{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "Please select the Log Analytics Workspace with 'NetworkAccessTrafficLogs' enabled in the Microsoft Entra ID 'Diagnostic settings'", "style": "info" }, "name": "text - 14", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## Enriched Microsoft 365 logs Workbook\n---\n\nThe enriched Microsoft 365 logs provide information about Microsoft 365 workloads, so you can review network data and security events relevant to Microsoft 365 apps." }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "value::all" ], "parameters": [ { "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10", "version": "KqlParameterItem/1.0", "name": "LogAnalyticWorkspace", "label": "Log Analytic Workspace", "type": 5, "description": "The Log Analytic Workspace In Which To Execute The Queries", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id", "crossComponentResources": [ "value::all" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [ "value::1", "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 3600000 } }, { "id": "8bab511b-53b3-4220-9d1c-372345b06728", "version": "KqlParameterItem/1.0", "name": "Users", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "EnrichedMicrosoft365AuditLogs\r\n| summarize Count = count() by UserId\r\n| order by Count desc, UserId asc\r\n| project Value = UserId, Label = strcat(UserId, ' - ', Count, ' Logs'), Selected = false", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "typeSettings": { "limitSelectTo": 20, "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 15" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "tabStyle": "bigger", "links": [ { "id": "e841bafb-6437-4d29-84ac-ba16c5a6d901", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "ac5f2082-50bc-4739-bdf2-20c93b613671", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "SharePoint/OneDrive Insights", "subTarget": "Threat", "style": "link" }, { "id": "dc2778e7-739b-44ba-9ae4-c81901277f57", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Exchange Online Insights", "subTarget": "ThreatEXO", "style": "link" }, { "id": "666111e2-54ff-4fa4-a648-11a5c8c0235b", "cellValue": "selTab", "linkTarget": "parameter", "linkLabel": "Teams Insights", "subTarget": "ThreatTeams", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"Exchange\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n Country = tostring(GeoInfo.country), \r\n State = tostring(GeoInfo.state), \r\n City = tostring(GeoInfo.city), \r\n Latitude = tostring(GeoInfo.latitude), \r\n Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n UserId, \r\n Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n Latitude, \r\n Longitude, \r\n City, \r\n State, \r\n Country\r\n| summarize Count = count() by City, State, Country\r\n", "size": 0, "title": "Access By Location", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Country", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "Count", "sizeAggregation": "Sum", "labelSettings": "Country", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "turquoise" } } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"Exchange\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n", "size": 0, "title": "Access By Location And OS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ] }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where Operation in (\"Set-AdminAuditLogConfig\", \"Set-OrganizationConfig\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Audit Of Critical Configuration Changes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where Operation in (\"Set-TransportRule\", \"Set-AtpPolicyForO365\", \"Set-MalwareFilterRule\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Changes In Email Security Policies", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where Operation in (\"Add-RoleGroupMember\", \"Remove-ManagementRoleAssignment\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Monitoring Role Group Membership Changes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where Operation in (\"New-TenantAllowBlockListSpoofitems\", \"Remove-TenantAllowBlockListSpoofitems\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Spoofing Settings Management Activities", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where Operation in (\"New-SafeAttachmentPolicy\", \"Set-SafeAttachmentPolicy\", \"Set-SafeAttachmentRule\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Safe Attachments Policy Changes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "name": "query - 6" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "ThreatEXO" }, "name": "group - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId | where OfficeWorkload == \"Exchange\" | where Operation in (\"Add-MailboxFolderPermission\", \"Add-RoleGroupMember\", \"New-TransportRule\", \"Remove-ManagementRoleAssignment\", \"Set-TransportRule\") | summarize Count = count(), Users = makeset(UserPrincipalName) by Operation | order by Count desc", "size": 0, "title": "Permission changes and security policy updates", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ] }, "conditionalVisibility": { "parameterName": "seltab", "comparison": "isEqualTo", "value": "ThreatEXO" }, "name": "query - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"Teams\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n Country = tostring(GeoInfo.country), \r\n State = tostring(GeoInfo.state), \r\n City = tostring(GeoInfo.city), \r\n Latitude = tostring(GeoInfo.latitude), \r\n Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n UserId, \r\n Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n Latitude, \r\n Longitude, \r\n City, \r\n State, \r\n Country\r\n| summarize Count = count() by City, State, Country\r\n", "size": 0, "title": "Access By Location", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Country", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "Count", "sizeAggregation": "Sum", "labelSettings": "Country", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "turquoise" } } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"Teams\")\r\n| summarize [\"Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Count\"] desc\r\n", "size": 0, "title": "Access By Location And OS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ] }, "customWidth": "50", "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "ThreatTeams" }, "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"OneDrive\", \"SharePoint\",\"SPO/OneDrive\")\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n Country = tostring(GeoInfo.country), \r\n State = tostring(GeoInfo.state), \r\n City = tostring(GeoInfo.city), \r\n Latitude = tostring(GeoInfo.latitude), \r\n Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n UserId, \r\n Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n Latitude, \r\n Longitude, \r\n City, \r\n State, \r\n Country\r\n| summarize Count = count() by City, State, Country\r\n", "size": 0, "title": "Access By Location", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Country", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "Count", "sizeAggregation": "Sum", "labelSettings": "Country", "legendMetric": "Country", "numberOfMetrics": 19, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "turquoise" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "query - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where OfficeWorkload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| summarize [\"Event Count\"] = count() by [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem\r\n| order by [\"Event Count\"] desc\r\n", "size": 2, "title": "Access By Location And OS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 20" } ] }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "group - 20", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where OfficeWorkload == \"Teams\"\r\n| where Operation in (\"MemberAdded\", \"MemberRemoved\", \"TeamDeleted\")\r\n| project TimeGenerated, [\"User ID\"] = UserId, UserPrincipalName, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"],UserPrincipalName, [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User\"] = UserPrincipalName, [\"User ID\"], [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Changes In Team Memberships", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "ThreatTeams" }, "customWidth": "50", "name": "query - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let RiskyExtensions = dynamic([\"exe\", \"msi\", \"bat\", \"cmd\", \"com\", \"scr\", \"pif\", \"ps1\", \"vbs\", \"js\", \"jse\", \"wsf\", \"docm\", \"xlsm\", \"pptm\", \"dll\", \"ocx\", \"cpl\", \"app\", \"vb\", \"reg\", \"inf\", \"hta\"]);\r\n\r\nNetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where OfficeWorkload in (\"SPO/OneDrive\")\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where SourceFileExtension in (RiskyExtensions)\r\n| project TimeGenerated, [\"User ID\"] = UserId, UserPrincipalName, [\"Client IP\"] = SourceIp, SourceFileExtension, Operation\r\n| summarize Count = count() by TimeGenerated, [\"User ID\"], UserPrincipalName, [\"Client IP\"], SourceFileExtension, Operation\r\n| project TimeGenerated, [\"User\"] = UserPrincipalName, [\"Client IP\"], SourceFileExtension, Operation, Count\r\n", "size": 0, "title": "Risky File Operations", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "OperationCount", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where OfficeWorkload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation in (\"FileRecycled\", \"FileDownloaded\", \"FileUploaded\", \"FileCreated\", \"File Modified\")\r\n| project TimeGenerated, UserPrincipalName, [\"User ID\"] = UserId, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by TimeGenerated, UserPrincipalName, [\"User ID\"], [\"Client IP\"], Operation\r\n| project TimeGenerated, [\"User\"] = UserPrincipalName, [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Bulk File Events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } }, { "columnMatch": "OperationCount", "formatter": 4, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where OfficeWorkload in (\"SPO/OneDrive\")\r\n| where Operation == \"FileDeletedFirstStageRecycleBin\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, UserPrincipalName, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by bin(Timestamp, 1h), [\"User ID\"], UserPrincipalName, [\"Client IP\"], Operation\r\n| project Timestamp, [\"User\"] = UserPrincipalName, [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n| where Count > 1\r\n", "size": 0, "title": " Bulk File Deletion Operations", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } }, { "columnMatch": "FileDeletions", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let baselinePeriod = 30d;\r\nlet detectionWindow = 1h;\r\nlet downloadThreshold = 5; // Threshold of downloads indicating potential exfiltration\r\n\r\nNetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId ,UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where TimeGenerated >= ago(baselinePeriod)\r\n| where OfficeWorkload in (\"OneDrive\", \"SharePoint\", \"SPO/OneDrive\")\r\n| where Operation == \"FileDownloaded\"\r\n| project Timestamp = TimeGenerated, [\"User ID\"] = UserId, UserPrincipalName, [\"Client IP\"] = SourceIp, Operation\r\n| summarize Count = count() by bin(Timestamp, detectionWindow), UserPrincipalName, [\"User ID\"], [\"Client IP\"], Operation\r\n| project Timestamp, [\"User\"] = UserPrincipalName, [\"Client IP\"], Operation, Count\r\n| order by Count desc\r\n", "size": 0, "title": "Bulk File Download", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "dateFormat": { "formatName": "shortDateTimeNoMsPattern" } }, { "columnMatch": "DownloadCount", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Threat" }, "name": "query - 4" } ] }, "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic\r\n| where TrafficType in ('microsoft365', 'entra')\r\n| where UniqueTokenId != \"\"\r\n| project\r\n UniqueTokenId,\r\n SourceIp,\r\n DeviceId,\r\n DeviceOperatingSystem,\r\n DeviceOperatingSystemVersion,\r\n InitiatingProcessName,\r\n AgentVersion,\r\n UserId \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\n on UniqueTokenId\r\n| where UserId in ('*') or '*' in ('*')\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIp) // Assuming a function exists to pull geo info\r\n| extend \r\n Country = tostring(GeoInfo.country), \r\n State = tostring(GeoInfo.state), \r\n City = tostring(GeoInfo.city), \r\n Latitude = tostring(GeoInfo.latitude), \r\n Longitude = tostring(GeoInfo.longitude)\r\n| project \r\n UserId, \r\n Location = strcat(City, ', ', State, ', ', Country), // Constructing a full location string\r\n Latitude, \r\n Longitude, \r\n City, \r\n State, \r\n Country\r\n| where tostring(Country) != \"\"\r\n| summarize Count = count() by City, State, Country\r\n", "size": 0, "title": "Access By Location", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Country", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "Count", "sizeAggregation": "Sum", "minSize": 20, "labelSettings": "Country", "legendMetric": "Country", "numberOfMetrics": 8, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "turquoise" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| summarize [\"Event Count\"] = count() by [\"Time Generated\"] = TimeGenerated, [\"User\"] = UserPrincipalName, [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem, [\"Workload\"] = OfficeWorkload\r\n| order by [\"Time Generated\"] desc\r\n", "size": 0, "title": "Access By Location And OS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Time Generated", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimeNoMsPattern" } } ], "rowLimit": 1000, "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 1" } ] }, "name": "group - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = NetworkAccessTraffic\r\n | where TrafficType in ('microsoft365', 'entra')\r\n | where UniqueTokenId != \"\"\r\n | project\r\n UniqueTokenId,\r\n SourceIp,\r\n DeviceId,\r\n DeviceOperatingSystem,\r\n DeviceOperatingSystemVersion,\r\n InitiatingProcessName,\r\n AgentVersion,\r\n UserId,\r\n UserPrincipalName \r\n | join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\n on UniqueTokenId\r\n | where UserId in ('*') or '*' in ('*')\r\n | project \r\n Operation, \r\n UserId,\r\n UserPrincipalName, \r\n Workload = OfficeWorkload, \r\n SourceIp, \r\n DeviceId, \r\n TimeGenerated, \r\n Details = pack_all(),\r\n OS = tostring(DeviceOperatingSystem)\r\n | extend Workload = tostring(Workload)\r\n | extend WorkloadStatus = case(\r\n Workload == \"Exchange\",\r\n \"Exchange\",\r\n Workload == \"Teams\",\r\n \"Teams\",\r\n Workload == \"SharePoint\",\r\n \"SharePoint\",\r\n \"Other\"\r\n );\r\nlet appData = data\r\n | summarize \r\n TotalCount = count(), \r\n ExchangeCount = countif(Workload == \"Exchange\"), \r\n TeamsCount = countif(Workload == \"Teams\"), \r\n SharePointCount = countif(Workload == \"SharePoint\"), \r\n OtherCount = countif(Workload == \"Other\") \r\n by UserId, UserPrincipalName\r\n | where UserId != ''\r\n | join kind=inner (\r\n data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(15m), now(), 1m) by UserId, UserPrincipalName\r\n | project-away TimeGenerated\r\n )\r\n on UserId\r\n | order by TotalCount desc, UserId asc\r\n | project\r\n UserPrincipalName,\r\n UserId,\r\n TotalCount,\r\n ExchangeCount,\r\n TeamsCount,\r\n SharePointCount,\r\n OtherCount,\r\n Trend\r\n | serialize Id = row_number();\r\ndata\r\n| summarize \r\n TotalCount = count(), \r\n ExchangeCount = countif(Workload == \"Exchange\"), \r\n TeamsCount = countif(Workload == \"Teams\"), \r\n SharePointCount = countif(Workload == \"SharePoint\"), \r\n OtherCount = countif(Workload == \"Other\") \r\n by UserId, UserPrincipalName, SourceIp = tostring(SourceIp)\r\n| join kind=inner (\r\n data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(15m), now(), 1m) by UserId, SourceIp\r\n | project-away TimeGenerated\r\n )\r\n on UserId, SourceIp\r\n| order by TotalCount desc, UserId asc\r\n| project\r\n UserId,\r\n UserPrincipalName,\r\n SourceIp,\r\n TotalCount,\r\n ExchangeCount,\r\n TeamsCount,\r\n SharePointCount,\r\n OtherCount,\r\n Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on UserId\r\n| project\r\n Id,\r\n Name = SourceIp,\r\n Type = 'Client IP',\r\n ['Events Count'] = TotalCount,\r\n Trend,\r\n ['Exchange Events'] = ExchangeCount,\r\n ['Teams Events'] = TeamsCount,\r\n ['SharePoint Events'] = SharePointCount,\r\n ['Other Count'] = OtherCount,\r\n ParentId = Id1\r\n| union (\r\n appData \r\n | project\r\n Id,\r\n Name = UserPrincipalName,\r\n Type = 'Operating System',\r\n ['Events Count'] = TotalCount,\r\n Trend,\r\n ['Exchange Events'] = ExchangeCount,\r\n ['Teams Events'] = TeamsCount,\r\n ['SharePoint Events'] = SharePointCount,\r\n ['Other Count'] = OtherCount,\r\n ParentId = -1\r\n )\r\n| order by ['Events Count'] desc, Name asc\r\n", "size": 2, "title": "Activity Log", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Id", "formatter": 5 }, { "columnMatch": "Type", "formatter": 5 }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Other Count", "formatter": 5 }, { "columnMatch": "ParentId", "formatter": 5 }, { "columnMatch": "Operation Count", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Exchange Count", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } }, { "columnMatch": "Teams Count", "formatter": 8, "formatOptions": { "min": 0, "palette": "purple" } }, { "columnMatch": "SharePoint Count", "formatter": 8, "formatOptions": { "min": 0, "palette": "turquoise" } }, { "columnMatch": "Details", "formatter": 5, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "idColumn": "Id", "parentColumn": "ParentId", "treeType": 0, "expanderColumn": "Name" } } }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "
\r\n💡 _Click on a segment of the pie chart to explore more details_" }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| extend \r\n OS = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n OSVersion = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\")\r\n| summarize DeviceCount = count() by OS, OSVersion\r\n| order by DeviceCount desc\r\n", "size": 3, "title": "Devices Accessing M365", "timeContextFromParameter": "TimeRange", "exportParameterName": "Parampie", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "piechart" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName \r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend \r\n [\"Operating System\"] = coalesce(DeviceOperatingSystem, \"Unknown OS\"),\r\n [\"OS Version\"] = coalesce(tostring(DeviceOperatingSystemVersion), \"Unknown Version\"),\r\n [\"Device ID\"] = coalesce(tostring(DeviceId), \"Unknown DeviceId\")\r\n| where [\"Operating System\"] == dynamic({Parampie}).label\r\n| summarize [\"Transaction Count\"] = count() by [\"Operating System\"], [\"OS Version\"], [\"Device ID\"]\r\n| order by [\"Transaction Count\"] desc\r\n", "size": 2, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ] }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, { "parameterName": "Parampie", "comparison": "isNotEqualTo" } ], "name": "query - 1" } ] }, "name": "group - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let BusinessHoursStart = 8; // 8 AM\r\nlet BusinessHoursEnd = 18; // 6 PM\r\n\r\nNetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| extend HourOfDay = hourofday(TimeGenerated)\r\n| where HourOfDay < BusinessHoursStart or HourOfDay > BusinessHoursEnd\r\n| summarize [\"Off-Hour Activities\"] = count() by [\"User Principal Name\"] = UserPrincipalName, [\"User ID\"] = UserId, [\"Date\"] = bin(TimeGenerated, 1d), [\"Operation\"]\r\n| project [\"Off-Hour Activities\"], [\"User Principal Name\"], [\"User ID\"], [\"Date\"]\r\n| order by [\"Off-Hour Activities\"] desc\r\n", "size": 0, "title": "Activity Outside Standard Working Hours (8:00 - 18:00)", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "Date", "parameterName": "Date", "parameterType": 1 }, { "fieldName": "User ID", "parameterName": "UserId", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Date", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimeNoMsPattern" } } ] } }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\r\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId, UserPrincipalName\r\n| join kind=inner (\r\n OfficeActivity \r\n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\r\n | where UniqueTokenId != \"\")\r\non UniqueTokenId\r\n| where UserId in ({Users}) or '*' in ({Users})\r\n| where UserId == '{UserId}'\r\n| where TimeGenerated >= datetime('{Date}')\r\n| project [\"Time Generated\"] = TimeGenerated, [\"User\"] = UserPrincipalName, [\"Source IP\"] = SourceIp, [\"Device Operating System\"] = DeviceOperatingSystem, [\"Device Operating System Version\"] = DeviceOperatingSystemVersion, [\"Device Id\"] = DeviceId,[\"Workload\"] = OfficeWorkload, [\"Unique Token Id\"] = UniqueTokenId, [\"Initiating Process Name\"] = InitiatingProcessName, [\"Agent Version\"] = AgentVersion, [\"Record Type\"] = RecordType, Operation, [\"Item Type\"] = ItemType, [\"Site URL\"] = Site_Url, [\"Source File Name\"] = SourceFileName_", "size": 0, "title": "Activity Outside Standard Working Hours Drill Down", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "Date", "parameterName": "Date", "parameterType": 1 }, { "fieldName": "User", "parameterName": "UserId", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Time Generated", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimeNoMsPattern" } }, { "columnMatch": "Date", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimeNoMsPattern" } } ] } }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetworkAccessTraffic | where TrafficType in ('microsoft365', 'entra') | where UniqueTokenId != \"\"\n| project UniqueTokenId, SourceIp, DeviceId, DeviceOperatingSystem, DeviceOperatingSystemVersion, InitiatingProcessName, AgentVersion, UserId \n| join kind=inner (\n OfficeActivity \n | extend UniqueTokenId = tostring(AppAccessContext.UniqueTokenId)\n | where UniqueTokenId != \"\")\non UniqueTokenId\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc\n", "size": 0, "title": "Microsoft 365 Transactions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LogAnalyticWorkspace}" ], "visualization": "unstackedbar" }, "conditionalVisibility": { "parameterName": "selTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "query - 2" } ], "fallbackResourceIds": [ "Global Secure Access" ], "fromTemplateId": "GSA Enriched Microsoft 365 logs", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }