{
"version": "Notebook/1.0",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# This workbook helps you map your use cases across Content Hub solutions in Microsoft Sentinel\r\n\r\nIn pills:\r\n- **STEP 0**
\r\nDeploy the solution/ARM template\r\n- **STEP 1**
\r\nSelect the use cases of interest\r\n- **STEP 2**
\r\nSelect the currently active data sources
\r\n- **STEP 3**
\r\nExplore the content\r\n\r\nThis workbook is aligned with solutions available in the official Sentinel Github Repository. You can visit it here https://github.com/Azure/Azure-Sentinel"
},
"name": "text - 0"
}
]
},
"name": "group - 2"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# 0. Related resources\r\n\r\nThis workbook uses data stored in the following watchlists:\r\n- **\\_ucases\\_**\r\n- **\\_arules\\_**\r\n- **\\_wbooks\\_**\r\n- **\\_hqueries\\_**\r\n- **\\_tactec\\_**\r\n\r\n**If you imported this workbook a little while ago, wait a few minutes for the watchlists to be available.**"
},
"name": "text - 5 - Copy"
}
]
},
"name": "group - 20"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "bullets",
"links": []
},
"name": "links - 18"
},
{
"type": 1,
"content": {
"json": "# 1. Select Use Cases\r\n\r\n"
},
"name": "text - 5"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f93d9a04-dcbb-4625-9354-6e9651e0b78b",
"version": "KqlParameterItem/1.0",
"name": "usecases",
"type": 2,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "_GetWatchlist('_ucases_')\r\n| distinct usecasename",
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": null,
"label": "Use Cases"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 6"
},
{
"type": 1,
"content": {
"json": "The use cases you have selected are intended to protect you against the following tactics and techniques",
"style": "info"
},
"name": "text - 15"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| extend technique = strcat(name, ' (',id,')')\r\n| summarize techniques = make_set(technique) by tactics\r\n| extend techniques=strcat_array(techniques, \" - \")\r\n",
"size": 0,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "query - 16"
},
{
"type": 1,
"content": {
"json": "# 2. Select Data Sources"
},
"name": "text - 0 - Copy"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "d5680494-689e-497f-a413-db3921b36eb6",
"version": "KqlParameterItem/1.0",
"name": "datasource",
"type": 2,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "_GetWatchlist('_anrules_')\r\n| distinct solution",
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": null,
"label": "Data Sources"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 3"
},
{
"type": 1,
"content": {
"json": "# 3. Explore"
},
"name": "text - 0 - Copy - Copy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Use Cases & Solutions\r\nBelow is the list of solutions available in Sentinel"
},
"name": "text - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "",
"size": 4,
"showExportToExcel": true,
"queryType": 2,
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Parameter name",
"formatter": 5
},
{
"columnMatch": "Display name",
"formatter": 1
},
{
"columnMatch": "Parameter type",
"formatter": 5
},
{
"columnMatch": "Value",
"formatter": 1
},
{
"columnMatch": "Formatted",
"formatter": 5
},
{
"columnMatch": "Label",
"formatter": 5
},
{
"columnMatch": "Pending",
"formatter": 5
},
{
"columnMatch": "Failed",
"formatter": 5
}
]
}
},
"name": "query - 20"
}
]
},
"name": "group - 21"
},
{
"type": 1,
"content": {
"json": "## Analytics Rules\r\nThose are the Analytics Rules that you can implement to cover your use cases.
\r\nIf you are interested to see all the Analytics Rules for the selected data sources, please select _use case=all_"
},
"name": "text - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_anrules_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| summarize techniques = make_set(techniques) by tostring(id), name, solution\r\n| extend techniques = strcat_array(techniques, \" \")\r\n\r\n\r\n",
"size": 0,
"noDataMessage": "There are not Analytics Rules for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"sortBy": []
},
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_anrules_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| summarize techniques = make_set(techniques) by tostring(id), name, solution, tactics\r\n| extend techniques = strcat_array(techniques, \" \")\r\n| project tactics\r\n| summarize count() by tostring(tactics)\r\n| render piechart\r\n\r\n",
"size": 0,
"title": "Analytics Rules Tactics",
"noDataMessage": "There are not Analytics Rules for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "50",
"name": "query - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_anrules_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| project techniques\r\n| summarize count() by tostring(techniques)\r\n| render piechart",
"size": 0,
"title": "Analytics Rules Techniques",
"noDataMessage": "There are not Analytics Rules for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "50",
"name": "query - 4"
},
{
"type": 1,
"content": {
"json": "## Hunting Queries\r\nThose are the Hunting Queries that you can implement to cover your use cases.
\r\nIf you are interested to see all the Hunting Queries for the selected data sources, please select use _case=all_\r\n\r\n\r\n"
},
"name": "text - 0 - Copy - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_hqueries_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| summarize techniques = make_set(techniques) by tostring(id), name, solution\r\n| extend techniques = strcat_array(techniques, \" \")\r\n\r\n\r\n",
"size": 0,
"noDataMessage": "There are not Hunting Queries for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"sortBy": [
{
"itemKey": "solution",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "solution",
"sortOrder": 1
}
]
},
"name": "query - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_hqueries_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| summarize techniques = make_set(techniques) by tostring(id), name, solution, tactics\r\n| extend techniques = strcat_array(techniques, \" \")\r\n| project tactics\r\n| summarize count() by tostring(tactics)\r\n| render piechart\r\n\r\n",
"size": 0,
"title": "Hunting Queries Tactics",
"noDataMessage": "There are not Hunting Queries for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "50",
"name": "query - 3 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_hqueries_')\r\n| where solution in ({datasource})\r\n| project techniques = split(techniques,\" \"), solution, id, name, tactics\r\n| mv-expand techniques\r\n| where techniques in ( \r\n_GetWatchlist('_ucases_')\r\n| where usecasename in ({usecases})\r\n| summarize result = strcat_array(make_list(tactic), \" \")\r\n| project tactics = split(result,\" \")\r\n| mv-expand tactics\r\n| where isnotempty(tactics)\r\n| distinct tostring(tactics)\r\n| join _GetWatchlist('_tactec_') on tactics\r\n| project tactics, id, name\r\n| project id\r\n)\r\n| project techniques\r\n| summarize count() by tostring(techniques)\r\n| render piechart",
"size": 0,
"title": "Hunting Queries Techniques",
"noDataMessage": "There are not Hunting Queries for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "50",
"name": "query - 4 - Copy"
},
{
"type": 1,
"content": {
"json": "## Workbooks\r\nThose are the Workbooks that you can implement to cover your use cases for your data sources.
"
},
"name": "text - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('_wbooks_')\r\n| where solution in ({datasource})\r\n| project name, solution",
"size": 0,
"noDataMessage": "There are not Workbooks for the selected data sources that cover the selected use cases",
"timeContext": {
"durationMs": 86400000
},
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"sortBy": []
},
"name": "query - 2 - Copy"
}
]
},
"customWidth": "100",
"name": "Select Data Source"
}
],
"fromTemplateId": "sentinel-usecasemapper",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}