{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "82fedb33-961a-4199-a5ab-16340948ed10", "version": "KqlParameterItem/1.0", "name": "time_range", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 1209600000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Category\n", "size": 0, "showAnalytics": true, "title": "Audit & Authentication Events by Category", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "titleContent": { "columnMatch": "auditType_s", "formatter": 1 }, "subtitleContent": { "columnMatch": "count_" }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "sortCriteriaField": "auditType_s", "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "auditType_s", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "group": "Category", "createOtherGroup": 10, "seriesLabelSettings": [ { "seriesName": "reporting_logs", "label": "Reporting " }, { "seriesName": "authentication_logs", "label": "Authentication" }, { "seriesName": "case_review_logs", "label": "Case Review" }, { "seriesName": "account_logs", "label": "Account" }, { "seriesName": "profile_group_logs", "label": "Profile Group" }, { "seriesName": "user_account_and_role_logs", "label": "User Account and Roles" }, { "seriesName": "mimecast_access_logs", "label": "Mimecast Acess" }, { "seriesName": "archive_service_logs", "label": "Archive Service" }, { "seriesName": "policy_logs", "label": "Policy " }, { "seriesName": "awareness_training_logs", "label": "Awareness Training" }, { "seriesName": "secure_messaging_logs", "label": "Secure Messaging" }, { "seriesName": "integrations_and_apis", "label": "Integrations and API's" } ] } }, "name": "query - 18", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| summarize count() by ['Audit Type'] ", "size": 3, "showAnalytics": true, "title": "Audit Events by Type", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 15", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"account_logs\"\n| summarize count() by ['Audit Type']", "size": 3, "showAnalytics": true, "title": "Account Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 4", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"authentication_logs\"\n| summarize count() by ['Audit Type']\n", "size": 3, "showAnalytics": true, "title": "Authentication Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"mimecast_access_logs\"\n| summarize count() by ['Audit Type']", "size": 3, "showAnalytics": true, "title": "Mimecast Support Access Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 8", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"archive_service_logs\"\n| summarize count() by ['Audit Type']", "size": 3, "showAnalytics": true, "title": "Archive Service Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 10", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"user_account_and_role_logs\"\n| summarize count() by ['Audit Type']", "size": 3, "showAnalytics": true, "title": "User Account and Role Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 12", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where Category == \"policy_logs\"\n| summarize count() by ['Audit Type']", "size": 3, "showAnalytics": true, "title": "Policy Events", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Audit Type", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 14", "styleSettings": { "margin": "5px", "maxWidth": "50%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where ['Audit Type'] == \"User Logged On\" and Application !=\"\"\n| summarize count() by Application", "size": 3, "showAnalytics": true, "title": "Successful Logins by Application", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Application", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 8", "styleSettings": { "margin": "5px", "maxWidth": "50%" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where ['Source IP'] !=\"unknown\" and ['Audit Type'] == \"User Logged On\"\n| summarize count() by User, Application, ['Source IP'] , [\"Event Time\"] ", "size": 0, "showAnalytics": true, "title": "Successful Logins by User, App and Source IP", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Successful Logins" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "user_s", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "user_s", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 0 }, "mapSettings": { "locInfo": "AzureResource", "locInfoColumn": "src_s", "sizeAggregation": "Count", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "representation": "blue" } ] } } }, "name": "query - 12", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastAudit\n| where ['Source IP'] !=\"unknown\" and ['Audit Type'] == \"Logon Authentication Failed\"\n| summarize [\"Failed Login\"] = count() by User, Application, ['Source IP'], ['Event Time']", "size": 0, "showAnalytics": true, "title": "Failed Logins by User, App and Source IP", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "User", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "User", "sortOrder": 1 } ] }, "name": "query - 14", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "name": "group - 5" }, { "type": 1, "content": { "json": "#### 📝***Refresh the web page to fetch details of recently collected events***\r\n" }, "name": "text - 4" } ] }, "name": "group - 9" } ], "fromTemplateId": "Sentinel-Mimecast-Audit-Workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }