{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5b6911a3-52f1-4f84-b045-93bb9539b8a2", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "isGlobal": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "c28d22bb-3b21-4677-a6b8-361c2ec5ff2e", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link", "linkIsContextBlade": true }, { "id": "5841dfac-8f1a-4820-9b27-3e1020ba3372", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "User Specific Query", "subTarget": "UserSpecific", "style": "link" }, { "id": "aa995553-a918-41df-b3fe-9ff7fddde269", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Statistics", "subTarget": "Stats", "style": "link" } ] }, "name": "links - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Overview", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| summarize Events=count() by type_s\r\n| sort by Events", "size": 1, "exportFieldName": "type_s", "exportParameterName": "UserRiskType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "type_s", "formatter": 1 }, "leftContent": { "columnMatch": "Events", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where type_s == '{UserRiskType}'\r\n| project-away TenantId, Computer, RawData, SourceSystem, MG, Message, _ResourceId, ManagementGroupName, TimeGenerated, insertedUtc_t\r\n| project-reorder timeUtc_t, parameters_from_s\r\n| sort by timeUtc_t desc", "size": 0, "exportFieldName": "CorrelationId", "exportParameterName": "EventCorrelationId", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where CorrelationId == '{EventCorrelationId}'\r\n| project-away TenantId, Computer, RawData, SourceSystem, MG, Message, _ResourceId, ManagementGroupName, TimeGenerated, insertedUtc_t\r\n| project-reorder timeUtc_t, parameters_from_s\r\n| sort by timeUtc_t desc", "size": 0, "title": "Message CorrelationId Trace", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "tabOverview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "User Specific Query", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3530b981-9f7e-4da0-8657-d238a1f7b224", "version": "KqlParameterItem/1.0", "name": "SelectUser", "label": "Select User", "type": 2, "description": "Limited to top 250 hits", "isRequired": true, "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| summarize Count = count() by parameters_sender_s\r\n| summarize Count = sum(Count) by parameters_sender_s = tolower(parameters_sender_s)\r\n| order by Count desc, parameters_sender_s asc\r\n| project Value = parameters_sender_s, Label = strcat(parameters_sender_s, ' - ', Count, ' Events'), Selected = false\r\n", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "01023c30-fea9-41c5-9b88-a10de19682a6", "version": "KqlParameterItem/1.0", "name": "UserRiskType", "label": "User Risk Type", "type": 2, "isRequired": true, "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where tolower(parameters_sender_s) == '{SelectUser}'\r\n| summarize Count = count() by type_s\r\n| order by Count desc, type_s asc\r\n| project Value = type_s, Label = strcat(type_s, ' - ', Count, ' Events'), Selected = false", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where tolower(parameters_sender_s) == '{SelectUser}'\r\n| summarize Events=count() by type_s\r\n| sort by Events\r\n| limit 10", "size": 4, "exportFieldName": "type_s", "exportParameterName": "UserRiskType", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "type_s", "formatter": 1 }, "leftContent": { "columnMatch": "Events", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "type_s", "formatter": 1 }, "bottomContent": { "columnMatch": "EgressEvents_CL", "formatter": 1 }, "nodeIdField": "type_s", "sourceIdField": "type_s", "targetIdField": "EgressEvents_CL", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "EgressEvents_CL", "type": 4, "heatmapPalette": "red", "heatmapMin": null, "heatmapMax": null, "emptyValueColor": "gray" }, "hivesMargin": 5, "edgeColorSettings": null } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where tolower(parameters_sender_s) == '{SelectUser}'\r\n| where type_s == '{UserRiskType}'\r\n| project-away TenantId, Computer, RawData, SourceSystem, MG, Message, _ResourceId, ManagementGroupName, TimeGenerated, insertedUtc_t\r\n| project-reorder timeUtc_t, parameters_from_s\r\n| sort by timeUtc_t desc", "size": 0, "title": "Detected Events", "exportedParameters": [ { "fieldName": "CorrelationId", "parameterName": "EventCorrelationId", "parameterType": 1 }, { "fieldName": "uuid_g", "parameterName": "EventUuid_g", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "75", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where tolower(parameters_sender_s) == '{SelectUser}'\r\n| where uuid_g == '{EventUuid_g}'\r\n| extend change_s = iff(parameters_removed_s <> \"\" or parameters_removed_s <> \"[]\", parameters_recipients_replace_s, parameters_removed_s)\r\n| extend remain_s = iff(parameters_remained_s <> \"\" or parameters_remained_s <> \"[]\", parameters_recipients_remained_s, parameters_remained_s)\r\n| extend prompt_b = iff(parameters_promptIgnored_b <> \"\" or parameters_promptIgnored_b == \"null\", parameters_promptIgnored_b, parameters_anyIgnored_b)\r\n| project FromAddress=parameters_sender_s, PromptRecieved=parameters_prompted_b, PromptIgnored=prompt_b, EventType=type_s, RecipientRemained=remain_s, RecipientRemoved=change_s, Domains=parameters_domains_s\r\n| project packed = pack_all()\r\n| mv-expand packed\r\n| parse tostring(packed) with * '\"' Field '\":' Value '}'\r\n| extend Value = iff((Value contains '\"'), trim('\"', Value), Value)\r\n| extend Value = iff((Value == \"\"), \"N/A\", Value)\r\n| project Field, Value", "size": 0, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Field" }, "secondaryContent": { "columnMatch": "Value" }, "showBorder": true } }, "customWidth": "25", "name": "query - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Message CorrelationId Trace", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where isnotempty(parameters_sender_s)\r\n| where tolower(parameters_sender_s) == '{SelectUser}'\r\n| where CorrelationId == '{EventCorrelationId}'\r\n| project-away TenantId, Computer, RawData, SourceSystem, MG, Message, _ResourceId, ManagementGroupName, TimeGenerated, insertedUtc_t\r\n| project-reorder timeUtc_t, parameters_from_s\r\n| sort by timeUtc_t desc", "size": 1, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "parameters_recipients_remained_s", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "parameters_recipients_remained_s", "sortOrder": 1 } ] }, "name": "query - 0" } ] }, "name": "group - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "UserSpecific" }, "name": "tabUserSpecific" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Statistics", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(EgressEvents_CL | summarize min({TimeRange:start}));\r\nlet max_t = toscalar(EgressEvents_CL | summarize max({TimeRange:end}));\r\nEgressEvents_CL\r\n| where type_s contains \"prevent\" and type_s !in (\"prevent.firstSend.1\", \"prevent.multiDomain.1\")\r\n| make-series num=count_distinct(uuid_g) default=0 on timeUtc_t from min_t to max_t step 1d by type_s\r\n| render timechart with(title=\"Types of Prompts\")", "size": 0, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EgressEvents_CL\r\n| where timeUtc_t between ({TimeRange:start} .. {TimeRange:end})\r\n| where type_s contains \"prevent\"\r\n| where parameters_prompted_b == true\r\n| where parameters_promptIgnored_b == false\r\n| summarize Total=count() by Type=type_s\r\n| render piechart with(title=\"Breach Types Prevented\")", "size": 3, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "25", "name": "query - 1" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Stats" }, "name": "tabStats" } ], "fallbackResourceIds": [""], "fromTemplateId": "sentinel-EgressIrisPrevent", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }