{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5b5bf4e9-62b8-4ef2-aeb3-ecd249fb6187", "version": "KqlParameterItem/1.0", "name": "CustomTimeRange", "label": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "6b4373f0-7c1a-47d8-baed-bc5d0cd7233e", "version": "KqlParameterItem/1.0", "name": "timebrush", "label": "Time Filter", "type": 4, "isRequired": true, "isHiddenWhenLocked": true, "typeSettings": { "selectableValues": [], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 60000, "endTime": "2016-12-12T18:01:00.000Z" } }, { "id": "a40ffccc-08a0-4e15-9bf2-3ed99658d4d8", "version": "KqlParameterItem/1.0", "name": "selectedseverity", "label": "Severity", "type": 2, "description": "Filter on Security Events by Severity", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\"high\", \"med\",\"low\"]", "value": [ "value::all" ] }, { "id": "e2572416-ae1f-42db-8c31-8d0d4c4315d4", "version": "KqlParameterItem/1.0", "name": "selectedtype", "label": "Type", "type": 2, "description": "Filter on Security Events by Type", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\"Audit\",\"Application\", \"Process\", \"User\", \"Network\", \"System\"]", "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let audit = view(){\n Samsung_Knox_Audit_CL\n };\nlet application= view(){\n Samsung_Knox_Application_CL\n };\n let system= view(){\n Samsung_Knox_System_CL\n };\n let process= view(){\n Samsung_Knox_Process_CL\n };\n let user= view(){\n Samsung_Knox_User_CL\n };\n let network= view(){\n Samsung_Knox_Network_CL\n };\nlet selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nlet maxdatapoints = 10000;\nlet starttime = {CustomTimeRange:start};\nlet endtime = {CustomTimeRange:end};\nlet day = datetime_diff('day',endtime,starttime);\nlet initialbinsize = case(day >=30, 1d, day >=7, 1d, day >=1,1h,5m);\nlet datapoints = (binsize : timespan){\nunion (audit() | where \"Audit\" in (selectedtables)), (application() | where \"Application\" in (selectedtables)),(process() | where \"Process\" in (selectedtables)),(user() | where \"User\" in (selectedtables)),(network() | where \"Network\" in (selectedtables)),(system() | where \"System\" in (selectedtables))\n| where TimeGenerated >= {CustomTimeRange:start} and TimeGenerated <={CustomTimeRange:end} \n| where Severity in (severityParam)\n| summarize Count=count() by Name, bin(TimeGenerated,binsize)};\n\nlet totalpoints = datapoints(initialbinsize) |summarize totalrows = count();\nlet inttotalpoints = toint(toscalar(totalpoints));\nlet binsizefactor = inttotalpoints/maxdatapoints +1;\nlet binsize = binsizefactor * initialbinsize;\n\nunion (audit() | where \"Audit\" in (selectedtables)), (application() | where \"Application\" in (selectedtables)),(process() | where \"Process\" in (selectedtables)),(user() | where \"User\" in (selectedtables)),(network() | where \"Network\" in (selectedtables)),(system() | where \"System\" in (selectedtables))\n| where TimeGenerated >= {CustomTimeRange:start} and TimeGenerated <={CustomTimeRange:end} \n| where Severity in (severityParam)\n| summarize Count=count() by Name, bin(TimeGenerated,binsize)\n", "size": 2, "title": "Total events", "noDataMessage": "No security event data found for the selected time period, severity or type.  Please update the filters applied.", "timeBrushParameterName": "timebrush", "timeBrushExportOnlyWhenBrushed": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "60", "name": "query - 7", "styleSettings": { "margin": "0px", "padding": "0px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\n\nlet severityParam = dynamic([{selectedseverity}]);\nlet audit = view(){\n Samsung_Knox_Audit_CL\n };\nlet application= view(){\n Samsung_Knox_Application_CL\n };\n let system= view(){\n Samsung_Knox_System_CL\n };\n let process= view(){\n Samsung_Knox_Process_CL\n };\n let user= view(){\n Samsung_Knox_User_CL\n };\n let network= view(){\n Samsung_Knox_Network_CL\n };\nlet selectedtables = dynamic([{selectedtype}]);\nunion (audit() | where \"Audit\" in (selectedtables)), (application() | where \"Application\" in (selectedtables)),(process() | where \"Process\" in (selectedtables)),(user() | where \"User\" in (selectedtables)),(network() | where \"Network\" in (selectedtables)),(system() | where \"System\" in (selectedtables))\n|where iff('{timebrush:label}'==\"12/12/2016 10:00 AM - 10:01 AM\" , TimeGenerated >= {CustomTimeRange:start} and TimeGenerated <={CustomTimeRange:end}, TimeGenerated >= {timebrush:start} and TimeGenerated <={timebrush:end})\n|where Severity in (severityParam)\n| summarize count() by Severity\n| where Severity in ('high', 'med','low')\n|order by case( Severity == 'high',3, Severity == 'med',2, Severity == 'low',1,0)\n", "size": 4, "title": "Events by severity", "noDataMessage": "No security event data found for the selected time period, severity or type.  Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "severity", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "severity", "color": "redBright" }, { "columnName": "severity", "color": "orange" }, { "columnName": "severity", "color": "lightBlue" } ] } } }, { "columnMatch": "count_", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "severity", "color": "lightBlue" }, { "columnName": "severity", "color": "lightBlue" }, { "columnName": "severity", "color": "lightBlue" } ] } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "low", "representation": "yellow", "text": "{0}" }, { "operator": "==", "thresholdValue": "med", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "sortOrderField": 1 } }, "customWidth": "100", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let severityParam = dynamic([{selectedseverity}]);\nlet audit = view(){\n Samsung_Knox_Audit_CL\n };\nlet application= view(){\n Samsung_Knox_Application_CL\n };\n let system= view(){\n Samsung_Knox_System_CL\n };\n let process= view(){\n Samsung_Knox_Process_CL\n };\n let user= view(){\n Samsung_Knox_User_CL\n };\n let network= view(){\n Samsung_Knox_Network_CL\n };\nlet selectedtables = dynamic([{selectedtype}]);\nunion (audit() | where \"Audit\" in (selectedtables)), (application() | where \"Application\" in (selectedtables)),(process() | where \"Process\" in (selectedtables)),(user() | where \"User\" in (selectedtables)),(network() | where \"Network\" in (selectedtables)),(system() | where \"System\" in (selectedtables))\n|where iff('{timebrush:label}'==\"12/12/2016 10:00 AM - 10:01 AM\" , TimeGenerated >= {CustomTimeRange:start} and TimeGenerated <={CustomTimeRange:end}, TimeGenerated >= {timebrush:start} and TimeGenerated <={timebrush:end})\n|where Severity in (severityParam)\n| summarize count() by Type\n| render piechart ", "size": 3, "title": "Events by type", "noDataMessage": "No security event data found for the selected time period, severity or type.  Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Samsung_Knox_Application_CL", "label": "Application" }, { "seriesName": "Samsung_Knox_Network_CL", "label": "Network" }, { "seriesName": "Samsung_Knox_User_CL", "label": "User" }, { "seriesName": "Samsung_Knox_Process_CL", "label": "Process" }, { "seriesName": "Samsung_Knox_Audit_CL", "label": "Audit" }, { "seriesName": "Samsung_Knox_System_CL", "label": "System" } ] } }, "name": "query - 11" } ] }, "name": "group - 9" } ] }, "customWidth": "40", "name": "group - 8", "styleSettings": { "margin": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nlet audit = view(){\n Samsung_Knox_Audit_CL\n };\nlet application= view(){\n Samsung_Knox_Application_CL\n };\n let system= view(){\n Samsung_Knox_System_CL\n };\n let process= view(){\n Samsung_Knox_Process_CL\n };\n let user= view(){\n Samsung_Knox_User_CL\n };\n let network= view(){\n Samsung_Knox_Network_CL\n };\nlet selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nunion (audit() | where \"Audit\" in (selectedtables)), (application() | where \"Application\" in (selectedtables)),(process() | where \"Process\" in (selectedtables)),(user() | where \"User\" in (selectedtables)),(network() | where \"Network\" in (selectedtables)),(system() | where \"System\" in (selectedtables))\n| where iff('{timebrush:label}'==\"12/12/2016 10:00 AM - 10:01 AM\" , TimeGenerated >= {CustomTimeRange:start} and TimeGenerated <={CustomTimeRange:end}, TimeGenerated >= {timebrush:start} and TimeGenerated <={timebrush:end})\n| where Severity in (severityParam)\n|project Time =TimeGenerated,\nName,\nSeverity,\n[\"Device Model\"] = DeviceModel,\nType = replace_string(replace_string(Type,\"Samsung_Knox_\",\"\"),\"_CL\",\"\"),\nProfile,\n[\"MITRE Technique ID(s)\"] = array_strcat(MitreTtp,\", \")\n| sort by Time desc\n\n\n", "size": 2, "title": "Event list", "noDataMessage": "No security event data found for the selected time period, severity or type.  Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "dot-redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "med", "representation": "dot-orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "low", "representation": "dot-yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "LOW", "representation": "dot-yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "HIGH", "representation": "dot-redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "MED", "representation": "dot-orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } } ], "rowLimit": 1000 } }, "name": "query - 9" } ] }, "name": "group - 6" } ], "fromTemplateId": "sentinel-SamsungKnoxAssetIntelligence", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }