{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.", "style": "info" }, "name": "text - 9", "styleSettings": { "margin": "0 0 20px 0" } }, { "type": 1, "content": { "json": "# Infoblox CDC BloxOne DDI & Threat Defense Workbook\r\n\r\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \r\n\r\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\r\n\r\nSupported BloxOne Cloud Source log types:\r\n* Threat Defense Query/Response Log\r\n* Threat Defense Threat Feeds Hits Log\r\n* DDI Query/Response Log\r\n* DDI DHCP Lease Log\r\n\r\n---\r\n" }, "name": "text - 3", "styleSettings": { "margin": "0 0 20px 0" } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "f2ce2fdb-104a-447f-b42b-6d11931a09ff", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "DNS & DHCP Overview", "subTarget": "DNS & DHCP Overview", "style": "link" }, { "id": "46b4abc5-316b-4c75-89b7-5cf134d6dbb0", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Security Overview", "subTarget": "Security Overview", "style": "link" }, { "id": "81661594-3591-4fe6-a67d-b69ae55abf67", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Events by Device", "subTarget": "Events by Device", "preText": "IPs", "style": "link" }, { "id": "46ca603b-ead0-46bd-987d-1d157b2a763a", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Events by Domain", "subTarget": "Events by Domain", "style": "link" }, { "id": "2e942b67-07c4-4579-ac5b-f43c5b01c51c", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Filters", "subTarget": "Filters", "style": "link" } ] }, "name": "links - 16", "styleSettings": { "margin": "0 0 20px 0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9878ee10-a66a-4438-afdd-29789d76bd61", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 172800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "parameters - 0" }, { "type": 1, "content": { "json": "#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\r\n\r\n---\r\n", "style": "info" }, "customWidth": "70", "name": "text - 7", "styleSettings": { "margin": "0 0 10px 0" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Events by Device\r\n---\r\n#### Get a closer look into where threat data is originating. \r\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \r\n\r\nMake sure to set all Threat Defense dropdowns below back to \"All\" when switching between Log Types." }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "12793c1f-b77e-4319-99f6-b6b4230d9cfe", "version": "KqlParameterItem/1.0", "name": "LogTypeParam", "label": "Log Type", "type": 2, "isRequired": true, "value": "RPZ", "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"RPZ\", \"label\":\"Threat Defense Security Hits\" },\r\n { \"value\":\"DNS\", \"label\":\"DNS Queries & Responses\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy - Copy - Copy2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "19099936-395c-4ac9-a462-097e6c1fe50c", "version": "KqlParameterItem/1.0", "name": "ThreatLevelParam", "label": "Threat Level", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"N/A\"},\r\n { \"value\":\"Info\"},\r\n { \"value\":\"Low\"},\r\n { \"value\":\"Medium\"},\r\n { \"value\":\"High\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all" }, { "id": "2d6b86ef-4bd8-4afd-be72-83f7cb365585", "version": "KqlParameterItem/1.0", "name": "FeedParam", "label": "Feed", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| where isnotempty(InfobloxB1FeedName)\r\n| summarize by InfobloxB1FeedName\r\n| order by InfobloxB1FeedName asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "8e48699a-6c2e-42b2-bcd8-15cfce54fe4d", "version": "KqlParameterItem/1.0", "name": "ThreatClassParam", "label": "Threat Class", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| summarize by ThreatClass\r\n| order by ThreatClass asc\r\n| project value = ThreatClass, label = case(ThreatClass == \"\", \"N/A\", ThreatClass)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ActionParam", "label": "Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"NXDOMAIN\", \"label\": \"Block\"},\r\n { \"value\":\"REDIRECT\", \"label\": \"Redirect\"},\r\n { \"value\":\"PASSTHRU\", \"label\": \"Log\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "id": "f57d037a-57c8-4b7b-93fd-8f6215d1c9c2" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" }, "name": "parameters - 6 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where isnotempty(SourceIP)\r\n| summarize count() by SourceIP\r\n| top 15 by count_ \r\n| project SourceIP);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where SourceIP in ((Top))\r\n| project TimeGenerated, SourceIP\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\r\n", "size": 2, "title": "Top Source IPs by Time", "color": "red", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "name": "Top Source IPs by Time" }, { "type": 1, "content": { "json": "#### Click on a Device in the chart below to further drilldown the device.\r\n\r\n---", "style": "info" }, "name": "text - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\r\n| order by count_ desc", "size": 2, "title": "Hit Count by Device", "timeContextFromParameter": "TimeRange", "exportFieldName": "SourceIP", "exportParameterName": "ip", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "40%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Device", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs 'RPZ'\r\n| where '{ip}' == SourceIP \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n", "size": 2, "showAnalytics": true, "title": "Events for {ip}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "InfobloxB1PolicyAction", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "InfobloxB1PolicyAction", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "showPin": false, "name": "Events for {ip}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where DeviceEventClassID has_cs 'DNS'\r\n| where '{ip}' == SourceIP \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol\r\n", "size": 2, "showAnalytics": true, "title": "Events for {ip}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "SourceIP", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "SourceIP", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "DNS" } ], "showPin": false, "name": "Events for {ip} - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \"\", InfobloxRPZ, InfobloxB1FeedName)\r\n| where '{ip}' == SourceIP \r\n| summarize count() by InfobloxB1FeedName\r\n| top 10 by count_ \r\n| project InfobloxB1FeedName);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \"\", InfobloxRPZ, InfobloxB1FeedName)\r\n| where '{ip}' == SourceIP \r\n| where InfobloxB1FeedName in ((Top))\r\n| where isnotempty(InfobloxB1FeedName)\r\n| project TimeGenerated, InfobloxB1FeedName\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName", "size": 0, "title": "Feed Trend for {ip}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "name": "Feed Trend for {ip}", "styleSettings": { "margin": "0px 10px 0px 0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| extend ThreatClass = case(ThreatClass == \"\", \"N/A\", ThreatClass)\r\n| where '{ip}' == SourceIP \r\n| summarize count() by ThreatClass\r\n| top 10 by count_ \r\n| project ThreatClass);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| extend ThreatClass = case(ThreatClass == \"\", \"N/A\", ThreatClass)\r\n| where '{ip}' == SourceIP \r\n| where ThreatClass in ((Top))\r\n| project TimeGenerated, ThreatClass\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass", "size": 0, "title": "Threat Class Trend for {ip}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "name": "Threat Class Trend for {ip}", "styleSettings": { "margin": "0px 10px 0px 0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel", "size": 0, "title": "Threat Level Trend for {ip}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "group": "ThreatLevel", "showLegend": true, "seriesLabelSettings": [ { "seriesName": "N/A", "label": "N/A", "color": "turquoise" }, { "seriesName": "Info", "label": "", "color": "lightBlue" }, { "seriesName": "Low", "label": "", "color": "yellow" }, { "seriesName": "Medium", "label": "", "color": "orange" }, { "seriesName": "High", "color": "red" } ] } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "name": "Threat Level Trend for {ip}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction", "size": 0, "title": "Action Trend for {ip}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "PASSTHRU", "label": "Log", "color": "green" }, { "seriesName": "REDIRECT", "label": "Redirect", "color": "orange" }, { "seriesName": "NXDOMAIN", "label": "Block", "color": "redBright" }, { "seriesName": "", "label": "Unknown", "color": "turquoise" } ] } }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "ip", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "name": "Action Trend for {ip}" }, { "type": 1, "content": { "json": "#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \r\n\r\n---", "style": "info" }, "conditionalVisibility": { "parameterName": "ip", "comparison": "isNotEqualTo" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| summarize count() by DestinationDnsDomain\r\n| order by count_ desc", "size": 2, "title": "Queries for {ip}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DestinationDnsDomain", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "60%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "20", "conditionalVisibility": { "parameterName": "ip", "comparison": "isNotEqualTo" }, "name": "Queries for {ip}", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\nlet timeframe = 1h;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| where isnotempty(DestinationDnsDomain)\r\n| summarize count() by DestinationDnsDomain\r\n| top 15 by count_ \r\n| project DestinationDnsDomain);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| where DestinationDnsDomain in ((Top))\r\n| project TimeGenerated, DestinationDnsDomain\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\r\n", "size": 2, "title": "Top Queries for {ip} by Time", "color": "red", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "brush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "customWidth": "80", "conditionalVisibility": { "parameterName": "ip", "comparison": "isNotEqualTo" }, "name": "Top Queries for {ip} by Time" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Total Events for {ip} between {brush:label}", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| summarize count()", "size": 3, "title": "Events Count", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "name": "Events Count" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{ip}' == SourceIP \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "InfobloxB1PolicyAction", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxB1PolicyAction", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" }, "showPin": false, "name": "Events for {ip} between {brush:label} - grid" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where DeviceEventClassID has_cs 'DNS'\r\n| where '{ip}' == SourceIP \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "DNS" }, "showPin": false, "name": "Events for {ip} between {brush:label} - grid - Copy" } ] }, "conditionalVisibility": { "parameterName": "ip", "comparison": "isNotEqualTo" }, "name": "Total Events for {ip} between {brush:label}" } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "Events by Device" }, "name": "Events by Device" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Events by Destination Domain\r\n---\r\n#### Get a closer look into what is being queried. \r\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \r\n\r\nMake sure to set all Threat Defense dropdowns below back to \"All\" when switching between Log Types." }, "name": "text - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9d2856d9-b23c-4779-916d-abef2e4c50e0", "version": "KqlParameterItem/1.0", "name": "LogTypeParam", "label": "Log Type", "type": 2, "isRequired": true, "value": "RPZ", "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"RPZ\", \"label\":\"Threat Defense Security Hits\" },\r\n { \"value\":\"DNS\", \"label\":\"DNS Queries & Responses\" }\r\n]", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy - Copy - Copy2 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a5663eb6-1030-421e-a60a-6af9f4af3f99", "version": "KqlParameterItem/1.0", "name": "ThreatLevelParam", "label": "Threat Level", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"N/A\"},\r\n { \"value\":\"Info\"},\r\n { \"value\":\"Low\"},\r\n { \"value\":\"Medium\"},\r\n { \"value\":\"High\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all" }, { "id": "5cbd5c34-3703-4835-aa3b-228504310c1c", "version": "KqlParameterItem/1.0", "name": "FeedParam", "label": "Feed", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| where isnotempty(InfobloxB1FeedName)\r\n| summarize by InfobloxB1FeedName\r\n| order by InfobloxB1FeedName asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "3c67b4c6-8cf3-4c75-87ea-4bca83dee296", "version": "KqlParameterItem/1.0", "name": "ThreatClassParam", "label": "Threat Class", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| summarize by ThreatClass\r\n| order by ThreatClass asc\r\n| project value = ThreatClass, label = case(ThreatClass == \"\", \"N/A\", ThreatClass)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "version": "KqlParameterItem/1.0", "name": "ActionParam", "label": "Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"NXDOMAIN\", \"label\": \"Block\"},\r\n { \"value\":\"REDIRECT\", \"label\": \"Redirect\"},\r\n { \"value\":\"PASSTHRU\", \"label\": \"Log\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "id": "730927d0-a8ce-461d-b20b-fe9cda17c486" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" }, "name": "parameters - 6 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\nlet timeframe = 1h;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where isnotempty(DestinationDnsDomain)\r\n| summarize count() by DestinationDnsDomain\r\n| top 15 by count_ \r\n| project DestinationDnsDomain);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where DestinationDnsDomain in ((Top))\r\n| project TimeGenerated, DestinationDnsDomain\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\r\n", "size": 2, "title": "Top Queries by Time", "color": "red", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "name": "Top Queries by Time" }, { "type": 1, "content": { "json": "#### Click on a Query in the chart below to further drilldown the query.\r\n\r\n---", "style": "info" }, "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| summarize count() by DestinationDnsDomain\r\n| sort by count_ desc", "size": 2, "title": "Hit Count by Query/Domain", "timeContextFromParameter": "TimeRange", "exportFieldName": "DestinationDnsDomain", "exportParameterName": "domain", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DestinationDnsDomain", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "40%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Query/Domain", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs 'RPZ'\r\n| where '{domain}' == DestinationDnsDomain \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n", "size": 2, "showAnalytics": true, "title": "Events for {domain}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "domain", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" } ], "showPin": false, "name": "Events for {domain}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where DeviceEventClassID has_cs 'DNS'\r\n| where '{domain}' == DestinationDnsDomain \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol\r\n\r\n", "size": 2, "showAnalytics": true, "title": "Events for {domain}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "customWidth": "70", "conditionalVisibilities": [ { "parameterName": "domain", "comparison": "isNotEqualTo" }, { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "DNS" } ], "showPin": false, "name": "Events for {domain} - Copy" }, { "type": 1, "content": { "json": "#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \r\n\r\n---", "style": "info" }, "conditionalVisibility": { "parameterName": "domain", "comparison": "isNotEqualTo" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{domain}' == DestinationDnsDomain \r\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\r\n| sort by count_ desc", "size": 2, "title": "Devices Querying {domain}", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "40%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "conditionalVisibility": { "parameterName": "domain", "comparison": "isNotEqualTo" }, "name": "Devices Querying {domain}", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\nlet timeframe = 1h;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{domain}' == DestinationDnsDomain \r\n| where isnotempty(SourceIP)\r\n| summarize count() by SourceIP\r\n| top 15 by count_ \r\n| project SourceIP);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange}\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{domain}' == DestinationDnsDomain \r\n| where SourceIP in ((Top))\r\n| project TimeGenerated, SourceIP\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\r\n", "size": 2, "title": "Top Devices Querying {domain} by Time", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "brush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showLegend": true } }, "customWidth": "70", "conditionalVisibility": { "parameterName": "domain", "comparison": "isNotEqualTo" }, "name": "Top Devices Querying {domain} by Time" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Events for {domain} between {brush:label}", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs '{LogTypeParam}'\r\n| where '{domain}' == DestinationDnsDomain \r\n| summarize count()", "size": 3, "title": "Events Count", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "name": "Events Count" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where DeviceEventClassID has_cs 'RPZ'\r\n| where '{domain}' == DestinationDnsDomain \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "RPZ" }, "showPin": false, "name": "Domain RPZ Events - grid" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \r\n| where DeviceEventClassID has_cs 'DNS'\r\n| where '{domain}' == DestinationDnsDomain \r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "conditionalVisibility": { "parameterName": "LogTypeParam", "comparison": "isEqualTo", "value": "DNS" }, "showPin": false, "name": "Domain RPZ Events - grid - Copy" } ] }, "conditionalVisibility": { "parameterName": "domain", "comparison": "isNotEqualTo" }, "name": "Events for {domain} between {brush:label}" } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "Events by Domain" }, "name": "Events by Domain" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## BloxOne Threat Defense Security Overview\r\n---\r\n#### Top level insight into your BloxOne Threat Defense security data.\r\n\r\n" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5", "version": "KqlParameterItem/1.0", "name": "ThreatLevelParam", "label": "Threat Level", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"N/A\"},\r\n { \"value\":\"Info\"},\r\n { \"value\":\"Low\"},\r\n { \"value\":\"Medium\"},\r\n { \"value\":\"High\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all" }, { "id": "1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463", "version": "KqlParameterItem/1.0", "name": "FeedParam", "label": "Feed", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| where isnotempty(InfobloxB1FeedName)\r\n| summarize by InfobloxB1FeedName\r\n| order by InfobloxB1FeedName asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1eedd218-57c0-43e3-a306-a716380b05e6", "version": "KqlParameterItem/1.0", "name": "ThreatClassParam", "label": "Threat Class", "type": 2, "isRequired": true, "multiSelect": true, "quote": "\"", "delimiter": ",", "query": "InfobloxCDC\r\n| summarize by ThreatClass\r\n| order by ThreatClass asc\r\n| project value = ThreatClass, label = case(ThreatClass == \"\", \"N/A\", ThreatClass)", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ActionParam", "label": "Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"NXDOMAIN\", \"label\": \"Block\"},\r\n { \"value\":\"REDIRECT\", \"label\": \"Redirect\"},\r\n { \"value\":\"PASSTHRU\", \"label\": \"Log\"}\r\n]", "timeContext": { "durationMs": 259200000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "id": "e36bc3c2-b85e-478c-968b-7faf79c21c49" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Unique Impacted Devices", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "palette": "orangeBlue" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Impacted Devices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1ConnectionType == \"remote_client\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Unique Impacted B1 Endpoints", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "min": -1, "palette": "pink" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Impacted B1 Endpoints" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize dcount(DestinationDnsDomain)", "size": 3, "title": "Unique Threat Indicators", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_DestinationDnsDomain", "formatter": 12, "formatOptions": { "min": -1, "palette": "magenta" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Threat Indicators" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize dcount(ThreatClass)", "size": 3, "title": "Unique Threat Classes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_ThreatClass", "formatter": 12, "formatOptions": { "min": -1, "palette": "greenDark" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Threat Classes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize count()", "size": 3, "title": "Total Security Hits (All Actions)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Security Hits (All Actions)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\r\n| summarize count()", "size": 3, "title": "Total Allowed + Logged Hits (PASSTHRU)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Allowed + Logged Hits (PASSTHRU)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where InfobloxB1PolicyAction == \"Block\" or SimplifiedDeviceAction == \"NXDOMAIN\"\r\n| summarize count()", "size": 3, "title": "Total Blocked Hits (NXDOMAIN)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "redBright" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Blocked Hits (NXDOMAIN)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where InfobloxB1PolicyAction == \"Redirect\" or SimplifiedDeviceAction == \"REDIRECT\"\r\n| summarize count()", "size": 3, "title": "Total Redirects (REDIRECT)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Redirects (REDIRECT)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\r\n| where ThreatLevel == \"High\"\r\n| summarize count()", "size": 3, "title": "Total High Threat Level Hits Not Blocked", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": 0, "palette": "redBright" } }, "showBorder": false } }, "customWidth": "33", "name": "Total High Threat Level Hits Not Blocked" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1FeedName !has_cs \"CAT_\" and InfobloxRPZ !has_cs \"CAT_\" and InfobloxB1FeedName !has_cs \"APP_\" and InfobloxRPZ !has_cs \"APP_\"\r\n| summarize count()", "size": 3, "title": "Total Non-Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "coldHot" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Non-Filter Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1FeedName has_cs \"CAT_\" or InfobloxRPZ has_cs \"CAT_\"\r\n| summarize count()", "size": 3, "title": "Total Category Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellowGreenBlue" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Category Filter Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1FeedName has_cs \"APP_\" or InfobloxRPZ has_cs \"APP_\"\r\n| summarize count()", "size": 3, "title": "Total Application Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "yellow" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Application Filter Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1ConnectionType == \"remote_client\"\r\n| summarize count()", "size": 3, "title": "Total Hits via B1 Endpoints", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "orangeRed" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Hits via B1 Endpoints" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1ConnectionType == \"nios\"\r\n| summarize count()", "size": 3, "title": "Total Hits via NIOS", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Hits via NIOS" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| where InfobloxB1ConnectionType == \"dfp\"\r\n| summarize count()", "size": 3, "title": "Total Hits via DFP", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "orange" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Hits via DFP" } ] }, "customWidth": "40", "name": "Totals" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}", "size": 3, "title": "Security Hits over Time", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "60", "name": "Security Hits over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize count() by DestinationDnsDomain\r\n| top 50 by count_ desc", "size": 2, "title": "Top Indicators", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false }, "chartSettings": { "createOtherGroup": 0 } }, "customWidth": "65", "name": "Top Indicators", "styleSettings": { "margin": "0px 10px 0px 0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize count() by SourceIP\r\n| top 20 by count_ desc", "size": 3, "title": "Top Impacted IPs", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 0 } }, "customWidth": "35", "name": "Top Impacted IPs" }, { "type": 1, "content": { "json": "---\r\n## Threat Level" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\"N/A\",1, 0,\"Info\",2, 0,\"Low\",3, 0,\"Medium\",4, 0,\"High\",5]\r\n|union\r\n(\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend ThreatLevel_count = case(ThreatLevel == \"High\", 5, ThreatLevel==\"Medium\", 4, ThreatLevel==\"Low\", 3, ThreatLevel==\"Info\", 2, 1)\r\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\r\n)\r\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\r\n| sort by ThreatLevel_count asc", "size": 0, "title": "Hit Count by Threat Level", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "graph", "tileSettings": { "titleContent": { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "sortCriteriaField": "status_count", "sortOrderField": 1, "size": "auto" }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "ThreatLevel", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "nodeIdField": "Count", "graphOrientation": 3, "showOrientationToggles": false, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "ThreatLevel", "type": 3, "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange" }, { "operator": "==", "thresholdValue": "High", "representation": "red" }, { "operator": "Default", "representation": "gray" } ] }, "hivesMargin": 5 } }, "customWidth": "30", "name": "Hit Count by Threat Level" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel", "size": 0, "title": "Threat Level Trend", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "N/A", "color": "gray" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Info", "color": "lightBlue" } ] } }, "customWidth": "70", "name": "Threat Level Trend" }, { "type": 1, "content": { "json": "---\r\n## Feed" }, "name": "text - 8 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \"\", InfobloxRPZ, InfobloxB1FeedName)\r\n| where isnotempty(InfobloxB1FeedName)\r\n| summarize count() by InfobloxB1FeedName\r\n| order by count_ desc", "size": 0, "title": "Hit Count by Feed", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "InfobloxB1FeedName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "50%" } }, { "columnMatch": "Feed", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Feed", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \"\", InfobloxRPZ, InfobloxB1FeedName)\r\n| summarize count() by InfobloxB1FeedName\r\n| top 10 by count_ \r\n| project InfobloxB1FeedName);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \"\", InfobloxRPZ, InfobloxB1FeedName)\r\n| where InfobloxB1FeedName in ((Top))\r\n| where isnotempty(InfobloxB1FeedName)\r\n| project TimeGenerated, InfobloxB1FeedName\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName", "size": 0, "title": "Feed Trend", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "0", "label": "N/A", "color": "green" }, { "seriesName": "1", "label": "Low/Info", "color": "blue" }, { "seriesName": "8", "label": "High", "color": "red" }, { "seriesName": "5", "label": "Medium", "color": "orange" } ] } }, "customWidth": "70", "name": "Feed Trend", "styleSettings": { "margin": "0px" } }, { "type": 1, "content": { "json": "---\r\n## Class" }, "name": "text - 8 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend ThreatClass = case(ThreatClass == \"\", \"N/A\", ThreatClass)\r\n| summarize count() by ThreatClass\r\n| order by count_ desc\r\n\r\n\r\n", "size": 0, "title": "Hit Count by Class", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "50%" } }, { "columnMatch": "Feed", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Class", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend ThreatClass = case(ThreatClass == \"\", \"N/A\", ThreatClass)\r\n| summarize count() by ThreatClass\r\n| top 10 by count_ \r\n| project ThreatClass);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| extend ThreatClass = case(ThreatClass == \"\", \"N/A\", ThreatClass)\r\n| where ThreatClass in ((Top))\r\n| project TimeGenerated, ThreatClass\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass", "size": 0, "title": "Class Trend", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "customWidth": "70", "name": "Class Trend", "styleSettings": { "margin": "0px" } }, { "type": 1, "content": { "json": "---\r\n## Action" }, "name": "text - 8 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| summarize count() by SimplifiedDeviceAction\r\n| top 10 by count_ desc", "size": 0, "title": "Hit Count By Action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "REDIRECT", "label": "Redirect", "color": "orange" }, { "seriesName": "NXDOMAIN", "label": "Block", "color": "redBright" }, { "seriesName": "PASSTHRU", "label": "Log", "color": "green" }, { "seriesName": "", "label": "Unknown", "color": "turquoise" } ] } }, "customWidth": "30", "name": "Hit Count By Action" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction", "size": 0, "title": "Action Trend", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "REDIRECT", "label": "Redirect", "color": "orange" }, { "seriesName": "NXDOMAIN", "label": "Block", "color": "redBright" }, { "seriesName": "PASSTHRU", "label": "Log", "color": "green" }, { "seriesName": "", "label": "Unknown", "color": "turquoise" } ] } }, "customWidth": "70", "name": "Action Trend", "styleSettings": { "margin": "0px" } }, { "type": 1, "content": { "json": "---\r\n## Events" }, "name": "text - 8 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"RPZ\"\r\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \"All\"\r\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \"{ActionParam:label}\" or '{ActionParam:label}' == \"All\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "30", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 5000, "filter": true, "sortBy": [ { "itemKey": "InfobloxB1FeedName", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxB1FeedName", "sortOrder": 1 } ] }, "showPin": false, "name": "RPZ Events" } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "Security Overview" }, "name": "Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## BloxOne DNS Query/Response & DHCP Leases Overview\r\n---\r\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\r\n\r\n" }, "name": "text - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Unique Devices", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "palette": "orangeBlue" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Devices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| where InfobloxB1ConnectionType == \"remote_client\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Unique B1 Endpoints", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "min": -1, "palette": "pink" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique B1 Endpoints" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize dcount(DestinationDnsDomain)", "size": 3, "title": "Unique Queries (Domains)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_DestinationDnsDomain", "formatter": 12, "formatOptions": { "min": -1, "palette": "magenta" } }, "showBorder": false } }, "customWidth": "33", "name": "Unique Queries (Domains)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize count()", "size": 3, "title": "Total Queries", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Queries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| where InfobloxB1ConnectionType == \"remote_client\"\r\n| summarize count()", "size": 3, "title": "Total Queries via B1 Endpoints", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "orangeRed" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Queries via B1 Endpoints" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| where InfobloxB1ConnectionType == \"nios\"\r\n| summarize count()", "size": 3, "title": "Total Queries via NIOS", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Queries via NIOS" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| where InfobloxB1ConnectionType == \"dfp\"\r\n| summarize count()", "size": 3, "title": "Total Queries via DFP", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "orange" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Queries via DFP" } ] }, "customWidth": "40", "name": "Totals" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode", "size": 0, "title": "DNS Queries over Time", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "showLegend": true } }, "customWidth": "60", "name": "DNS Queries over Time - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-CREATE\"\r\n| summarize count()", "size": 3, "title": "New DHCP Leases", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "orangeBlue" } }, "showBorder": false } }, "customWidth": "33", "name": "New DHCP Leases" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-CREATE\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "New DHCP Leases (Unique IPs)", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "min": -1, "palette": "pink" } }, "showBorder": false, "size": "full" } }, "customWidth": "33", "name": "New DHCP Leases (Unique IPs)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-UPDATE\"\r\n| summarize count()", "size": 3, "title": "Updated DHCP Leases ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "greenDark" } }, "showBorder": false } }, "customWidth": "33", "name": "Updated DHCP Leases " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-UPDATE\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Updated DHCP Leases (Unique IPs)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "min": -1, "palette": "magenta" } }, "showBorder": false } }, "customWidth": "33", "name": "Updated DHCP Leases (Unique IPs)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-DELETE\"\r\n| summarize count()", "size": 3, "title": "Released DHCP Leases", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "33", "name": "Released DHCP Leases" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \"DHCP-LEASE-DELETE\"\r\n| summarize dcount(SourceIP)", "size": 3, "title": "Released DHCP Leases (Unique IPs)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "dcount_SourceIP", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "33", "name": "Released DHCP Leases (Unique IPs)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DHCP\"\r\n| summarize avg(toint(column_ifexists(\"InfobloxLifetime\", \"\")))", "size": 3, "title": "Average Lease Lifespan (seconds)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "rowLimit": 200, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "InfobloxThreatLevel", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "avg_InfobloxLifetime", "formatter": 12, "formatOptions": { "min": -1, "palette": "redBright" } }, "showBorder": false } }, "customWidth": "33", "name": "Average Lease Lifespan (seconds)" } ] }, "customWidth": "40", "name": "Totals - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DHCP\"\r\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp", "size": 0, "title": "DHCP Leases over Time", "color": "magenta", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "showLegend": true } }, "customWidth": "60", "name": "DHCP Leases over Time" }, { "type": 1, "content": { "json": "---\r\n## DNS Events" }, "name": "text - 8 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize count() by DestinationDnsDomain\r\n| order by count_ desc", "size": 2, "title": "Top Requested Domains", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "InfobloxB1FeedName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "50%" } }, { "columnMatch": "Feed", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Top Requested Domains", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize count() by InfobloxDNSRCode", "size": 3, "title": "Response Codes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "InfobloxB1FeedName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "50%" } }, { "columnMatch": "Feed", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Response Codes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize count() by InfobloxB1ConnectionType", "size": 3, "title": "Queries by Connection Type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "InfobloxB1FeedName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "50%" } }, { "columnMatch": "Feed", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "", "label": "unknown", "color": "orange" } ] } }, "name": "Queries by Connection Type" } ] }, "customWidth": "30", "name": "group - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| summarize count() by SourceIP\r\n| top 25 by count_ desc", "size": 2, "title": "Top Source IPs by DNS Queries", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 0 } }, "customWidth": "40", "name": "Top Source IPs by DNS Queries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DNS\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "30", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 5000, "filter": true, "sortBy": [ { "itemKey": "InfobloxDNSQType", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "InfobloxDNSQType", "sortOrder": 2 } ] }, "showPin": false, "name": "DNS Events" }, { "type": 1, "content": { "json": "---\r\n## DHCP Events" }, "name": "text - 8 - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b71068b1-a89d-4605-8440-802f89726143", "version": "KqlParameterItem/1.0", "name": "DHCPTypeParam", "label": "DHCP Operation", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n\r\n { \"value\":\"Create\"},\r\n { \"value\":\"Delete\"},\r\n { \"value\":\"Update\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 23" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \"DHCP\"\r\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \"All\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, InfobloxLeaseOp, SourceIP, SourceHostName, SourceMACAddress, InfobloxFingerprint, InfobloxHost, InfobloxLifetime, InfobloxRangeStart, InfobloxRangeEnd, InfobloxSubnet, InfobloxLeaseUUID\r\n", "size": 2, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel_Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": ">=", "thresholdValue": "80", "representation": "red", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "30", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ], "compositeBarSettings": { "labelText": "[\"ThreatLevel\"]", "columnSettings": [ { "columnName": "ThreatLevel", "color": "orange" }, { "columnName": "DestinationDnsDomain", "color": "blue" } ] } } }, { "columnMatch": "ThreatConfidence", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "purpleBlueGreen", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 5000, "filter": true }, "sortBy": [] }, "showPin": false, "name": "DHCP Events" } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "DNS & DHCP Overview" }, "name": "DNS Query/Response Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Filters \r\n---\r\n\r\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\r\n\r\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \r\n\r\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters)." }, "name": "text - 2", "styleSettings": { "margin": "0px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs \"CAT_\" or InfobloxRPZ has_cs \"CAT_\" or InfobloxB1FeedName has_cs \"APP_\" or InfobloxRPZ has_cs \"APP_\"\r\n| summarize count()", "size": 3, "title": "All Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "orange" } }, "showBorder": false } }, "customWidth": "33", "name": "All Filter Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs \"CAT_\" or InfobloxRPZ has_cs \"CAT_\"\r\n| summarize count()", "size": 3, "title": "Category Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellowGreenBlue" } }, "showBorder": false } }, "customWidth": "33", "name": "Category Filter Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs \"APP_\" or InfobloxRPZ has_cs \"APP_\"\r\n| summarize count()", "size": 3, "title": "Application Filter Hits", "color": "orange", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "redPurple" } }, "showBorder": false } }, "customWidth": "33", "name": "Application Filter Hits" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Top Category Filter Hits", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "be7263d9-229e-4875-a60a-76114659b718", "version": "KqlParameterItem/1.0", "name": "CatFilterSorter", "label": "Sort Tiles By", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"count_ desc\", \"label\":\"Hit Count\", \"selected\":true },\r\n { \"value\":\"DestinationDnsDomain asc, count_ desc\", \"label\":\"Domain Name\" },\r\n { \"value\":\"InfobloxDomainCat asc, count_ desc\", \"label\":\"Filter Type\" }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Top Category Filters RPZ Hits", "styleSettings": { "margin": "0px 0px 0px 10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs \"CAT_\" or InfobloxRPZ has_cs \"CAT_\"\r\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\r\n| sort by {CatFilterSorter}\r\n| take 50\r\n", "size": 3, "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "subtitleContent": { "columnMatch": "InfobloxDomainCat", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "rowLimit": 50, "sortOrderField": 1 }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Tops", "styleSettings": { "margin": "-20px 0px 0px 0px" } } ] }, "name": "Top Category Filter Hits", "styleSettings": { "margin": "10px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Top Application Filter Hits", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "be7263d9-229e-4875-a60a-76114659b718", "version": "KqlParameterItem/1.0", "name": "AppFilterSorter", "label": "Sort Tiles By", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"count_ desc\", \"label\":\"Hit Count\", \"selected\":true },\r\n { \"value\":\"DestinationDnsDomain asc, count_ desc\", \"label\":\"Domain Name\" },\r\n { \"value\":\"InfobloxDomainCat asc, count_ desc\", \"label\":\"Filter Type\" }\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Top Category Filters RPZ Hits", "styleSettings": { "margin": "0px 0px 0px 10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs \"APP_\" or InfobloxRPZ has_cs \"APP_\"\r\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\r\n| sort by {AppFilterSorter}\r\n| take 50\r\n", "size": 3, "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "subtitleContent": { "columnMatch": "InfobloxDomainCat", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "rowLimit": 50, "sortOrderField": 1 }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Tops", "styleSettings": { "margin": "-20px 0px 0px 0px" } } ] }, "name": "Top Application Filter Hits", "styleSettings": { "margin": "10px" } } ] }, "name": "Overview", "styleSettings": { "margin": "0px" } }, { "type": 1, "content": { "json": "---\r\n## By Filters" }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9f55f1ff-f771-485f-82a9-52a9f42251cc", "version": "KqlParameterItem/1.0", "name": "FilterTypeParam", "label": "Filter Type", "type": 2, "isRequired": true, "value": "CAT_", "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\":\"CAT_\", \"label\":\"Category Filters\" },\r\n { \"value\":\"APP_\", \"label\":\"Application Filters\" }\r\n]", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "TimeRange" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| summarize count() by InfobloxDomainCat\r\n| top 15 by count_ \r\n| project InfobloxDomainCat);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where InfobloxDomainCat in ((Top))\r\n| project TimeGenerated, InfobloxDomainCat\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat", "size": 2, "title": "Top Filters by Time", "color": "red", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "name": "Top Filters by Time" }, { "type": 1, "content": { "json": "#### Click on a Filter in the chart below to further drilldown the filter.\r\n---", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| summarize count() by InfobloxDomainCat\r\n| sort by count_ desc", "size": 0, "title": "Hit Count by Filter ", "timeContextFromParameter": "TimeRange", "exportFieldName": "InfobloxDomainCat", "exportParameterName": "filter", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "40%" } }, { "columnMatch": "CategoryFilter", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60%" } } ], "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Filter ", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{filter}' == InfobloxDomainCat\r\n| sort by TimeGenerated desc, SourceIP desc\r\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n", "size": 0, "showAnalytics": true, "title": "Events for {filter}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "gray", "text": "N/A" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Message", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "InfobloxB1SrcOSVersion", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "InfobloxB1SrcOSVersion", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibility": { "parameterName": "filter", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Events for {filter}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{filter}' == InfobloxDomainCat \r\n| summarize count() by SourceIP\r\n| top 10 by count_ desc\r\n", "size": 2, "title": "Top IPs for {filter}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "LogSeverity", "label": "Threat Level" } ] } }, "customWidth": "25", "conditionalVisibility": { "parameterName": "filter", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Top IPs for {filter}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{filter}' == InfobloxDomainCat \r\n| summarize count() by DestinationDnsDomain\r\n| top 10 by count_ \r\n| project DestinationDnsDomain);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{filter}' == InfobloxDomainCat \r\n| where DestinationDnsDomain in ((Top))\r\n| project TimeGenerated, DestinationDnsDomain\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\r\n", "size": 2, "title": "Top Queries for {filter} by Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "LogSeverity", "label": "Threat Level" } ] }, "chartSettings": { "createOtherGroup": 0, "showLegend": true } }, "customWidth": "74", "conditionalVisibility": { "parameterName": "filter", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Top Queries for {filter} by Time", "styleSettings": { "margin": "0 0 0 1%" } } ] }, "name": "Category Filter By Type" }, { "type": 1, "content": { "json": "---\r\n## By Source IP" }, "name": "text - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| summarize count() by SourceIP\r\n| top 15 by count_ \r\n| project SourceIP);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where SourceIP in ((Top))\r\n| project TimeGenerated, SourceIP\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP", "size": 2, "title": "Top Source IPs by Time", "color": "red", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 0, "showLegend": true } }, "name": "Top Source IPs by Time" }, { "type": 1, "content": { "json": "#### Click on a Source IP in the chart below to further drilldown the IP.\r\n\r\n---", "style": "info" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| summarize count() by SourceIP\r\n| sort by count_ desc", "size": 0, "title": "Hit Count by Source IP", "timeContextFromParameter": "TimeRange", "exportFieldName": "SourceIP", "exportParameterName": "ip_cat", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SourceIP", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60%" } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "40%" } }, { "columnMatch": "CategoryFilter", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Hits" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DestinationDnsDomain", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "Hit Count by Source IP", "styleSettings": { "margin": "0 10px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{ip_cat}' == SourceIP\r\n| sort by TimeGenerated desc, InfobloxDomainCat desc\r\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network\r\n\r\n", "size": 2, "showAnalytics": true, "title": "Events for {ip_cat}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "gray", "text": "N/A" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Message", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true } }, "customWidth": "70", "conditionalVisibility": { "parameterName": "ip_cat", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Events for {ip_cat}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{ip_cat}' == SourceIP \r\n| summarize count() by DestinationDnsDomain", "size": 2, "title": "Top Queries for {ip_cat}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "LogSeverity", "label": "Threat Level" } ] }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "25", "conditionalVisibility": { "parameterName": "ip_cat", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Top Queries for {ip_cat}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:start};\r\nlet endtime = {TimeRange:end};\r\n// Finding Tops \r\nlet Top = materialize(InfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{ip_cat}' == SourceIP \r\n| summarize count() by InfobloxDomainCat\r\n| top 10 by count_ \r\n| project InfobloxDomainCat);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxCDC\r\n| where TimeGenerated {TimeRange} \r\n| where DeviceEventClassID has_cs \"RPZ\" \r\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\r\n| where '{ip_cat}' == SourceIP \r\n| where InfobloxDomainCat in ((Top))\r\n| project TimeGenerated, InfobloxDomainCat\r\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat", "size": 2, "title": "Top Filters for {ip_cat} by Time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "N/A" }, { "operator": "==", "thresholdValue": "1", "representation": "blue", "text": "Low/Info" }, { "operator": "==", "thresholdValue": "5", "representation": "orange", "text": "Medium" }, { "operator": "==", "thresholdValue": "8", "representation": "red", "text": "High" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "LogSeverity", "color": "blue" }, { "columnName": "DestinationDnsDomain", "color": "purple" } ] } } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "LogSeverity", "label": "Threat Level" } ] }, "chartSettings": { "createOtherGroup": 0, "showLegend": true } }, "customWidth": "75", "conditionalVisibility": { "parameterName": "ip_cat", "comparison": "isNotEqualTo" }, "showPin": false, "name": "Top Filters for {ip_cat} by Time" } ] }, "name": "Category Filter by IP" } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "Filters" }, "name": "Category Filters" } ], "fallbackResourceIds": [], "styleSettings": { "spacingStyle": "none" }, "fromTemplateId": "sentinel-InfobloxCDCB1TDWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }