{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "# Semperis Directory Services Protector\r\n\r\n**Semperis Directory Services Protector** (DSP) provides valuable insight into your Active Directory security posture. It queries your Active Directory environment and performs a set of tests against many aspects of Active Directory's security posture, including AD Delegation, Account security, AD Infrastructure security, Group Policy security, and Kerberos security.\r\n\r\nEach security indicator is mapped to MITRE ATT&CK® framework categories, explains what was evaluated, and indicates how likely an exposure will compromise Active Directory. \r\n\r\nEach IoE found highlights weak Active Directory configurations and provides actionable guidance on how to close gaps before they are exploited by attackers. Using this workbook, you can determine how you are doing from a security perspective, compared to best practice environments.\r\n\r\nIn case of security regressions, Semperis Directory Services Protector will trigger alerts through Microsoft Sentinel." }, "name": "text - 2" }, { "type": 1, "content": { "json": "# Security Indicators mapped to MITRE ATT&CK® Framework Categories:" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "83787f1b-6573-47c6-8def-36bceb9a8afe", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": " Specify the time range on which to query the data", "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } }, { "id": "d46aac4d-bcb8-4dbf-a331-3a3538226bc3", "version": "KqlParameterItem/1.0", "name": "MitreFramework", "label": "MITRE ATT&CK Framework", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags)\r\n| mv-expand bagexpansion=array parse_csv(SecurityFrameworkTagsCsv) to typeof(string)\r\n| summarize Count = count() by SecurityFrameworkTagsCsv\r\n| order by Count desc, SecurityFrameworkTagsCsv asc\r\n| project Value = SecurityFrameworkTagsCsv, Label = strcat(SecurityFrameworkTagsCsv)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "cf84c455-c1b9-4785-a592-54834be54097", "version": "KqlParameterItem/1.0", "name": "Status", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "dsp_parser\r\n| where isnotempty(Result)\r\n| summarize Count = count() by tostring(Result)\r\n| order by Count desc, Result asc\r\n| project Value = Result, Label = strcat(Result)", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| mv-expand bagexpansion=array SecurityFrameworkTagList to typeof(string)\r\n| where SecurityFrameworkTagList in ({MitreFramework})\r\n| summarize event_count=count() by SecurityFrameworkTagList\r\n", "size": 0, "title": "Amount of Generated Events per Category", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "securityFrameworkTags", "formatter": 1 }, "centerContent": { "columnMatch": "event_count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": null }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "event_count", "sizeAggregation": "Sum", "legendMetric": "event_count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "event_count", "heatmapPalette": "greenRed" } } }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Requests = count() by tostring(SecurityIndicatorName)\r\n| order by Requests\r\n", "size": 3, "title": "Breakdown by Indicators of Exposure (IoEs)", "noDataMessageStyle": 4, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "SecurityIndicatorName", "formatter": 1 }, "subtitleContent": { "columnMatch": "Requests", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" }, "chartSettings": { "group": "securityIndicatorName", "createOtherGroup": 10, "showMetrics": false }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Requests", "sizeAggregation": "Sum", "legendMetric": "Requests", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Requests", "heatmapPalette": "greenRed" } } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityFrameworkTags), tostring(SecurityIndicatorName), tostring(SecurityIndicatorDescription), tostring(LikelihoodOfCompromise), tostring(Remediation), tostring(Result), tostring(FirstFound), tostring(Score)\r\n| order by Count\r\n", "size": 0, "title": "Indicators of Exposure (IoEs) Details:", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "SecurityFrameworkTags", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "SecurityFrameworkTags", "label": "MITRE ATT&CK Framework" }, { "columnId": "SecurityIndicatorName", "label": "Indicator of Exposure" }, { "columnId": "SecurityIndicatorDescription", "label": "Description" }, { "columnId": "LikelihoodOfCompromise", "label": "Likelihood of Compromise" }, { "columnId": "FirstFound", "label": "First Time Found" }, { "columnId": "Count" } ] }, "sortBy": [ { "itemKey": "SecurityFrameworkTags", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "securityIndicatorName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 1", "styleSettings": { "showBorder": true } } ] }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityIndicatorName)\r\n| top 10 by Count desc", "size": 3, "title": "Top 10 Indicators of Exposure (IoEs)", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "sortBy": [], "chartSettings": { "group": "SecurityIndicatorName", "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } } } }, "customWidth": "40", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "dsp_parser\r\n| where isnotempty(SecurityFrameworkTags) \r\n| where Result in ({Status})\r\n| extend SecurityFrameworkTagList = parse_csv(SecurityFrameworkTagsCsv)\r\n| extend MitreFramework = pack_array({MitreFramework})\r\n| extend FilterIntersection = set_intersect(SecurityFrameworkTagList, MitreFramework)\r\n| extend FilterIntersectionCount = array_length(FilterIntersection)\r\n| where FilterIntersectionCount > 0\r\n| summarize Count = count() by tostring(SecurityFrameworkTags), tostring(SecurityIndicatorName), tostring(FirstFound), tostring(Remediation)\r\n| top 10 by Count desc\r\n| project-away Count", "size": 0, "title": "Top 10 Indicators of Exposure (IoEs) Details:", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "60", "name": "query - 1", "styleSettings": { "showBorder": true } } ] }, "name": "group - 5", "styleSettings": { "showBorder": true } } ], "fromTemplateId": "sentinel-SemperisDSPWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }