{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Citrix Analytics workbook\n---" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "aeffe548-46af-4ef2-8f4a-7f49c4dd515a", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "Received Events", "subTarget": "Received Events", "style": "link" }, { "id": "27451792-ea3a-4178-be43-31b3fd78104e", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "Secure Private Access", "subTarget": "Secure Private Access", "style": "link" }, { "id": "662447f0-e745-457f-89a1-ff5f01055084", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "User Risk Scores Overview", "subTarget": "User Risk Scores Overview", "style": "link" }, { "id": "505e4c6a-34a3-4174-9b34-1112ce3a5da7", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "User Details", "subTarget": "User Details", "style": "link" }, { "id": "235fc368-f144-4902-a49a-7cae1c2bd765", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "User Profile", "subTarget": "User Profile", "style": "link" }, { "id": "51102296-4355-472a-9c85-d24ef52f460b", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "Risk Indicator Details", "subTarget": "Risk Indicator Details", "style": "link" }, { "id": "5567e348-a5b1-43b5-841f-173effea84e3", "cellValue": "selectTab", "linkTarget": "parameter", "linkLabel": "Risk Indicator Overview", "subTarget": "Risk Indicator Overview", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "53e9d4bb-61d8-4a42-b766-79bd877c37a0", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let spaCount = CitrixAnalytics_SPA_Events_V1_CL | count; \nlet userProfileCount = CitrixAnalytics_userProfile_V1_CL | count; \nlet indicatorEventDetailCount = CitrixAnalytics_indicatorEventDetails_V1_CL | count; \nlet indicatorSummaryCount = CitrixAnalytics_indicatorSummary_V1_CL | count ;\nlet riskScoreChangeCount = CitrixAnalytics_riskScoreChange_V1_CL | count ;\nlet cvadCount = CitrixAnalytics_CVAD_Events_V1_CL | count ;\nprint toscalar(spaCount)\n +toscalar(userProfileCount)\n +toscalar(indicatorEventDetailCount)\n +toscalar(indicatorSummaryCount)\n +toscalar(riskScoreChangeCount)\n +toscalar(cvadCount);", "size": 4, "title": "# Received Events", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let spaCount = CitrixAnalytics_SPA_Events_V1_CL\n| count; \nprint toscalar(spaCount);", "size": 4, "title": "# SPA Events Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let riskIndicatorSummaryCount = CitrixAnalytics_indicatorSummary_V1_CL\n| count; \nprint toscalar(riskIndicatorSummaryCount);", "size": 4, "title": "# Risk Indicator Summary Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let indicatorEventDetailsCount = CitrixAnalytics_indicatorEventDetails_V1_CL | count; \nprint toscalar(indicatorEventDetailsCount);", "size": 4, "title": "# Risk Indicator Event Details Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let riskScoreChangeCount = CitrixAnalytics_riskScoreChange_V1_CL | count ;\nprint toscalar(riskScoreChangeCount);", "size": 4, "title": "# Risk Score Changes Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userProfileCount = CitrixAnalytics_userProfile_V1_CL \n| where event_type == \"userProfileRiskscore\"| count; \nprint toscalar(userProfileCount);", "size": 4, "title": "# User Profile Risk Score Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false } }, "customWidth": "20", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userProfileCount = CitrixAnalytics_userProfile_V1_CL \n| where event_type == \"userProfileLocation\"| count; \nprint toscalar(userProfileCount);", "size": 4, "title": "# User Profile Location Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userProfileCount = CitrixAnalytics_userProfile_V1_CL \n| where event_type == \"userProfileApp\"| count; \nprint toscalar(userProfileCount);", "size": 4, "title": "# User Profile App Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userProfileCount = CitrixAnalytics_userProfile_V1_CL \n| where event_type == \"userProfileUsage\"| count; \nprint toscalar(userProfileCount);", "size": 4, "title": "# User Profile Usage Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userProfileCount = CitrixAnalytics_userProfile_V1_CL \n| where event_type == \"userProfileDevice\"| count; \nprint toscalar(userProfileCount);", "size": 4, "title": "# User Profile Device Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "print_0", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL | project bin(TimeGenerated, 1d), event_type\n| union CitrixAnalytics_indicatorSummary_V1_CL | project bin(TimeGenerated, 1d), event_type\n| union CitrixAnalytics_indicatorEventDetails_V1_CL | project bin(TimeGenerated, 1d), event_type\n| union CitrixAnalytics_riskScoreChange_V1_CL | project bin(TimeGenerated, 1d), event_type\n| union CitrixAnalytics_userProfile_V1_CL | project bin(TimeGenerated, 1d), event_type\n| summarize count() by bin(TimeGenerated, 1d), event_type", "size": 1, "title": "Citrix Analytics Events Received (over time)", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "name": "query - 10" } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "Received Events" }, "name": "Received Events Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "20eb1db0-15d3-49f8-97c2-cc7d2ece19a8", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 } }, { "id": "13b1b7f0-0f2b-41f5-a3d3-081aedc97122", "version": "KqlParameterItem/1.0", "name": "entityType", "label": "Select Entity Type", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by entity_type", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "user" }, { "id": "d690abe2-3fe1-44c6-9dfc-0d3d2d35efd0", "version": "KqlParameterItem/1.0", "name": "riskIndicatorType", "label": "Select Risk Indicator Type", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by indicator_type", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "custom" }, { "id": "75e42b30-91c5-47f5-81eb-bc17517a48fc", "version": "KqlParameterItem/1.0", "name": "dataSource", "label": "Select Data Source", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by data_source", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "Citrix Virtual Apps and Desktops" }, { "id": "80b819b1-b5f0-443c-961c-f55caf925083", "version": "KqlParameterItem/1.0", "name": "riskIndicatorCategory", "label": "Select Risk Indicator Category", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by indicator_category", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "Compromised users" }, { "id": "1fa3e1ca-41da-42c7-b2cb-73043d3e1553", "version": "KqlParameterItem/1.0", "name": "riskIndicator", "label": "Select Risk Indicator", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by indicator_name", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| where data_source == \"{dataSource}\"\n| where indicator_category == \"{riskIndicatorCategory}\"\n| where entity_type == \"{entityType}\"\n| where indicator_type == \"{riskIndicatorType}\"\n| where indicator_name == \"{riskIndicator}\"\n| project TimeGenerated, data_source, indicator_category, indicator_name, entity_id, entity_type, severity, risk_probability, indicator_uuid", "size": 0, "title": "Risk Indicator (History)", "timeContextFromParameter": "timeRange", "exportFieldName": "indicator_uuid", "exportParameterName": "indicator_uuid", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorEventDetails_V1_CL\n| where indicator_uuid == '{indicator_uuid}'", "size": 0, "title": "Risk Indicator Event Details", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 2" } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "Risk Indicator Details" }, "name": "Risk Indicator Details Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "014e8f3c-0356-4fd9-8b03-21a172ec01f4", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 65\n| where cur_riskscore <= 100\n| where entity_type == 'user'\n| summarize count()", "size": 4, "title": "High Risk Users", "color": "redBright", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 1, "formatOptions": { "showIcon": true }, "tooltipFormat": { "tooltip": "Risk Score of 64 to 100" } } ], "labelSettings": [ { "columnId": "Count", "label": "High Risk Users" } ] }, "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "redBright" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false } }, "customWidth": "33", "name": "query - 6 - Copy - Copy", "styleSettings": { "padding": "10px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 35\n| where cur_riskscore <= 64\n| where entity_type == 'user'\n| summarize count()", "size": 4, "title": "Medium Risk Users", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 1, "formatOptions": { "showIcon": true }, "tooltipFormat": { "tooltip": "Risk Score of 33 to 64" } } ], "labelSettings": [ { "columnId": "Count", "label": "Medium Risk Users" } ] }, "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellow" } }, "showBorder": false } }, "customWidth": "33", "name": "query - 6 - Copy", "styleSettings": { "padding": "10px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 1\n| where cur_riskscore <= 34\n| where entity_type == 'user'\n| summarize count()", "size": 4, "title": "Low Risk Users", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 1, "formatOptions": { "showIcon": true }, "tooltipFormat": { "tooltip": "Risk Score of 0 to 33" } } ], "labelSettings": [ { "columnId": "Count", "label": "Low Risk Users" } ] }, "tileSettings": { "titleContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "gray" } }, "showBorder": false } }, "customWidth": "33", "name": "query - 6", "styleSettings": { "padding": "10px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "( CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 65\n| where cur_riskscore <= 100\n| where entity_type == 'user'\n| summarize count() by bin(TimeGenerated,1d), severity=\"High\")\n| union (CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 35\n| where cur_riskscore <= 64\n| where entity_type == 'user'\n| summarize count() by bin(TimeGenerated,1d), severity=\"Medium\")\n| union (CitrixAnalytics_userProfile_V1_CL\n| where cur_riskscore >= 1\n| where cur_riskscore <= 34\n| where entity_type == 'user'\n| summarize count() by bin(TimeGenerated,1d), severity=\"Low\")\n| order by severity, TimeGenerated asc \n| render barchart ", "size": 1, "aggregation": 3, "title": "Users Risk Profile (over time)", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "xAxis": "TimeGenerated", "group": "severity", "createOtherGroup": null, "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "High", "label": "High", "color": "redBright" }, { "seriesName": "Medium", "label": "Medium", "color": "orange" }, { "seriesName": "Low", "label": "Low", "color": "gray" } ], "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "885a817d-ab3e-498f-99cf-280f4e0c79aa", "version": "KqlParameterItem/1.0", "name": "userName", "label": "User Name", "type": 1, "value": "kevin", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| join CitrixAnalytics_indicatorSummary_V1_CL on tenant_id, entity_id\n| summarize count() by entity_id, indicator_category, cur_riskscore\n| evaluate pivot(indicator_category)\n| where entity_id contains \"{userName}\"", "size": 0, "title": "Risky Users", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "cur_riskscore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "64", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">", "thresholdValue": "34", "representation": "yellow" }, { "operator": ">", "thresholdValue": "1", "representation": "gray" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "labelSettings": [ { "columnId": "entity_id", "label": "User" }, { "columnId": "cur_riskscore", "label": "Risk Score" } ] } }, "name": "query - 1" } ] }, "name": "group - 7" } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "User Risk Scores Overview" }, "name": "UserRiskScoresOverviewGroup" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3c5195b6-5487-4abc-9d70-75eda370b6da", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 } }, { "id": "fa764770-1f4d-44b0-9d05-25d83fba61dd", "version": "KqlParameterItem/1.0", "name": "riskIndicatorType", "label": "Select Risk Indicator Type", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by indicator_type", "value": "custom", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "d822a164-cbef-4b76-a0b6-2240cbe93bda", "version": "KqlParameterItem/1.0", "name": "entityType", "label": "Select Entity Type", "type": 2, "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| summarize by entity_type", "value": "user", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| where indicator_type == \"{riskIndicatorType}\"\n| where entity_type == \"{entityType}\"\n| summarize count() by TimeGenerated, indicator_name", "size": 0, "title": "Risk Indicators Received", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| where indicator_type == \"{riskIndicatorType}\"\n| where entity_type == \"{entityType}\"\n| summarize Count = count() by indicator_name\n| top 10 by Count desc", "size": 0, "title": "Top 10 Risk Indicators", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorEventDetails_V1_CL\n| join CitrixAnalytics_indicatorSummary_V1_CL on indicator_uuid\n| where indicator_type == \"{riskIndicatorType}\"\n| where entity_type == \"{entityType}\"\n| where country != \"NA\"\n| summarize count() by city, country", "size": 2, "title": "Citrix Analytics Risk Indicator by Geo Location", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "country", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": null } }, "name": "query - 5", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "Risk Indicator Overview" }, "name": "Risk Indicator Overview Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8743acf2-c3a4-4199-84a5-e2b9cbeda328", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceSPAEventDetails\" and entity_type == \"user\" and isnotempty(user_oid)\r\n| summarize dcount(tolower(user_oid))", "size": 1, "title": "Users", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "25", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceSPAEventDetails\" and isnotempty(device_id)\r\n| summarize dcount(tolower(device_id))", "size": 1, "title": "Devices", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "auto" } }, "customWidth": "25", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceSPAEventDetails\"\r\n| where occurrence_event_type contains \"Launch\"\r\n| where (isnotempty(app_name) and app_name != \"NA\") \r\n or (isnotempty(saas_app_name) and saas_app_name != \"NA\")\r\n| where app_name !startswith \"NetAccess\"\r\n| extend AppName = coalesce(app_name, saas_app_name)\r\n| summarize Count = count() by AppName", "size": 1, "title": "Applications", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL | summarize event_cnt=count() by occurrence_event_type, TimeGenerated", "size": 1, "title": "Event Summary", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| summarize count() by event_source", "size": 1, "title": "Event Source", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "25", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| summarize count() by event_category", "size": 1, "title": "Event Category", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "25", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceDPSEventDetails\"\r\n| summarize count() by policy_result", "size": 1, "title": "Device Posture", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "25", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceSPAEventDetails\" and event_category == \"App Enumeration\"\r\n| summarize count() by event_status", "size": 1, "title": "App Enumeration", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "25", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_SPA_Events_V1_CL\r\n| where event_type == \"datasourceSPAEventDetails\" and occurrence_event_type contains \"Launch\"\r\n| extend normalized_status = case(\r\n isempty(event_status) or event_status in (\"NA\", \"allow\"), \"Success\",\r\n event_status == \"deny\", \"Deny\",\r\n event_status in (\"Failure\", \"failure\"), \"Failure\",\r\n event_status // default: keep original value if none of the above match\r\n)\r\n| summarize count() by normalized_status", "size": 1, "title": "App Launch", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "25", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "User Search", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "269f72e5-84a4-4fef-8daf-3ca34e1693f4", "version": "KqlParameterItem/1.0", "name": "usersearchtimerange", "label": "Time Range", "type": 4, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } }, { "id": "52449f06-83f5-44cf-80e3-13a932e76c36", "version": "KqlParameterItem/1.0", "name": "user", "label": "User Name", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "" }, { "id": "fc17df73-f1f3-4c1e-83c3-e1887187283e", "version": "KqlParameterItem/1.0", "name": "status", "label": "Event Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{\"value\":\"Success\"},{\"value\":\"Failure\",\"selected\":true}]", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let userParam = \"{user}\";\r\nCitrixAnalytics_SPA_Events_V1_CL\r\n| where isnotempty(userParam)\r\n| where event_type == \"datasourceSPAEventDetails\"\r\n| where entity_id contains userParam\r\n| where \r\n (\"{status}\" == \"\" and event_status in (\"Success\", \"allow\", \"Failure\", \"failure\")) or\r\n (\"{status}\" == \"Success\" and event_status in (\"Success\", \"allow\")) or\r\n (\"{status}\" == \"Failure\" and event_status in (\"Failure\", \"failure\")) or\r\n (event_status == \"{status}\")\r\n| project user=entity_id, timestamp, operation_type, event_source, event_status, event_description, info_code, transaction_id", "size": 0, "timeContextFromParameter": "usersearchtimerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" } ] }, "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Transaction Search", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9d8f4d9f-22d5-4f74-96ef-53f211d35d13", "version": "KqlParameterItem/1.0", "name": "transactionsearchtimerange", "label": "Select Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "716b787b-28ac-4974-9df8-b99cbb591dcd", "version": "KqlParameterItem/1.0", "name": "transactionid", "label": "Transaction ID", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let transactionIdParam = \"{transactionid}\";\r\nCitrixAnalytics_SPA_Events_V1_CL\r\n| where isnotempty(transactionIdParam)\r\n| where transaction_id == transactionIdParam\r\n| project user=entity_id,\r\n transaction_id,\r\n timestamp,\r\n event_type=occurrence_event_type,\r\n category=event_category,\r\n source=event_source,\r\n app_name=coalesce(app_name, saas_app_name),\r\n policy_result,\r\n status=event_status,\r\n reason=event_description,\r\n mode_of_access,\r\n client_ip", "size": 0, "timeContextFromParameter": "transactionsearchtimerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" } ] }, "name": "group - 10" } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "Secure Private Access" }, "name": "SecurePrivateAccessGroup" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "2f53dae0-6c61-4d32-9b16-971eb0da8987", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "08875964-ddb1-4731-a048-0c4272c95fe8", "version": "KqlParameterItem/1.0", "name": "userName", "label": "Search for User", "type": 1, "isRequired": true, "timeContext": { "durationMs": 86400000 }, "value": "0" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_riskScoreChange_V1_CL\n| where entity_id contains \"{userName}\"\n| order by TimeGenerated desc \n| project cur_riskscore\n| limit 1", "size": 4, "title": "Current Risk Score", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "cur_riskscore", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "100", "name": "query - 3", "styleSettings": { "margin": "100", "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_riskScoreChange_V1_CL\n| where entity_id contains \"{userName}\"\n| summarize by cur_riskscore, TimeGenerated", "size": 1, "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| where entity_id contains \"{userName}\"\n| summarize count() by indicator_name", "size": 3, "title": "Risk Indicator (ratio)", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "maxWidth": "100", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorEventDetails_V1_CL\n| where entity_id contains \"{userName}\"\n| where country != \"NA\"\n| project country\n", "size": 0, "title": "Risk Indicator (Geo Distribution)", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "country", "sizeAggregation": "Sum", "legendMetric": "country", "legendAggregation": "Count", "itemColorSettings": null } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| join CitrixAnalytics_indicatorSummary_V1_CL on tenant_id, entity_id\n| where entity_id contains \"{userName}\"\n| where event_type == \"userProfileDevice\"\n| project data_source, indicator_category, indicator_name, device", "size": 0, "title": "Related Devices", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "labelSettings": [ { "columnId": "data_source", "label": "Data Source" }, { "columnId": "indicator_category", "label": "Indicator Category" }, { "columnId": "indicator_name", "label": "Indicator Name" }, { "columnId": "device", "label": "Device" } ] } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_indicatorSummary_V1_CL\n| join CitrixAnalytics_indicatorEventDetails_V1_CL on tenant_id, entity_id\n| where entity_id contains \"{userName}\"\n| project data_source, indicator_category, indicator_name, client_ip", "size": 0, "title": "Related IP's", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "labelSettings": [ { "columnId": "data_source", "label": "Data Source" }, { "columnId": "indicator_category", "label": "Indicator Category" }, { "columnId": "indicator_name", "label": "Indicator Name" }, { "columnId": "client_ip", "label": "Client IP" } ] } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "User Details" }, "name": "User Details Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "78720f79-3173-44cc-856c-e61c42cc0fbf", "version": "KqlParameterItem/1.0", "name": "timeRange", "label": "Select Time Range", "type": 4, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where event_type == \"userProfileApp\"\n| summarize sum(cnt) by app\n| take 10\n| order by sum_cnt desc ", "size": 3, "title": "Top 10 User Applications", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where event_type == \"userProfileDevice\"\n| summarize sum(cnt) by device\n| take 10\n| order by sum_cnt desc ", "size": 3, "title": "Top 10 User Devices", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CitrixAnalytics_userProfile_V1_CL\n| where event_type == \"userProfileLocation\"\n| summarize sum(cnt) by city, country\n| take 10\n| order by sum_cnt desc ", "size": 3, "title": "Top 10 User Locations", "timeContextFromParameter": "timeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "query - 11", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "selectTab", "comparison": "isEqualTo", "value": "User Profile" }, "name": "User Profile Group" } ], "fallbackResourceIds": [ ], "styleSettings": { "paddingStyle": "narrow", "spacingStyle": "narrow" }, "fromTemplateId": "sentinel-CitrixAnalyticsWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }