{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## 1Password audit logs" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "value": "/subscriptions/7570c6f7-9ca9-409b-aeaf-cb0f5ac1ad50", "typeSettings": { "additionalResourceOptions": [], "includeAll": false }, "label": "☁️ Subscription" }, { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "Resources \n| where type =~ \"microsoft.operationalinsights/workspaces\" \n| order by name \n| project id, name, selected=row_number()==1, group=resourceGroup", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "label": "🗂️ Workspace", "value": "" }, { "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "label": "⏱️ Time Range" }, { "id": "6ed3bbc6-be3f-44ed-84b3-9908e7c92315", "version": "KqlParameterItem/1.0", "name": "Help", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true },\r\n { \"value\": \"Change Log\", \"label\": \"Change Log\"}\r\n]", "label": "📖 Help", "value": "Yes" } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "customWidth": "70", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e648443b-bf59-4ae6-8c04-a5edf7097da6", "version": "KqlParameterItem/1.0", "name": "Measurement", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\r\n{\"value\": \"KM\", \"label\": \"KM\"},\r\n{\"value\": \"Miles\", \"label\": \"Miles\", \"selected\":true}\r\n]", "value": "KM" }, { "id": "ba4eb749-336e-4aa0-8a4b-2b7987507852", "version": "KqlParameterItem/1.0", "name": "Top", "label": "Show Top locations", "type": 2, "description": "Only show this amount of locations om the map", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n{ \"value\": \"5\", \"label\": \"5\"},\r\n{\"value\": \"10\", \"label\": \"10\", \"selected\":true },\r\n{\"value\": \"20\", \"label\": \"20\" },\r\n{\"value\": \"30\", \"label\": \"30\" },\r\n{\"value\": \"50\", \"label\": \"50\" }\r\n]" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "name": "parameters - settings" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "182ff415-dc4f-42d3-a39a-eab397510bc7", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "All Data", "subTarget": "AllData", "style": "link" }, { "id": "0d78c03f-f8d7-40da-8761-3ef454b14ad8", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "User Data", "subTarget": "UserData", "style": "link" } ] }, "name": "links - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "All Data", "loadType": "always", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| summarize count() by bin (timestamp, 1d), log_source", "size": 1, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "xAxis": "timestamp" } }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring((geo_info_from_ip_address (tostring(client.ip_address))).region)\r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude) \r\n| order by timestamp asc, city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_, 1)\r\n| extend pLon = prev(longitude_, 1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(row_number() > 1,tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType ,2)),\"FirstLocation\")\r\n| where distance_in !=\"0.0\"\r\n| summarize by bin(timestamp, {TimeRange:grain}),\r\n City=city_ ,\r\n CountryorRegion=countryOrRegion_, \r\n visitedInThisOrder = row_number(),\r\n distanceTravelled = distance_in,\r\n distanceTravelled2 = strcat(distance_in,' ','{Measurement}'),\r\n latitude_,\r\n longitude_\r\n| order by timestamp asc, visitedInThisOrder asc", "size": 0, "title": "User Locations", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "City", "sizeAggregation": "Count", "minSize": 20, "labelSettings": "distanceTravelled", "legendMetric": "distanceTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "CountryorRegion", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = \r\nOnePasswordEventLogs_CL\r\n| where log_source == 'signinattempts'\r\n and tostring(target_user.name) notcontains 'Provisioning';\r\ndata\r\n| summarize count() by tostring(target_user.name), bin (timestamp, 1d)", "size": 1, "title": "User Sign-ins", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "50", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend countryOrRegion_ = tostring((geo_info_from_ip_address (tostring(client.ip_address))).country)\r\n| order by TimeGenerated asc\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}),\r\n Country=countryOrRegion_ \r\n| order by count_ desc", "size": 1, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "countries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| distinct tostring(target_user.name)\r\n| count\r\n\r\n", "size": 4, "title": "Active Users", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "sortOrderField": 1 } }, "customWidth": "15", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where object_type == \"group\"\r\n| where action == \"create\"\r\n| count", "size": 4, "title": "Groups Added", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "15", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where object_type == \"group\"\r\n| where action == \"delete\"\r\n| count", "size": 4, "title": "Groups deleted", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "15", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n//| where category != \"success\"\r\n| extend actiontype_ = tostring(action_type)\r\n| order by TimeGenerated asc, category asc\r\n| summarize count() by Category=category \r\n| order by count_ desc", "size": 1, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Category", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend applicationName_ = tostring(client.app_name)\r\n| where applicationName_ notcontains \"SCIM\"\r\n| order by timestamp asc , applicationName_\r\n| summarize count() by bin(timestamp, {TimeRange:grain}),\r\n ApplicationName=applicationName_ \r\n| order by count_ desc", "size": 1, "showAnalytics": true, "title": "All Users : Used Application by most frequent", "color": "green", "noDataMessage": "Select a workspace", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "ApplicationName", "createOtherGroup": null, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location - All User - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "AllData" }, "name": "Group: AllData" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Group: UserMap", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "268ebde4-5b20-4106-9e91-8e7d36b26d4f", "version": "KqlParameterItem/1.0", "name": "Select", "label": "Select Users method", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"name\", \"label\": \"Select User by Name\", \"selected\":true },\r\n {\"value\": \"letter\", \"label\": \"Select User by letter\"},\r\n {\"value\": \"free\", \"label\": \"Select User using free text search\"}\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4fd13b3f-9856-4e1d-93f5-c4681a6b4c16", "version": "KqlParameterItem/1.0", "name": "SelectUserName", "type": 2, "isRequired": true, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where timestamp {TimeRange:query}\r\n| where isnotempty(UserDisplayName) and UserDisplayName !=\"On-Premises Directory Synchronization Service Account\"\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", "crossComponentResources": [ "{Workspace}" ], "value": "Rogier Dijkman", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 5184000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "" }, { "id": "8aa43840-1b93-449a-861e-450856dc1297", "version": "KqlParameterItem/1.0", "name": "userCount", "label": "How many unique Users?", "type": 10, "description": "1000 users max are shown", "isRequired": true, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where isnotempty(UserDisplayName) and UserDisplayName !=\"On-Premises Directory Synchronization Service Account\"\r\n| distinct UserDisplayName\r\n| summarize Count = strcat(count(),\" of 1000\")", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "Select", "comparison": "isEqualTo", "value": "name" }, "name": "parameters - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "adb47350-f652-4bd3-b2c7-dcfc3e380a23", "version": "KqlParameterItem/1.0", "name": "UserFilter", "type": 2, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| distinct UserDisplayName\r\n| project Alpha = toupper(substring(UserDisplayName,0,1))\r\n| summarize Count = count() by Alpha\r\n| order by Alpha asc\r\n| project Value=Alpha, Label=Alpha, selected = false", "crossComponentResources": [ "{Workspace}" ], "value": null, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "ad7f576a-5df8-49c1-99c2-f8fdbca5557b", "version": "KqlParameterItem/1.0", "name": "SelectUserLetter", "label": " Select User Letter", "type": 2, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName startswith '{UserFilter:label}'\r\n| summarize by UserDisplayName\r\n| order by UserDisplayName asc", "crossComponentResources": [ "{Workspace}" ], "value": null, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "96d46227-91be-4519-a83d-449e38b5f32c", "version": "KqlParameterItem/1.0", "name": "selectedUserCount", "label": "How many unique Users?", "type": 10, "description": "1000 users max are shown", "isRequired": true, "query": "SigninLogs\r\n| where UserDisplayName startswith '{UserFilter:label}'\r\n| distinct UserDisplayName\r\n| summarize Count = strcat(count(),\" of 1000\")", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "Select", "comparison": "isEqualTo", "value": "letter" }, "name": "parameters - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c2577785-56e7-415e-b95d-4af62446fb49", "version": "KqlParameterItem/1.0", "name": "SelectUserFree", "label": "Search for a User here", "type": 1, "description": "Enter a free text search for a User Name ", "value": "", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange" }, { "id": "38ee7b13-de6b-48da-a98f-0ae75ae0517e", "version": "KqlParameterItem/1.0", "name": "SelectUserwithin", "label": "Matched User(s)", "type": 2, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName contains '{SelectUserFree}'\r\n| distinct UserDisplayName\r\n| project UserDisplayName \r\n| order by UserDisplayName asc", "crossComponentResources": [ "{Workspace}" ], "value": null, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 5184000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1407f53f-c0b3-4eae-a3a8-8d60c737fb4d", "version": "KqlParameterItem/1.0", "name": "selectedUserCount2", "label": "How many unique Users?", "type": 10, "description": "1000 users max are shown", "isRequired": true, "query": "OnePasswordEventLogs_CL\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName contains '{SelectUserFree}'\r\n| distinct UserDisplayName\r\n| summarize Count = strcat(count(),\" of 1000\")", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "Select", "comparison": "isEqualTo", "value": "free" }, "name": "parameters - 12" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "ba660562-9b21-4412-b2d7-cc12bb64c33d", "version": "KqlParameterItem/1.0", "name": "SelectUser", "type": 1, "description": "Only shows user from name or letter parameter - depending on Toggle", "query": "OnePasswordEventLogs_CL\r\n| extend SelectUser = case( '{Select}' == \"name\" , '{SelectUserName}',\r\n '{Select}' == \"letter\" , '{SelectUserLetter}',\r\n '{Select}' == \"free\" , '{SelectUserwithin}',\r\n // else\r\n \"error\"\r\n )\r\n| limit 1\r\n| project SelectUser", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 12" }, { "type": 1, "content": { "json": "### Missing Input data Warning: diagnostics\r\n\r\nUser Name displayed, from the selected parameter: \r\n## {SelectUser}\r\n\r\n|Parameter|Value detected|\r\n|---|---|\r\n|Name|{SelectUserName}|\r\n|Letter|{SelectUserLetter}|\r\n|Free|{SelectUserFree}|" }, "conditionalVisibility": { "parameterName": "SelectUser", "comparison": "isEqualTo" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName == '{SelectUser}'\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring(location.region) \r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude) \r\n| order by TimeGenerated asc, city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_, 1)\r\n| extend pLon = prev(longitude_, 1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(row_number() > 0,tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType, 2)), \"FirstLocation\")\r\n| where distance_in !=\"0.0\"\r\n| summarize by bin(TimeGenerated, {TimeRange:grain}),\r\n UserDisplayName,\r\n City=city_ ,\r\n CountryorRegion=countryOrRegion_, \r\n visitedInThisOrder = row_number(),\r\n distanceTravelled = distance_in,\r\n distanceTravelled2 = strcat(distance_in,' ','{Measurement}'),\r\n latitude_,\r\n longitude_\r\n| order by TimeGenerated asc, visitedInThisOrder asc", "size": 0, "showAnalytics": true, "title": "Map showing locations for user: '{SelectUser}'", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "Namespace", "parameterName": "Namespace", "defaultValue": "All" }, { "parameterName": "SelectedUsers", "parameterType": 1 } ], "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "yAxis": [ "City" ] }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "distanceTravelled", "sizeAggregation": "Sum", "opacity": 0.7, "labelSettings": "City", "legendMetric": "distanceTravelled", "numberOfMetrics": 10, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "distanceTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "categorical" } } }, "customWidth": "50", "name": "query - 6 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "extend a = parse_json('{SelectedUsers}')\r\n| project ['User']='{SelectUser}', ['city']=a.regionName, ['latitude']=a.latitude, ['longitude']=a.longitude\r\n| limit 1", "size": 4, "title": "Please select a map region for more details", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ] }, "customWidth": "50", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = \r\nOnePasswordEventLogs_CL\r\n| where log_source == 'signinattempts'\r\n and tostring(target_user.name) in ('{SelectUser}');\r\ndata\r\n| summarize count() by tostring(target_user.name), bin (TimeGenerated,1h)", "size": 1, "title": "'{SelectUser}': Sign-in pattern", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| where target_user.name == '{SelectUser}'\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring(location.region) \r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude)\r\n| order by TimeGenerated asc , city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_,1)\r\n| extend pLon = prev(longitude_,1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(row_number() > 1,tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType ,2)),strcat(\"FirstLocation\",' ','({Measurement})') ) \r\n| extend dwell_in = datetime_diff(\"second\",TimeGenerated, prev(TimeGenerated))\r\n| where distance_in !=\"0.0\"\r\n| extend\r\n UserDisplayName = tostring(target_user.name)\r\n , City = city_\r\n , State = state_\r\n , location = location.country\r\n , IPAddress = tostring(client.ip_address)\r\n , ClientAppUsed = tostring(client.app_version)\r\n , AppDisplayName = tostring(client.app_name)\r\n| extend ResourceGroup = 'Microsoft.aadiam'\r\n| summarize by TimeGenerated,\r\n UserDisplayName,\r\n City=city_ ,\r\n State = state_,\r\n Location=countryOrRegion_, \r\n visitOrder = row_number(),\r\n distanceBetweenLocations = distance_in, // strcat(distance_in,' ','({Measurement})')\r\n dwell_in, IPAddress, ResourceGroup, AppDisplayName, ClientAppUsed\r\n| order by TimeGenerated asc, visitOrder asc", "size": 1, "showAnalytics": true, "title": "Looking for '{SelectUser}' - click a row for more IP detail", "color": "green", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "Namespace", "parameterName": "Namespace", "defaultValue": "All" }, { "fieldName": "IPAddress", "parameterName": "ipAddress", "parameterType": 1 }, { "fieldName": "ResourceGroup", "parameterName": "resourceGroup", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "distanceBetweenLocations", "formatter": 8, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "dwell_in", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } }, { "columnMatch": "ResourceGroup", "formatter": 5 }, { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true, "sortBy": [ { "itemKey": "visitOrder", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "visitOrder", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "name": "query - get User details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"method\":\"GET\",\"path\":\"/subscriptions/{Workspace:subscriptionid}/resourceGroups/Microsoft.aadiam/providers/Microsoft.SecurityInsights/enrichment/ip/geodata/?ipaddress={ipAddress}&api-version=2021-09-01-preview\",\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$\"}}]}", "size": 4, "title": "🖧 Lookup IP Address: {ipAddress} from Microsoft geoLocation api", "queryType": 12, "gridSettings": { "formatters": [ { "columnMatch": "country", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "ipAddr", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "ipAddress", "comparison": "isNotEqualTo" }, "name": "query - geoLocation api" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let IP_Data = external_data(network:string,geoname_id:long,continent_code:string,continent_name:string ,country_iso_code:string,country_name:string,is_anonymous_proxy:bool,is_satellite_provider:bool)\r\n ['https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv']\r\n with (ignoreFirstRecord=true, format=\"csv\");\r\nIP_Data\r\n| evaluate ipv4_lookup(IP_Data, '{ipAddress}', network)\r\n| summarize arg_max(network,*) by '{ipAddress}'\r\n| extend IPaddress = '{ipAddress}'\r\n| project-away *1\r\n| project-reorder IPaddress\r\n\r\n", "size": 4, "title": "🖧 Lookup IP Address: {ipAddress} from GeoIP2", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "IPaddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] } } ] } }, "conditionalVisibility": { "parameterName": "ipAddress", "comparison": "isNotEqualTo" }, "name": "query - ip lookup GeoIP2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName !=\"On-Premises Directory Synchronization Service Account\"\r\n| where UserDisplayName == '{SelectUser}'\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring(location.region) \r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude) \r\n| order by TimeGenerated asc , city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_,1)\r\n| extend pLon = prev(longitude_,1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(isnotempty(pLat),tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType ,2)),\"FirstLocation\")\r\n| where distance_in !=\"0.0\"\r\n| summarize by bin(TimeGenerated, {TimeRange:grain}),\r\n UserDisplayName,\r\n City=city_ ,\r\n CountryorRegion=countryOrRegion_, \r\n visitedInThisOrder = row_number(),\r\n distanceTravelled = strcat(distance_in,' ','{Measurement}')\r\n//| top {Top} by City\r\n| order by TimeGenerated asc, visitedInThisOrder asc\r\n", "size": 1, "showAnalytics": true, "title": " '{SelectUser}' : Cities visitied", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "unstackedbar", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "City", "createOtherGroup": 10, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName == '{SelectUser}'\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring(location.region) \r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude)\r\n| order by TimeGenerated asc , city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_,1)\r\n| extend pLon = prev(longitude_,1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(isnotempty(pLat),tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType ,2)),\"FirstLocation\")\r\n| where distance_in !=\"0.0\"\r\n| summarize by bin(TimeGenerated, {TimeRange:grain}),\r\n UserDisplayName,\r\n City=city_ ,\r\n CountryorRegion=countryOrRegion_, \r\n visitedInThisOrder = row_number(),\r\n distanceTravelled = strcat(distance_in,' ','{Measurement}')\r\n| order by TimeGenerated asc, visitedInThisOrder asc", "size": 1, "showAnalytics": true, "title": " '{SelectUser}' : distance travelled", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "unstackedbar", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "distanceTravelled", "createOtherGroup": null, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where target_user.name == '{SelectUser}'\r\n| extend city_ = tostring(location.city) \r\n| extend state_ = tostring(location.state) \r\n| extend countryOrRegion_ = tostring(location.region) \r\n| extend latitude_ = tostring(location.latitude)\r\n| extend longitude_ = tostring(location.longitude)\r\n| order by TimeGenerated asc , city_ asc\r\n| serialize \r\n| extend pLat = prev(latitude_,1)\r\n| extend pLon = prev(longitude_,1)\r\n| extend distanceType = iif('{Measurement}' == \"KM\", todouble(1000), todouble(1609.344))\r\n| extend distance_in = iif(isnotempty(pLat),tostring(round(geo_distance_2points(todouble(longitude_), todouble(latitude_), todouble(pLon), todouble(pLat))/distanceType ,2)),\"FirstLocation\")\r\n| where distance_in !=\"0.0\"\r\n| summarize by bin(TimeGenerated, {TimeRange:grain}),\r\n UserDisplayName,\r\n City=city_ ,\r\n CountryorRegion=countryOrRegion_, \r\n visitedInThisOrder = row_number(),\r\n distanceTravelled = strcat(distance_in,' ','{Measurement}')\r\n| order by TimeGenerated asc, visitedInThisOrder asc", "size": 4, "showAnalytics": true, "title": " '{SelectUser}' : Regions visitied ", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "CountryorRegion", "createOtherGroup": null, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName == '{SelectUser}'\r\n| extend applicationName_ = tostring(client.app_name)\r\n| where applicationName_ notcontains \"SCIM\"\r\n| order by TimeGenerated asc , applicationName_\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}),\r\n ApplicationName=applicationName_ \r\n| order by count_ desc", "size": 4, "showAnalytics": true, "title": "'{SelectUser}' : Used Application by most frequent", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "ApplicationName", "createOtherGroup": null, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location - All User - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OnePasswordEventLogs_CL\r\n| where log_source contains \"signinattempts\"\r\n| extend UserDisplayName = tostring(target_user.name)\r\n| where UserDisplayName == '{SelectUser}'\r\n//| where category != \"success\"\r\n| extend actiontype_ = tostring(action_type)\r\n| order by TimeGenerated asc, category asc\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}),\r\n Category=category \r\n| order by count_ desc", "size": 4, "showAnalytics": true, "title": "'{SelectUser}' : Authentication", "color": "green", "timeContextFromParameter": "TimeRange", "exportFieldName": "Namespace", "exportParameterName": "Namespace", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Table Entries", "formatter": 3, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "Table Size Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "visit_order", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "UserDisplayName", "formatter": 8, "formatOptions": { "palette": "blue", "showIcon": true } }, "centerContent": { "columnMatch": "count_", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "userNameLocation", "sourceIdField": "TimeGenerated", "targetIdField": "MilesTravelled", "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "Category", "createOtherGroup": null, "showMetrics": false, "showLegend": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "MilesTravelled", "sizeAggregation": "Sum", "labelSettings": "visit_order", "legendMetric": "MilesTravelled", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "MilesTravelled", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "redDark" } } }, "customWidth": "50", "name": "query - 6 - by Location - All User - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "UserData" }, "name": "group - UserMap" } ], "fallbackResourceIds": [], "fromTemplateId": "1Password", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }