{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## iboss Malware and C2 Detections\n\n**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-iboss-parser) to create the Kusto function alias **ibossUrlEvent**."
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "7cf056ef-64cd-41a5-85e0-90c0ec529434",
            "version": "KqlParameterItem/1.0",
            "name": "time_range_picker",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "label": "Time Range Picker"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ibossUrlEvent\r\n| where EventTime {time_range_picker}\r\n| where EventResult == 'Blocked' and MalwareDetected == 1\r\n| where isnotempty(ThreatName)\r\n| summarize count() by ThreatName",
        "size": 2,
        "showAnalytics": true,
        "title": "Top Malware Detection Families",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - malware variants",
      "styleSettings": {
        "margin": "0px"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ibossUrlEvent\r\n| where EventTime {time_range_picker}\r\n| where MalwareDetected == 1 or CNCDetected == 1\r\n| extend EventType = case(MalwareDetected == 1, \"Malware\", CNCDetected == 1, \"C2\", \"NA\")\r\n| make-series Detections = count() default = 0 on EventTime from {time_range_picker:start} to {time_range_picker:end} step {time_range_picker:grain} by EventType",
        "size": 0,
        "showAnalytics": true,
        "title": "Malware & C2 Traffic",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "query - malware and c2 detections"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ibossUrlEvent\r\n| where EventTime {time_range_picker}\r\n| where MalwareDetected == 1\r\n| project EventTime\r\n        , SrcUsername\r\n        , SrcIpAddr\r\n        , SrcPortNumber\r\n        , DstIpAddr\r\n        , DstPortNumber\r\n        , FileName\r\n        , FileSHA256\r\n        , ThreatName\r\n| order by EventTime desc\r\n\r\n\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Malware Detections",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - malware detections"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ibossUrlEvent\r\n| where EventTime {time_range_picker}\r\n| where CNCDetected == 1\r\n| project EventTime\r\n        , SrcUsername\r\n        , SrcIpAddr\r\n        , SrcPortNumber\r\n        , DstIpAddr\r\n        , DstPortNumber\r\n        , Url\r\n| order by EventTime desc",
        "size": 0,
        "showAnalytics": true,
        "title": "C2 Detections",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - c2 detections"
    }
  ],
  "fromTemplateId": "sentinel-ibossMalwareAndC2Workbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}