{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "993362fd-57fa-42bf-acdc-9b17553a5206", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 2592000000 }, "value": { "durationMs": 2592000000 } }, { "id": "3ec1d354-0588-43dd-b3e5-7ebab2195c40", "version": "KqlParameterItem/1.0", "name": "host_token", "label": "Veeam Backup & Replication Data Sources", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Veeam_GetSecurityEvents\r\n| summarize by original_host", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "26fbaaa0-3b0f-4506-885b-9fd8cd87ece9", "version": "KqlParameterItem/1.0", "name": "vone_host_token", "label": "Veeam ONE Data Sources", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Veeam_GetVeeamONEAlarms\r\n| summarize by VoneHostName", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d559890f-2663-49a6-af45-3dfc1fa7fda0", "cellValue": "isRest", "linkTarget": "parameter", "linkLabel": "Syslog", "subTarget": "0", "preText": "d", "postText": "d", "style": "secondary" }, { "id": "aee69a87-0e6f-4aab-ab21-14423e4d2d3d", "cellValue": "isRest", "linkTarget": "parameter", "linkLabel": "REST", "subTarget": "1", "style": "link" } ] }, "name": "links - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Custom Tables Events Overview" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| summarize Count = count() by Status\n| top 20 by Count\n| project Status, Count\n| render piechart", "size": 3, "title": "Veeam ONE Triggered Alarms by Status", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "label", "parameterName": "VoneTriggeredAlarmsStatusRest" }, { "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Warning", "color": "orange" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Resolved", "color": "blue" }, { "seriesName": "Error", "color": "redBright" } ] } }, "customWidth": "25", "name": "query - vone-alarms-status" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| summarize Count = count() by Severity\n| top 20 by Count\n| project Severity, Count\n| render piechart", "size": 3, "title": "Malware Events by Severity", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "MalwareEventsSeverity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Infected", "color": "redBright" } ] } }, "customWidth": "25", "name": "query - malware-severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| summarize Count = count() by State\n| top 20 by Count\n| project State, Count\n| render piechart", "size": 3, "title": "Authorization Events by State", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "AuthorizationEventsState", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Approved", "color": "green" }, { "seriesName": "Info", "color": "blue" }, { "seriesName": "Rejected", "color": "redBright" } ] } }, "customWidth": "25", "name": "query - authorization-state" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamSecurityComplianceAnalyzer_CL\n| summarize Count = count() by Status\n| top 20 by Count\n| project Status, Count\n| render piechart", "size": 3, "title": "Security & Compliance Analyzer Results by Status", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "BestPracticesStatus", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Violation", "color": "redBright" }, { "seriesName": "OK", "color": "green" }, { "seriesName": "UnableToCheck", "color": "orange" } ] } }, "customWidth": "25", "name": "query - best-practices-status" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\r\n| where \"{VoneTriggeredAlarmsStatusRest}\" == Status\r\n| project-away TenantId, Type, _ResourceId", "size": 0, "title": "Veeam ONE Triggered Alarms by Status Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "VoneTriggeredAlarmsStatusRest", "comparison": "isNotEqualTo" }, { "parameterName": "MalwareEventsSeverity", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesStatus", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsState", "comparison": "isEqualTo" } ], "name": "VeeamONETriggeredAlarmsDrilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\r\n| where \"{AuthorizationEventsState}\" == State\r\n| project-away TenantId, Type, _ResourceId", "size": 0, "title": "Authorization Events by State Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "VoneTriggeredAlarmsStatusRest", "comparison": "isEqualTo" }, { "parameterName": "MalwareEventsSeverity", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsState", "comparison": "isNotEqualTo" }, { "parameterName": "BestPracticesStatus", "comparison": "isEqualTo" } ], "name": "Authorization Events Drilldown " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\r\n| where \"{MalwareEventsSeverity}\" == Severity\r\n| project-away TenantId, Type, _ResourceId", "size": 0, "title": "Malware Events by Severity Drilldown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "MalwareEventsSeverity", "comparison": "isNotEqualTo" }, { "parameterName": "VoneTriggeredAlarmsStatusRest", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesStatus", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsState", "comparison": "isEqualTo" } ], "name": "MalwareEventsDrilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamSecurityComplianceAnalyzer_CL\r\n| where \"{BestPracticesStatus}\" == Status\r\n| project-away TenantId, Type, _ResourceId", "size": 0, "title": "Security & Compliance Analyzer Results by Status Drilldown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibilities": [ { "parameterName": "MalwareEventsSeverity", "comparison": "isEqualTo" }, { "parameterName": "VoneTriggeredAlarmsStatusRest", "comparison": "isEqualTo" }, { "parameterName": "AuthorizationEventsState", "comparison": "isEqualTo" }, { "parameterName": "BestPracticesStatus", "comparison": "isNotEqualTo" } ], "name": "BestPracticesAnalysisDrilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| summarize Count = count() by Name\n| top 20 by Count\n| project Name, Count\n| render piechart", "size": 3, "title": "Veeam ONE Triggered Alarms by Name", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "VoneTriggeredAlarmsName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Warning", "color": "orange" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Success", "color": "yellow" } ] } }, "customWidth": "33", "name": "query - vone-alarms-name" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\r\n| where \"{VoneTriggeredAlarmsName}\" == Name\r\n| project-away TenantId, Type, _ResourceId", "size": 0, "title": "Veeam ONE Triggered Alarms by Name Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibility": { "parameterName": "VoneTriggeredAlarmsName", "comparison": "isNotEqualTo" }, "name": "VeeamONETriggeredAlarmsDrilldown - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| where Severity == \"Infected\"\n| count", "size": 2, "title": "Infected Files Detected", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "statSettings": { "showBorder": false, "colorSettings": { "colorizeBody": true, "thresholds": [ { "criteria": "isGreaterThan", "value": "0", "color": "red" } ] } } }, "customWidth": "33", "name": "infected-files-stat", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union VeeamOneTriggeredAlarms_CL, VeeamMalwareEvents_CL, VeeamAuthorizationEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamCovewareFindings_CL\n| summarize Count = count() by Type\n| project [\"Event Type\"] = Type, Count\n| render piechart", "size": 3, "title": "All Custom Table Events by Type", "timeContextFromParameter": "TimeRange", "exportFieldName": "Event Type", "exportParameterName": "CustomTableEventType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - custom-tables-distribution" }, { "type": 1, "content": { "json": "## Daily Trends" }, "name": "text - daily-trends" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Coveware Findings" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| summarize Count = count() by EventType\r\n| top 20 by Count\r\n| project EventType, Count\r\n| render piechart", "size": 3, "title": "Coveware Findings by Name", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "CovewareFindingsName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| summarize Count = count() by bin(EventTime, 1d), RiskLevel\r\n| order by EventTime asc\r\n| render timechart", "size": 0, "title": "Daily Coveware Findings by Risk Level", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "label", "parameterName": "CovewareRiskLevel", "parameterType": 1 }, { "fieldName": "x", "parameterName": "DailyCovewareFindingsTime", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "medium", "color": "orange" } ] } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| where EventType == \"{CovewareFindingsName}\"\r\n", "size": 0, "title": "Coveware Findings by Name Drilldown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "CovewareFindingsName", "comparison": "isNotEqualTo" }, { "parameterName": "CovewareRiskLevel", "comparison": "isEqualTo" } ], "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| where RiskLevel == \"{CovewareRiskLevel}\"\r\n", "size": 0, "title": "Coveware Findings by Risk Level Drilldown", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "CovewareFindingsName", "comparison": "isEqualTo" }, { "parameterName": "CovewareRiskLevel", "comparison": "isNotEqualTo" } ], "name": "query - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamCovewareFindings_CL\r\n| project ScanTime, Artifact, EventType, TechniqueId, EventTime, Hostname, EventActivity, MachineId, RiskLevel, TenantId, Id", "size": 0, "title": "Coveware Findings Details", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "CovewareFindingsName", "comparison": "isEqualTo" }, "name": "query - 2" } ] }, "name": "group - 17", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| summarize Count = count() by bin(TimeGenerated, 1d), Status\n| order by TimeGenerated asc\n| render timechart", "size": 0, "title": "Daily Veeam ONE Triggered Alarms", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "daily-vone-alarms" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| summarize Count = count() by bin(TimeGenerated, 1d), Severity\n| order by TimeGenerated asc\n| render timechart", "size": 0, "title": "Daily Malware Events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "daily-malware-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| summarize Count = count() by bin(TimeGenerated, 1d), State\n| order by TimeGenerated asc\n| render timechart", "size": 0, "title": "Daily Four-Eyes Authorization Events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "100", "name": "daily-authorization-events" }, { "type": 1, "content": { "json": "## Latest Events" }, "name": "text - latest-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamOneTriggeredAlarms_CL\n| project TimeGenerated, [\"Host\"] = VoneHostName, [\"Alarm Name\"] = Name, Status, [\"Object Name\"] = ObjectName, [\"Object Type\"] = ObjectType, Description\n| top 15 by TimeGenerated desc", "size": 0, "title": "Latest Veeam ONE Triggered Alarms", "timeContextFromParameter": "TimeRange", "exportFieldName": "Alarm Name", "exportParameterName": "SelectedVoneAlarm", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-vone-alarms" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamMalwareEvents_CL\n| project TimeGenerated, [\"Host\"] = VbrHostName, [\"Machine\"] = MachineDisplayName, Severity, [\"Detection Time\"] = DetectionTimeUtc, Engine, Details, [\"Created By\"] = CreatedBy\n| top 15 by TimeGenerated desc", "size": 0, "title": "Latest Malware Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "Machine", "exportParameterName": "SelectedMalwareMachine", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-malware-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamAuthorizationEvents_CL\n| project TimeGenerated, [\"Host\"] = VbrHostName, [\"Event Name\"] = Name, State, [\"Processed By\"] = ProcessedBy, [\"Creation Time\"] = CreationTime, [\"Expiration Time\"] = ExpirationTime\n| top 15 by TimeGenerated desc", "size": 0, "title": "Latest Authorization Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "Event Name", "exportParameterName": "SelectedAuthEvent", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-authorization-events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VeeamSecurityComplianceAnalyzer_CL\n| project TimeGenerated, [\"Host\"] = VbrHostName, [\"Best Practice\"] = BestPractice, Status\n| top 15 by TimeGenerated desc", "size": 0, "title": "Latest Security & Compliance Analysis", "timeContextFromParameter": "TimeRange", "exportFieldName": "Best Practice", "exportParameterName": "SelectedBestPractice", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "latest-best-practices" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "1" }, "name": "REST Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Overview" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\n| where \"{vone_host_token}\" == \"All\" or VoneHostName in ({vone_host_token})\n| summarize Count = count() by [\"SeverityDescription\"]\n| top 20 by Count\n| project [\"SeverityDescription\"], Count\n| render piechart \n", "size": 3, "title": "Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "VeeamONEAlarmsSeverity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\" or SyslogMessage has \"predefined_alarm_id\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\r\n| extend eventId = strcat(\r\n tostring(extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage)), \r\n tostring(extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage))\r\n)\r\n| where eventId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\",\"23630\",\"23631\",\"23632\",\"23633\",\"24020\",\"24114\",\"24131\",\"24140\",\"24142\",\"24143\",\"24160\",\"24170\",\"25000\",\"25210\",\"25220\",\"25400\",\"25700\",\"25800\",\"26000\",\"26600\",\"26700\",\"26800\",\"26900\",\"27200\",\"27300\",\"27500\",\"27600\",\"27900\",\"28400\",\"28800\",\"28850\",\"28940\",\"29110\",\"29140\",\"30700\",\"30800\",\"31000\",\"32100\",\"32400\",\"32800\",\"40202\",\"41200\",\"41401\",\"42280\",\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\",\"378\")\r\n| extend host = Computer\r\n| count", "size": 0, "title": "All Security Activities", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "All Security Activities", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\n| summarize Count = count() by SeverityDescription\n| top 20 by Count\n| render piechart\n", "size": 3, "title": "Veeam Backup & Replication Security Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "VeeamBackupAndReplicationSecurityEventsSeverity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 3", "styleSettings": { "maxWidth": "50%" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{VeeamONEAlarmsSeverity}\" == SeverityDescription\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Veeam ONE Alarms Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsSeverity", "comparison": "isEqualTo" }, { "parameterName": "VeeamONEAlarmsSeverity", "comparison": "isNotEqualTo" } ], "name": "Veeam ONE Alarms by Severity Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{VeeamBackupAndReplicationSecurityEventsSeverity}\" == SeverityDescription\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage", "size": 0, "title": "Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsSeverity", "comparison": "isNotEqualTo" }, { "parameterName": "VeeamONEAlarmsSeverity", "comparison": "isEqualTo" } ], "name": "Veeam Backup & Replication Security Events Drilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"All\" or VoneHostName in ({vone_host_token})\r\n| summarize Count = count() by [\"Event Name\"]\r\n| project [\"Event Name\"], Count\r\n| render piechart ", "size": 3, "title": "Veeam ONE Alarms by Name", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "VeeamONEAlarmsName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| summarize Count = count() by [\"Event Name\"]\r\n| top 20 by Count\r\n| render piechart\r\n", "size": 3, "title": "Veeam Backup & Replication Security Events by Name", "timeContextFromParameter": "TimeRange", "exportFieldName": "label", "exportParameterName": "VeeamBackupAndReplicationSecurityEventsName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "redBright" }, { "seriesName": "Information", "color": "blue" }, { "seriesName": "Medium", "color": "yellow" }, { "seriesName": "High", "color": "orange" } ] } }, "customWidth": "50", "name": "query - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{VeeamONEAlarmsName}\" == [\"Event Name\"]\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Veeam ONE Alarms Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsName", "comparison": "isEqualTo" }, { "parameterName": "VeeamONEAlarmsName", "comparison": "isNotEqualTo" } ], "name": "Veeam ONE Alarms by Name Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{VeeamBackupAndReplicationSecurityEventsName}\" == [\"Event Name\"]\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage", "size": 0, "title": "Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VeeamBackupAndReplicationSecurityEventsName", "comparison": "isNotEqualTo" }, { "parameterName": "VeeamONEAlarmsName", "comparison": "isEqualTo" } ], "name": "Veeam Backup & Replication Security Events Drilldown - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where instanceId == \"42220\"\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Marked as Infected", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "MarkedAsInfectedCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Marked as Infected", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| extend original_host = Computer\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Four-Eyes Authorization Events", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "FourEyesAuthorizationEventsCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Four-Eyes Authorization Events", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"41600\"\r\n| extend original_host = Computer\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| count", "size": 3, "title": "Marked as Suspicious", "timeContextFromParameter": "TimeRange", "exportFieldName": "Count", "exportParameterName": "MarkedAsSuspiciousCount", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "mega" } }, "customWidth": "33", "name": "Marked as Suspicious", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Four-Eyes Authorization Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isNotEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isEqualTo" } ], "name": "Four-Eyes Authorization Events Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42220\"\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Marked as Infected Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isNotEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isEqualTo" } ], "name": "Marked as Infected Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"41600\"\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Four-Eyes Authorization Events Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "MarkedAsInfectedCount", "comparison": "isEqualTo" }, { "parameterName": "MarkedAsSuspiciousCount", "comparison": "isNotEqualTo" }, { "parameterName": "FourEyesAuthorizationEventsCount", "comparison": "isEqualTo" } ], "name": "Four-Eyes Authorization Events Drilldown" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Overview", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Daily Security Activities" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription", "size": 0, "aggregation": 5, "title": "Daily Veeam Backup & Replication Security Events", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "x", "parameterName": "DailyVeeamBackupAndReplicationSecurityEventsTime", "parameterType": 4, "plus": "1d", "minus": "1d" }, { "fieldName": "label", "parameterName": "DailyVeeamBackupAndReplicationSecurityEventsSeverity", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "Daily Veeam Backup & Replication Security Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{vone_host_token}\" == \"All\" or VoneHostName in ({vone_host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\r\n| order by TimeGenerated asc\r\n| render timechart ", "size": 0, "aggregation": 5, "title": " Daily Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "x", "parameterName": "DailyVeeamONEAlarmsTime", "parameterType": 4, "plus": "1d", "minus": "1d" }, { "fieldName": "label", "parameterName": "DailyVeeamONEAlarmsSeverity", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": " Daily Veeam ONE Alarms" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| where SeverityDescription == \"{DailyVeeamBackupAndReplicationSecurityEventsSeverity}\"\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, Severity = SeverityDescription, SyslogMessage\r\n", "size": 0, "title": "Daily Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "DailyVeeamBackupAndReplicationSecurityEventsTime", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamBackupAndReplicationSecurityEventsSeverity", "comparison": "isNotEqualTo" }, { "parameterName": "DailyVeeamONEAlarmsSeverity", "comparison": "isEqualTo" } ], "name": "Daily Veeam Backup & Replication Security Events Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where SeverityDescription == \"{DailyVeeamONEAlarmsSeverity}\"\r\n| where \"{host_token}\" == \"All\" or VoneHostName in ({vone_host_token})\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Daily Veeam Backup & Replication Security Events Drilldown", "timeContextFromParameter": "DailyVeeamONEAlarmsTime", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "DailyVeeamBackupAndReplicationSecurityEventsSeverity", "comparison": "isEqualTo" }, { "parameterName": "DailyVeeamONEAlarmsSeverity", "comparison": "isNotEqualTo" } ], "name": "Daily Veeam ONE Alarms Drilldown - Copy" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Daily Security Activities" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Latest Security Activities" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetSecurityEvents\r\n| where \"{host_token}\" == \"All\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, User = user, [\"Message Details\"] = Description, SeverityDescription, SyslogMessage", "size": 0, "title": "Latest Veeam Backup & Replication Security Events", "timeContext": { "durationMs": 86400000 }, "exportFieldName": "SyslogMessage", "exportParameterName": "VBRSyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Latest Veeam Backup & Replication Security Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetVeeamONEAlarms\r\n| where \"{host_token}\" == \"All\" or VoneHostName in ({vone_host_token})\r\n| project TimeGenerated, [\"Data Source\"] = VoneHostName, [\"Alarm Name\"] = alarm_name, Severity = SeverityDescription, [\"Alarm Type\"] = alarm_name, [\"Message Details\"] = alarm_details, [\"Previous Status\"] = status_old, [\"Current Status\"] = status_new, [\"Object Name\"] = object_name, [\"Object Path\"] = object_path, SyslogMessage", "size": 0, "title": "Latest Veeam ONE Alarms", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VoneSyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "customWidth": "50", "name": "Latest Veeam ONE Alarms" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VBRSyslogMessage}\r\n```" }, "conditionalVisibilities": [ { "parameterName": "VBRSyslogMessage", "comparison": "isNotEqualTo" }, { "parameterName": "VoneSyslogMessage", "comparison": "isEqualTo" } ], "name": "text - 3" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VoneSyslogMessage}\r\n```" }, "conditionalVisibilities": [ { "parameterName": "VoneSyslogMessage", "comparison": "isNotEqualTo" }, { "parameterName": "VBRSyslogMessage", "comparison": "isEqualTo" } ], "name": "text - 4" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Latest Security Activities" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Four-Eyes Authorization Events" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let watchlist = _GetWatchlist(\"operation_names_lookup\"); \r\nSyslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"All\" or Computer in ({host_token})\r\n| extend OperationId = extract(\"OperationId=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| lookup kind=inner (watchlist) \r\n on $left.OperationId == $right.[\"Operation Id\"]\r\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\r\n", "size": 0, "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "label", "parameterName": "FourEyesAuthorizationEventsName", "parameterType": 1 }, { "fieldName": "x", "parameterName": "FourEyesAuthorizationEventsTime", "parameterType": 4, "plus": "1d", "minus": "1d" } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let watchlist = _GetWatchlist(\"operation_names_lookup\"); \r\nSyslog\r\n| where SyslogMessage has \"instanceId\"\r\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \r\n| where instanceId == \"42402\"\r\n| where \"{host_token}\" == \"All\" or Computer in ({host_token})\r\n| extend OperationId = extract(\"OperationId=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| lookup kind=inner (watchlist) \r\n on $left.OperationId == $right.[\"Operation Id\"]\r\n| where OperationName == \"{FourEyesAuthorizationEventsName}\"\r\n", "size": 0, "timeContextFromParameter": "FourEyesAuthorizationEventsTime", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibility": { "parameterName": "FourEyesAuthorizationEventsName", "comparison": "isNotEqualTo" }, "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "isRest", "comparison": "isEqualTo", "value": "0" }, "name": "Four-Eyes Authorization Events" } ], "fallbackResourceIds": [ "/subscriptions/66bec3d1-9964-45f6-8c8f-e1ab9f88687e/resourcegroups/vz-deployment-rg/providers/microsoft.operationalinsights/workspaces/vz-publish-test" ], "fromTemplateId": "sentinel-VeeamSecurityActivities", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }