{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## ExtraHop Detections\n---\n"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "2b036d8d-8429-40a5-a5f4-8f7473738749",
            "version": "KqlParameterItem/1.0",
            "name": "query_times",
            "label": "Time Interval",
            "type": 4,
            "description": "Time range for detection Start Times",
            "isRequired": true,
            "value": {
              "durationMs": 86400000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"ExtraHop\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n| extend detectionID = DeviceCustomNumber1\n| extend StartTime = coalesce(\n                            column_ifexists(\"StartTime\", datetime(null)),\n                            extract(\"start=([0-9-]+T[0-9:.]+Z)\", 1, AdditionalExtensions,typeof(datetime)),\n                            datetime(null)\n                        )\n| summarize arg_min(todatetime(ReceiptTime), *) by detectionID\n| summarize count(detectionID) by Activity, bin(make_datetime(ReceiptTime), 1h)\n",
        "size": 0,
        "title": "Detections by Recently Updated",
        "timeContextFromParameter": "query_times",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Activity",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_detectionID",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "detections_by_time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let category_map = dynamic(\n{\n    \"sec.action\" : \"Actions on Objective\",\n    \"sec.caution\": \"Caution\",\n    \"sec.command\": \"Command and Control\",\n    \"sec.exploit\": \"Exploitation\",\n    \"sec.lateral\": \"Lateral Movement\",\n    \"sec.recon\": \"Reconnaissance\"\n    }\n);\nCommonSecurityLog\n| where DeviceVendor == \"ExtraHop\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n| extend categories = iif(DeviceCustomString2 != \"\", split(DeviceCustomString2, \",\"),dynamic(null))\n| extend detectionID = DeviceCustomNumber1\n| project detectionID, updateTime=todatetime(ReceiptTime), categories\n| summarize arg_max(updateTime, *) by detectionID\n| sort by detectionID desc \n| where isnotnull(categories)\n| mv-expand cat=categories to typeof(string)\n| extend cat = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),cat) \n| summarize count() by cat\n| project Category=tostring(category_map[cat]), Count=count_\n| where Category != \"\"",
        "size": 0,
        "title": "Detections by Category",
        "timeContextFromParameter": "query_times",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "30",
      "name": "total-detections-pie"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let ExtraHopDetections = materialize(CommonSecurityLog\n    | where DeviceVendor == \"ExtraHop\"\n    | extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n    | extend detectionID = DeviceCustomNumber1\n    | extend StartTime = coalesce(\n                            column_ifexists(\"StartTime\", datetime(null)),\n                            extract(\"start=([0-9-]+T[0-9:.]+Z)\", 1, AdditionalExtensions,typeof(datetime)),\n                            datetime(null)\n                        )\n    | project SourceIP, DestinationIP, detectionID, StartTime\n    | summarize arg_max(todatetime(StartTime), *) by detectionID\n    | sort by detectionID desc);\nlet t1 = ExtraHopDetections | where SourceIP != \"\" | summarize dcount=dcount(detectionID) by SourceIP | project IPAddress=SourceIP, dcount;\nlet t2 = ExtraHopDetections | where DestinationIP != \"\" | summarize dcount=dcount(detectionID) by DestinationIP | project IPAddress=DestinationIP, dcount;\nt1 | union t2 | summarize Count=sum(dcount) by [\"IP Address\"]=IPAddress | top 10 by Count desc",
        "size": 0,
        "title": "Top Participants",
        "timeContextFromParameter": "query_times",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "35",
      "name": "top-participants"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n    | where DeviceVendor == \"ExtraHop\"\n    | extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\n    | extend StartTime = coalesce(\n                            column_ifexists(\"StartTime\", datetime(null)),\n                            extract(\"start=([0-9-]+T[0-9:.]+Z)\", 1, AdditionalExtensions,typeof(datetime)),\n                            datetime(null)\n                        )\n    | extend detectionID = DeviceCustomNumber1\n    | summarize arg_max(todatetime(StartTime), *) by detectionID\n    | summarize Count=count() by Activity\n    | sort by Count desc, Activity asc\n    | project-rename [\"Detection Title\"]=Activity",
        "size": 0,
        "title": "Top Detections by Title",
        "timeContextFromParameter": "query_times",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "35",
      "name": "detections-by-title"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"ExtraHop\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n         DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\n| summarize arg_max(ReceiptTime, *) by DeviceCustomNumber1 // detection ID\n| sort by DeviceCustomNumber2 // risk score\n| project [\"Risk Score\"] = DeviceCustomNumber2,\nTitle=Activity, \nSourceIP,\nDestinationIP,\n[\"Last Updated\"]=format_datetime(make_datetime(ReceiptTime), 'M/d/yyyy HH:mm:ss'),\nID=DeviceCustomNumber1,\nURI=DeviceCustomString1\n| take 10\n",
        "size": 0,
        "title": "Top Ten Detections by Highest Risk Score",
        "timeContextFromParameter": "query_times",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "top-ten-by-risk"
    }
  ],
  "fromTemplateId": "sentinel-ExtraHop",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}