Server\"]\r\n| top 5 by Count\r\n", "size": 0, "showAnalytics": true, "title": "HASSH Fingerprint Details", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Source IP", "exportParameterName": "selected_source", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by src, dest\r\n| top 5 by Count)\r\n| join kind=leftouter\r\n(corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand InferenceNames, Inferences\r\n| where ('*' == ('{SSHInferences}') or InferenceNames == ('{SSHInferences}'))\r\n| search '{AdditionalFilter}'\r\n| extend InferenceDetails = iff(isnotempty(InferenceNames), strcat(Inferences, \":\", InferenceNames), Inferences)\r\n| summarize inference_set = strcat_array(make_set(InferenceDetails), \", \") by src, dest)\r\non src, dest\r\n| project ['Source IP'] = src, ['Destination IP'] = dest, Inferences = inference_set, Count\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "SSH Host Details", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Source IP", "exportParameterName": "selected_src_ip", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **HASSH Fingerprint Details** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **SSH Host Details** to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| where src == '{selected_source}'\r\n| extend Inferences = strcat_array(Inferences, \",\"), InferenceNames = strcat_array(InferenceNames, \",\"), Descriptions = strcat_array(Descriptions, \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Source IP : {selected_source}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_source", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| where src == '{selected_src_ip}'\r\n| extend Inferences = strcat_array(Inferences, \",\"), InferenceNames = strcat_array(InferenceNames, \",\"), Descriptions = strcat_array(Descriptions, \",\")\r\n| project-away $table", "size": 0, "showAnalytics": true, "title": "Details for Source IP: {selected_src_ip}", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_src_ip", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(host_key) and isnotempty(Inferences)\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| summarize Count = count() by src, dest)\r\n| join kind=leftouter\r\n(corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(host_key) and isnotempty(Inferences)\r\n| mv-expand InferenceNames, Inferences\r\n| where ('*' == ('{SSHInferences}') or InferenceNames == ('{SSHInferences}'))\r\n| search '{AdditionalFilter}'\r\n| extend InferenceDetails = iff(isnotempty(InferenceNames), strcat(Inferences, \":\", InferenceNames), Inferences)\r\n| summarize inference_set = strcat_array(make_set(InferenceDetails), \", \"), ['Host Key'] = make_set(host_key) by src, dest)\r\non src, dest\r\n| project [\"Source IP\"] = src, [\"Destination IP\"] = dest, ['Host Key'] = strcat_array(['Host Key'], \",\"), Inferences = inference_set, Count\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Inferences for Hosts with Host_Key", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Source IP", "exportParameterName": "selected_src", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the records in the above panel **Inferences for Hosts with Host_Key** to view more information.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(host_key) and isnotempty(Inferences)\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| where src == '{selected_src}'\r\n| extend Inferences = strcat_array(Inferences, \",\"), InferenceNames = strcat_array(InferenceNames, \",\"), Descriptions = strcat_array(Descriptions, \",\")\r\n| project-away $table\r\n| project-rename Source = src, Destination = dest", "size": 0, "showAnalytics": true, "title": "Details for Host : {selected_src} having Host Key ", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "selected_src", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where ('*' == ('{SSHInferences}') or (array_index_of(InferenceNames, ('{SSHInferences}')) != -1))\r\n| search '{AdditionalFilter}'\r\n| extend Inferences = strcat_array(Inferences, \",\"), InferenceNames = strcat_array(InferenceNames, \",\"), Descriptions = strcat_array(Descriptions, \",\")\r\n| project-away $table\r\n| project-rename Source = src, Destination = dest", "size": 0, "showAnalytics": true, "title": "SSH Inference Log Data", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 11", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "SSHInferencesOverview" }, "name": "SSHInferencesOverview" } ] }, "name": "Security Workflows" }, { "type": 1, "content": { "json": "📝 **Refresh the web page to fetch details of recently collected events**" }, "name": "text - 5" } ], "fromTemplateId": "sentinel-Corelight_Security_Workflow", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }