{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "a4b4e975-fa7c-46a3-b669-850aacc88134",
"version": "KqlParameterItem/1.0",
"name": "Help",
"label": "🔎 Guide",
"type": 10,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]"
},
{
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"crossComponentResources": [
"value::selected"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"id": "314d02bf-4691-43fa-af59-d67073c8b8fa"
},
{
"id": "e6ded9a1-a83c-4762-938d-5bf8ff3d3d38",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"type": 6,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)",
"crossComponentResources": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"value": [
"value::all"
]
},
{
"id": "e3225ed0-6210-40a1-b2d0-66e42ffa71d6",
"version": "KqlParameterItem/1.0",
"name": "Workspace",
"type": 5,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\r\n| mvexpand All limit 100\r\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)",
"crossComponentResources": [
"{Subscription}"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "15b2c181-7397-43c1-900a-28e175ae8a6f",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"type": 4,
"isRequired": true,
"value": {
"durationMs": 604800000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 604800000
}
],
"allowCustom": true
},
"timeContextFromParameter": "TimeRange"
}
],
"style": "pills"
},
"name": "Parameter Selectors",
"id": "65613de4-37ff-4ac6-95e9-3a7ab1519204"
},
{
"type": 1,
"content": {
"json": "# [Lumen Defender Threat Feed Overview](https://www.lumen.com/en-us/security/black-lotus-labs.html)\n---\n\nWithin a Security Information and Event Management (SIEM) solution like Microsoft Sentinel, the most commonly used form of CTI is threat indicators, also known as Indicators of Compromise or IoCs. Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it can be applied to security products and automation in large scale to detect potential threats to an organization and protect against them. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions. [Video Demo](https://youtu.be/4Bet2oVODow)
\n\n**What is Black Lotus Labs®?**\n\nAs the Threat Research and Operations arm of Lumen, we leverage our unmatched network visibility to protect your business and help keep the internet clean. Our Lumen Defender Threat Feed uses global network data flows and machine learning algorithms to create valuable threat indicators to help keep you aware of threats to your network. Learn more on the [Black Lotus Labs X/Twitter feed](https://twitter.com/blacklotuslabs?lang=en) and [blog archive](https://blog.lumen.com/black-lotus-labs/).
\n"
},
"customWidth": "79",
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Workbook Overview",
"id": "eb722097-9fe7-4ba4-9511-b1bc13efe77d"
},
{
"type": 1,
"content": {
"json": "![\"Lumen](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Lumen%20Defender%20Threat%20Feed/Workbooks/Images/Logo/Lumen.svg\")
"
},
"customWidth": "20",
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Lumen Logo",
"id": "5b88f9b7-2285-45d0-ab72-e0f7d55f2ee5"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "18c690d7-7cbd-46c1-b677-1f72692d40cd",
"cellValue": "TAB",
"linkTarget": "parameter",
"linkLabel": "Indicators Ingestion",
"subTarget": "Indicators",
"preText": "Alert rules",
"style": "link"
},
{
"id": "f88dcf47-af98-4684-9de3-1ee5f48f68fc",
"cellValue": "TAB",
"linkTarget": "parameter",
"linkLabel": "Observed Indicators",
"subTarget": "Observed",
"style": "link"
},
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"cellValue": "TAB",
"linkTarget": "parameter",
"linkLabel": "Heat Maps",
"subTarget": "HeatMaps",
"style": "link"
},
{
"id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"cellValue": "TAB",
"linkTarget": "parameter",
"linkLabel": "Value Dashboard",
"subTarget": "ValueDashboard",
"style": "link"
}
]
},
"name": "Tabs link",
"id": "4b93e510-7ae6-4b8d-b65c-b9a96aa0bcb6"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Select all indicators from the table\r\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\r\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \"IP\",\r\n iff(isnotempty(Url), \"URL\",\r\n iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \"Email\",\r\n iff(isnotempty(FileHashValue), \"File\",\r\n iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \"Domain\",\r\n \"Other\")))))\r\n// Summarize at 15-minute granularity for finer time slicing\r\n| summarize CountOfIndicators = count() by IndicatorType, bin(TimeGenerated, 15m)\r\n| order by TimeGenerated asc, IndicatorType asc\r\n| render barchart kind=stacked ",
"size": 0,
"showAnalytics": true,
"title": "Total Lumen Indicators Imported into Sentinel by Indicator Type and Date",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"graphSettings": {
"seriesLabelSettings": [
{
"seriesName": "Domain",
"label": "Domain",
"color": "#1f77b4"
},
{
"seriesName": "IP",
"label": "IP",
"color": "#e377c2"
},
{
"seriesName": "URL",
"label": "URL",
"color": "#2ca02c"
},
{
"seriesName": "File",
"label": "File",
"color": "#ff7f0e"
},
{
"seriesName": "Email",
"label": "Email",
"color": "#9467bd"
},
{
"seriesName": "Other",
"label": "Other",
"color": "#7f7f7f"
}
],
"yAxisSettings": {
"min": 0
}
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Domain",
"color": "blue"
},
{
"seriesName": "IP",
"color": "pink"
}
]
}
},
"name": "query - 1",
"id": "72f35ea3-8d10-4c18-8857-5854b044ff39"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Filter for high-level categories only\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count active indicators per category\r\n| summarize CountOfIndicators = count() by Tag\r\n| order by CountOfIndicators desc\r\n| render piechart",
"size": 3,
"showAnalytics": true,
"title": "Category Distribution in Unique Active Lumen Indicators",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"chartSettings": {
"group": "Tag",
"createOtherGroup": 10
}
},
"customWidth": "25",
"name": "query - 5",
"id": "f12a9065-c2cb-4d7f-806b-05501ef7447b"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Select all indicators from the table\r\n| where TimeGenerated < now()\r\n// Select only indicators that have not expired\r\n and ExpirationDateTime > now()\r\n// Select only indicators that are marked active\r\n and Active == true\r\n// Select only the most recently ingested copy of an indicator\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\r\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \"IP\",\r\n iff(isnotempty(Url), \"URL\",\r\n iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \"Email\",\r\n iff(isnotempty(FileHashValue), \"File\",\r\n iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \"Domain\",\r\n \"Other\")))))\r\n// Summarize and order the data, then render the chart\r\n| summarize CountOfIndicators = count() by IndicatorType\r\n| order by CountOfIndicators desc \r\n| render piechart",
"size": 3,
"showAnalytics": true,
"title": "Unique Active Lumen Indicators by Indicator Type",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"customWidth": "25",
"name": "query - 3",
"id": "ad513abf-dd95-4d5a-8004-e9df98017a7f"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Select all indicators from the table\r\n| where TimeGenerated < now()\r\n// Select only indicators that have not expired\r\n and ExpirationDateTime > now()\r\n// Select only indicators that are marked active\r\n and Active == true\r\n// Select only the most recently ingested copy of an indicator\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Only include records with confidence scores\r\n| where isnotnull(Confidence)\r\n// Map Confidence to risk levels per requested scheme\r\n| extend ConfidenceRange = case(\r\n Confidence == 100, \"severe\",\r\n Confidence >= 81 and Confidence <= 99, \"very high\",\r\n Confidence >= 61 and Confidence <= 80, \"high\",\r\n Confidence >= 41 and Confidence <= 60, \"medium\",\r\n Confidence >= 20 and Confidence <= 40, \"low\",\r\n Confidence < 20, \"very low\",\r\n \"unknown\"\r\n )\r\n// Summarize and order the data, then render the chart\r\n| summarize CountOfIndicators = count() by ConfidenceRange\r\n// Add severity order for consistent slice sorting\r\n| extend SeverityRank = case(\r\n ConfidenceRange == 'severe', 0,\r\n ConfidenceRange == 'very high', 1,\r\n ConfidenceRange == 'high', 2,\r\n ConfidenceRange == 'medium', 3,\r\n ConfidenceRange == 'low', 4,\r\n ConfidenceRange == 'very low', 5,\r\n 6)\r\n| order by SeverityRank asc, CountOfIndicators desc\r\n| project ConfidenceRange, CountOfIndicators\r\n| render piechart",
"size": 3,
"showAnalytics": true,
"title": "Unique Active Lumen Indicators by Risk Level",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"customWidth": "25",
"name": "query - 10",
"id": "55c874e9-f1d1-4969-84b5-97e0158cf4b5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for severe indicators only (confidence score = 100)\r\n| where Confidence == 100\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count active severe indicators per threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 10 by CountOfIndicators desc\r\n| order by CountOfIndicators desc\r\n| render piechart",
"size": 3,
"showAnalytics": true,
"title": "Top 10 Threat Families in Unique Active Severe Indicators (Confidence=100)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"chartSettings": {
"group": "Tag",
"createOtherGroup": 10
}
},
"customWidth": "25",
"name": "query - 14",
"id": "f5970f9c-c4ee-4630-8608-da6aa0a87d54"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Calculate statistics per threat family\r\n| summarize \r\n CountOfIndicators = count(),\r\n MinConfidence = min(Confidence),\r\n MaxConfidence = max(Confidence),\r\n MeanConfidence = round(avg(Confidence), 2),\r\n MedianConfidence = round(percentile(Confidence, 50), 2)\r\n by Tag\r\n| order by CountOfIndicators desc",
"size": 0,
"showAnalytics": true,
"title": "Threat Family Breakdown - Active Lumen Indicators (Detailed View)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Tag",
"formatter": 1
},
{
"columnMatch": "CountOfIndicators",
"formatter": 8,
"formatOptions": {
"palette": "blue",
"compositeBarSettings": {
"labelText": "",
"columnSettings": []
}
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": true
}
}
},
{
"columnMatch": "MinConfidence",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"minimumFractionDigits": 0,
"maximumFractionDigits": 0
}
}
},
{
"columnMatch": "MaxConfidence",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"minimumFractionDigits": 0,
"maximumFractionDigits": 0
}
}
},
{
"columnMatch": "MeanConfidence",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"minimumFractionDigits": 2,
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "MedianConfidence",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"minimumFractionDigits": 2,
"maximumFractionDigits": 2
}
}
}
],
"rowLimit": 1000,
"filter": true,
"labelSettings": [
{
"columnId": "Tag",
"label": "Threat Family"
},
{
"columnId": "CountOfIndicators",
"label": "Indicator Count"
},
{
"columnId": "MinConfidence",
"label": "Min Confidence"
},
{
"columnId": "MaxConfidence",
"label": "Max Confidence"
},
{
"columnId": "MeanConfidence",
"label": "Mean Confidence"
},
{
"columnId": "MedianConfidence",
"label": "Median Confidence"
}
]
},
"sortBy": []
},
"customWidth": "50",
"name": "query - 12",
"id": "6383ebd6-359e-44cc-b924-e03322bfde2c"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count active indicators per threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 30 by CountOfIndicators desc\r\n| order by CountOfIndicators desc",
"size": 0,
"showAnalytics": true,
"title": "Threat Family Distribution in Active Lumen Indicators (Top 30)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "barchart",
"chartSettings": {
"group": "Tag",
"createOtherGroup": 30,
"showLegend": true,
"seriesLabelSettings": [
{
"seriesName": "CountOfIndicators",
"color": "blue"
}
],
"ySettings": {
"numberFormatSettings": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "50",
"name": "query - 11",
"id": "47afe474-c90b-401c-9da9-267c06f35c00"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// First, get the top 10 threat families across the entire time range\r\nlet TopThreatFamilies = ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(Created, *) by IndicatorId\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| summarize TotalCount = count() by Tag\r\n| top 10 by TotalCount desc\r\n| project Tag;\r\n// Now chart these top 10 families over time with smoothing\r\nThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| where Tag in (TopThreatFamilies)\r\n| make-series CountOfIndicators = count() default=0 on Created from {TimeRange:start} to {TimeRange:end} step 1h by Tag\r\n// Apply exponential smoothing with alpha=0.3\r\n| extend SmoothedCount = series_iir(CountOfIndicators, pack_array(0.3), pack_array(1, -0.7))\r\n| project-away CountOfIndicators\r\n| project-rename CountOfIndicators = SmoothedCount\r\n| render timechart",
"size": 0,
"showAnalytics": true,
"title": "Top 10 Threat Families Over Time (Smoothed)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"name": "query - 13",
"id": "e966caa9-2330-4d3e-a79a-089e870fff42"
}
]
},
"conditionalVisibility": {
"parameterName": "TAB",
"comparison": "isEqualTo",
"value": "Indicators"
},
"name": "Indicators Ingestion",
"id": "f9fd12ce-a481-45fc-925e-2edeccf6a3a4"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "9aec751b-07bd-43ba-80b9-f711887dce45",
"version": "KqlParameterItem/1.0",
"name": "Indicator",
"label": "Search Indicator in Events",
"type": 1,
"value": "",
"timeContext": {
"durationMs": 7776000000
},
"timeContextFromParameter": "TimeRange"
}
],
"style": "pills"
},
"customWidth": "50",
"name": "Threat Research Parameters",
"id": "a494b865-1957-40e1-8155-d5c45b999d1e"
},
{
"type": 1,
"content": {
"json": ""
},
"customWidth": "50",
"name": "text - 9",
"id": "7af757be-fbb4-4ed8-b031-96e0b7371a46"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Curated tables for indicator observation over time (customize as needed)\r\n// Includes both legacy tables and ASIM normalized tables for comprehensive coverage\r\nlet CuratedTables = (\r\n union withsource=Table_Name isfuzzy=true\r\n SecurityAlert,\r\n SecurityIncident,\r\n CommonSecurityLog,\r\n DeviceNetworkEvents,\r\n DeviceFileEvents,\r\n DeviceProcessEvents,\r\n DnsEvents,\r\n SigninLogs,\r\n AuditLogs,\r\n OfficeActivity,\r\n AzureActivity,\r\n // ASIM Normalized Tables\r\n ASimNetworkSessionLogs,\r\n ASimAuthenticationEventLogs,\r\n ASimDnsActivityLogs,\r\n ASimWebSessionLogs,\r\n ASimFileEventLogs,\r\n ASimProcessEventLogs\r\n);\r\n// Add additional lines for desired data columns\r\nCuratedTables\r\n| where column_ifexists('CallerIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileOriginUrl', '') has \"{Indicator}\"\r\nor column_ifexists('FQDN', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessSHA256', '') has \"{Indicator}\"\r\nor column_ifexists('IpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddresses', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddress', '') has \"{Indicator}\"\r\nor column_ifexists('Name', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteIP', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteUrl', '') has \"{Indicator}\"\r\nor column_ifexists('RecipientEmailAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SenderMailFromAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('Url', '') has \"{Indicator}\"\r\nor column_ifexists('SrcIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('DstIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkSourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileHashValue', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkIP', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkDestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSourceIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSenderAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DomainName', '') has \"{Indicator}\"\r\nor column_ifexists('AADEmail', '') has \"{Indicator}\"\r\nor column_ifexists('Account', '') has \"{Indicator}\"\r\nor column_ifexists('AccountName', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUpn', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Caller', '') has \"{Indicator}\"\r\nor column_ifexists('CompromisedEntity', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserID', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserName', '') has \"{Indicator}\"\r\nor column_ifexists('DisplayName', '') has \"{Indicator}\"\r\nor column_ifexists('Email_s', '') has \"{Indicator}\"\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessAccountUpn', '') has \"{Indicator}\" \r\nor column_ifexists('MailboxOwnerUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Owner', '') has \"{Indicator}\"\r\nor column_ifexists('RequesterUpn', '') has \"{Indicator}\"\r\nor column_ifexists('SourceIdentity', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserID', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserName', '') has \"{Indicator}\"\r\nor column_ifexists('SubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUser', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUserName', '') has \"{Indicator}\"\r\nor column_ifexists('Upn', '') has \"{Indicator}\"\r\nor column_ifexists('User_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserId', '') has \"{Indicator}\" \r\nor column_ifexists('UserId_', '') has \"{Indicator}\"\r\nor column_ifexists('UserId_s_s', '') has \"{Indicator}\" \r\nor column_ifexists('userName', '') has \"{Indicator}\"\r\nor column_ifexists('UserName', '') has \"{Indicator}\" \r\nor column_ifexists('UserName_s', '') has \"{Indicator}\"\r\nor column_ifexists('userPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName', '') has \"{Indicator}\"\r\nor column_ifexists('Computer', '') has \"{Indicator}\"\r\nor column_ifexists('FileHash', '') has \"{Indicator}\"\r\nor column_ifexists('FilePath', '') has \"{Indicator}\"\r\nor column_ifexists('Process', '') has \"{Indicator}\"\r\nor column_ifexists('CommandLine', '') has \"{Indicator}\"\r\nor column_ifexists('NewProcessName', '') has \"{Indicator}\"\r\nor column_ifexists('ParentProcessName', '') has \"{Indicator}\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Table_Name\r\n| render areachart",
"size": 0,
"showAnalytics": true,
"title": "Indicators Observed over Time",
"noDataMessage": "No indicators observed within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Data Table",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Log",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Logs Count",
"formatter": 4,
"formatOptions": {
"palette": "redBright"
}
}
],
"filter": true
}
},
"customWidth": "50",
"name": "query - 4 - Copy",
"id": "46e07fa4-2608-4736-a26d-dbde33f6252a"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Get threat intelligence indicators from Lumen\r\nlet tiIndicators = ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated < {TimeRange:end}\r\n| where Active == true\r\n| where isnotnull(Confidence)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId;\r\n// Extract observables from indicators\r\nlet tiIPs = tiIndicators | where isnotempty(NetworkIP) | project NetworkIP, TI_TimeGenerated = TimeGenerated, Confidence;\r\nlet tiDomains = tiIndicators | where isnotempty(DomainName) | project TI_Domain = DomainName, TI_TimeGenerated = TimeGenerated, Confidence;\r\nlet tiUrls = tiIndicators | where isnotempty(Url) | project TI_Url = Url, TI_TimeGenerated = TimeGenerated, Confidence;\r\nlet tiHashes = tiIndicators | where isnotempty(FileHashValue) | project FileHashValue, TI_TimeGenerated = TimeGenerated, Confidence;\r\nlet tiEmails = tiIndicators | where isnotempty(EmailSenderAddress) | project TI_Email = EmailSenderAddress, TI_TimeGenerated = TimeGenerated, Confidence;\r\n// Curated tables for indicator observation (customize as needed)\r\nlet CuratedTables = (\r\n union withsource=Table_Name isfuzzy=true\r\n SecurityAlert,\r\n SecurityIncident,\r\n CommonSecurityLog,\r\n DeviceNetworkEvents,\r\n DeviceFileEvents,\r\n DeviceProcessEvents,\r\n DnsEvents,\r\n SigninLogs,\r\n AuditLogs,\r\n OfficeActivity,\r\n AzureActivity,\r\n ASimNetworkSessionLogs,\r\n ASimAuthenticationEventLogs,\r\n ASimDnsActivityLogs,\r\n ASimWebSessionLogs,\r\n ASimFileEventLogs,\r\n ASimProcessEventLogs\r\n | extend \r\n ObsIP = coalesce(\r\n column_ifexists('CallerIpAddress', ''),\r\n column_ifexists('DestinationIP', ''),\r\n column_ifexists('IpAddress', ''),\r\n column_ifexists('IPAddress', ''),\r\n column_ifexists('RemoteIP', ''),\r\n column_ifexists('SourceIP', ''),\r\n column_ifexists('SrcIpAddr', ''),\r\n column_ifexists('DstIpAddr', ''),\r\n column_ifexists('NetworkSourceIP', ''),\r\n column_ifexists('NetworkIP', ''),\r\n column_ifexists('NetworkDestinationIP', ''),\r\n column_ifexists('EmailSourceIpAddress', '')\r\n ),\r\n ObsDomain = coalesce(\r\n column_ifexists('FQDN', ''),\r\n column_ifexists('Name', ''),\r\n column_ifexists('DomainName', '')\r\n ),\r\n ObsUrl = coalesce(\r\n column_ifexists('FileOriginUrl', ''),\r\n column_ifexists('RemoteUrl', ''),\r\n column_ifexists('Url', '')\r\n ),\r\n ObsHash = coalesce(\r\n column_ifexists('InitiatingProcessSHA256', ''),\r\n column_ifexists('FileHashValue', ''),\r\n column_ifexists('FileHash', '')\r\n ),\r\n ObsEmail = coalesce(\r\n column_ifexists('RecipientEmailAddress', ''),\r\n column_ifexists('SenderMailFromAddress', ''),\r\n column_ifexists('EmailSenderAddress', ''),\r\n column_ifexists('AADEmail', '')\r\n )\r\n | project TimeGenerated, ObsIP, ObsDomain, ObsUrl, ObsHash, ObsEmail\r\n);\r\n// Join observed data with threat indicators and get confidence scores\r\nlet ObservedIndicators = union\r\n (CuratedTables | where isnotempty(ObsIP) | join kind=inner tiIPs on $left.ObsIP == $right.NetworkIP | project TimeGenerated, Confidence),\r\n (CuratedTables | where isnotempty(ObsDomain) | join kind=inner tiDomains on $left.ObsDomain == $right.TI_Domain | project TimeGenerated, Confidence),\r\n (CuratedTables | where isnotempty(ObsUrl) | join kind=inner tiUrls on $left.ObsUrl == $right.TI_Url | project TimeGenerated, Confidence),\r\n (CuratedTables | where isnotempty(ObsHash) | join kind=inner tiHashes on $left.ObsHash == $right.FileHashValue | project TimeGenerated, Confidence),\r\n (CuratedTables | where isnotempty(ObsEmail) | join kind=inner tiEmails on $left.ObsEmail == $right.TI_Email | project TimeGenerated, Confidence);\r\n// Map Confidence to risk levels and create time series\r\nObservedIndicators\r\n| extend ConfidenceRange = case(\r\n Confidence == 100, \"severe\",\r\n Confidence >= 81 and Confidence <= 99, \"very high\",\r\n Confidence >= 61 and Confidence <= 80, \"high\",\r\n Confidence >= 41 and Confidence <= 60, \"medium\",\r\n Confidence >= 20 and Confidence <= 40, \"low\",\r\n Confidence < 20, \"very low\",\r\n \"unknown\"\r\n)\r\n| make-series Count = count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by ConfidenceRange\r\n| extend SeverityRank = case(\r\n ConfidenceRange == 'severe', 0,\r\n ConfidenceRange == 'very high', 1,\r\n ConfidenceRange == 'high', 2,\r\n ConfidenceRange == 'medium', 3,\r\n ConfidenceRange == 'low', 4,\r\n ConfidenceRange == 'very low', 5,\r\n 6)\r\n| order by SeverityRank asc\r\n| project-away SeverityRank\r\n| render timechart",
"size": 0,
"showAnalytics": true,
"title": "Observed Indicators by Risk Level Over Time",
"noDataMessage": "No indicators observed within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"customWidth": "50",
"name": "query - 4",
"id": "23dc241e-84b6-4b30-8baf-5f8d872b2876"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Get Lumen indicators with Tags - normalize to single columns per type\r\nlet tiIPs = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project IP = coalesce(NetworkSourceIP, NetworkIP, NetworkDestinationIP, EmailSourceIpAddress), Tags\r\n | where isnotempty(IP);\r\nlet tiDomains = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Domain = DomainName, Tags\r\n | where isnotempty(Domain);\r\nlet tiUrls = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Url, Tags\r\n | where isnotempty(Url);\r\nlet tiHashes = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Hash = FileHashValue, Tags\r\n | where isnotempty(Hash);\r\nlet tiEmails = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Email = EmailSenderAddress, Tags\r\n | where isnotempty(Email);\r\n// Curated tables for indicator observation\r\nlet CuratedTables = (\r\n union withsource=Table_Name isfuzzy=true\r\n SecurityAlert,\r\n SecurityIncident,\r\n CommonSecurityLog,\r\n DeviceNetworkEvents,\r\n DeviceFileEvents,\r\n DeviceProcessEvents,\r\n DnsEvents,\r\n SigninLogs,\r\n AuditLogs,\r\n OfficeActivity,\r\n AzureActivity\r\n | extend IP = coalesce(\r\n column_ifexists('CallerIpAddress', ''),\r\n column_ifexists('DestinationIP', ''),\r\n column_ifexists('IpAddress', ''),\r\n column_ifexists('IPAddress', ''),\r\n column_ifexists('RemoteIP', ''),\r\n column_ifexists('SourceIP', ''),\r\n column_ifexists('SrcIpAddr', ''),\r\n column_ifexists('DstIpAddr', ''),\r\n column_ifexists('NetworkSourceIP', ''),\r\n column_ifexists('NetworkIP', ''),\r\n column_ifexists('NetworkDestinationIP', ''),\r\n column_ifexists('EmailSourceIpAddress', ''),\r\n '')\r\n | extend Domain = coalesce(\r\n column_ifexists('FQDN', ''),\r\n column_ifexists('DomainName', ''),\r\n column_ifexists('Name', ''),\r\n '')\r\n | extend Url = coalesce(\r\n column_ifexists('FileOriginUrl', ''),\r\n column_ifexists('RemoteUrl', ''),\r\n column_ifexists('Url', ''),\r\n '')\r\n | extend Hash = coalesce(\r\n column_ifexists('InitiatingProcessSHA256', ''),\r\n column_ifexists('FileHashValue', ''),\r\n column_ifexists('FileHash', ''),\r\n '')\r\n | extend Email = coalesce(\r\n column_ifexists('RecipientEmailAddress', ''),\r\n column_ifexists('SenderMailFromAddress', ''),\r\n column_ifexists('EmailSenderAddress', ''),\r\n '')\r\n | project TimeGenerated, IP, Domain, Url, Hash, Email\r\n);\r\n// Union all matches together\r\nlet ObservedIndicators = union\r\n (CuratedTables | where isnotempty(IP) | join kind=inner tiIPs on IP | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Domain) | join kind=inner tiDomains on Domain | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Url) | join kind=inner tiUrls on Url | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Hash) | join kind=inner tiHashes on Hash | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Email) | join kind=inner tiEmails on Email | project TimeGenerated, Tags);\r\n// Process tags and create time series\r\nObservedIndicators\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| make-series ObservationCount = count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h by Tag\r\n| render timechart",
"size": 0,
"showAnalytics": true,
"title": "Observed Indicators by Category Over Time",
"noDataMessage": "No observed indicators within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"customWidth": "50",
"name": "query - 6",
"id": "2d3a36eb-d4d1-480c-bba8-8f5a845d0b69"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Get Lumen indicators with Tags - normalize to single columns per type\r\nlet tiIPs = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project IP = coalesce(NetworkSourceIP, NetworkIP, NetworkDestinationIP, EmailSourceIpAddress), Tags\r\n | where isnotempty(IP);\r\nlet tiDomains = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Domain = DomainName, Tags\r\n | where isnotempty(Domain);\r\nlet tiUrls = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Url, Tags\r\n | where isnotempty(Url);\r\nlet tiHashes = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Hash = FileHashValue, Tags\r\n | where isnotempty(Hash);\r\nlet tiEmails = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty(Tags)\r\n | project Email = EmailSenderAddress, Tags\r\n | where isnotempty(Email);\r\n// Curated tables for indicator observation\r\nlet CuratedTables = (\r\n union withsource=Table_Name isfuzzy=true\r\n SecurityAlert,\r\n SecurityIncident,\r\n CommonSecurityLog,\r\n DeviceNetworkEvents,\r\n DeviceFileEvents,\r\n DeviceProcessEvents,\r\n DnsEvents,\r\n SigninLogs,\r\n AuditLogs,\r\n OfficeActivity,\r\n AzureActivity\r\n | extend IP = coalesce(\r\n column_ifexists('CallerIpAddress', ''),\r\n column_ifexists('DestinationIP', ''),\r\n column_ifexists('IpAddress', ''),\r\n column_ifexists('IPAddress', ''),\r\n column_ifexists('RemoteIP', ''),\r\n column_ifexists('SourceIP', ''),\r\n column_ifexists('SrcIpAddr', ''),\r\n column_ifexists('DstIpAddr', ''),\r\n column_ifexists('NetworkSourceIP', ''),\r\n column_ifexists('NetworkIP', ''),\r\n column_ifexists('NetworkDestinationIP', ''),\r\n column_ifexists('EmailSourceIpAddress', ''),\r\n '')\r\n | extend Domain = coalesce(\r\n column_ifexists('FQDN', ''),\r\n column_ifexists('DomainName', ''),\r\n column_ifexists('Name', ''),\r\n '')\r\n | extend Url = coalesce(\r\n column_ifexists('FileOriginUrl', ''),\r\n column_ifexists('RemoteUrl', ''),\r\n column_ifexists('Url', ''),\r\n '')\r\n | extend Hash = coalesce(\r\n column_ifexists('InitiatingProcessSHA256', ''),\r\n column_ifexists('FileHashValue', ''),\r\n column_ifexists('FileHash', ''),\r\n '')\r\n | extend Email = coalesce(\r\n column_ifexists('RecipientEmailAddress', ''),\r\n column_ifexists('SenderMailFromAddress', ''),\r\n column_ifexists('EmailSenderAddress', ''),\r\n '')\r\n | project TimeGenerated, IP, Domain, Url, Hash, Email\r\n);\r\n// Union all matches together\r\nlet ObservedIndicators = union\r\n (CuratedTables | where isnotempty(IP) | join kind=inner tiIPs on IP | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Domain) | join kind=inner tiDomains on Domain | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Url) | join kind=inner tiUrls on Url | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Hash) | join kind=inner tiHashes on Hash | project TimeGenerated, Tags),\r\n (CuratedTables | where isnotempty(Email) | join kind=inner tiEmails on Email | project TimeGenerated, Tags);\r\n// Get top 15 threat families from observed indicators\r\nlet TopThreatFamilies = ObservedIndicators\r\n | where isnotempty(Tags)\r\n | extend TagList = split(Tags, ',')\r\n | mv-expand TagList\r\n | extend Tag = trim(' ', tostring(TagList))\r\n | where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n | summarize TotalCount = count() by Tag\r\n | top 15 by TotalCount desc\r\n | project Tag;\r\n// Create time series for top threat families\r\nObservedIndicators\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| where Tag in (TopThreatFamilies)\r\n| make-series ObservationCount = count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h by Tag\r\n| render timechart",
"size": 0,
"showAnalytics": true,
"title": "Observed Indicators by Threat Family Over Time (Top 15)",
"noDataMessage": "No observed indicators within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"customWidth": "50",
"name": "query - 7",
"id": "191fe246-aaed-4f53-9d74-75391759ba76"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Get Lumen indicators - expanded with all fields for matching\r\nlet tiIPs = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | project IP = coalesce(NetworkSourceIP, NetworkIP, NetworkDestinationIP, EmailSourceIpAddress), ThreatType, Description, Tags, Confidence\r\n | where isnotempty(IP);\r\nlet tiDomains = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | project Domain = DomainName, ThreatType, Description, Tags, Confidence\r\n | where isnotempty(Domain);\r\nlet tiUrls = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | project Url, ThreatType, Description, Tags, Confidence\r\n | where isnotempty(Url);\r\nlet tiHashes = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | project Hash = FileHashValue, ThreatType, Description, Tags, Confidence\r\n | where isnotempty(Hash);\r\nlet tiEmails = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where ExpirationDateTime > now()\r\n | where Active == true\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | project Email = EmailSenderAddress, ThreatType, Description, Tags, Confidence\r\n | where isnotempty(Email);\r\n// Curated tables with more context fields\r\nlet IPMatches = CommonSecurityLog\r\n | extend IP = coalesce(DestinationIP, SourceIP)\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"CommonSecurityLog\", MatchedIndicator = IP, SourceIP, DestinationIP, SourcePort = tostring(SourcePort), DestinationPort = tostring(DestinationPort), RemoteIP = \"\", RemotePort = \"\", Protocol, DeviceAction, Activity, ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\nlet DomainMatches = DnsEvents\r\n | extend Domain = Name\r\n | where isnotempty(Domain)\r\n | join kind=inner (tiDomains | project Domain, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on Domain\r\n | project TimeGenerated, DataSource = \"DnsEvents\", MatchedIndicator = Domain, SourceIP = \"\", DestinationIP = \"\", SourcePort = \"\", DestinationPort = \"\", RemoteIP = \"\", RemotePort = \"\", ClientIP, QueryType, ResultCode = tostring(ResultCode), ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"Domain\";\r\nlet DeviceIPMatches = DeviceNetworkEvents\r\n | extend IP = coalesce(RemoteIP, LocalIP)\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"DeviceNetworkEvents\", MatchedIndicator = IP, SourceIP = \"\", DestinationIP = \"\", SourcePort = \"\", DestinationPort = \"\", RemoteIP, RemotePort = tostring(RemotePort), DeviceName, LocalIP, LocalPort = tostring(LocalPort), Protocol, ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\nlet SignInIPMatches = SigninLogs\r\n | extend IP = IPAddress\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"SigninLogs\", MatchedIndicator = IP, SourceIP = \"\", DestinationIP = \"\", SourcePort = \"\", DestinationPort = \"\", RemoteIP = \"\", RemotePort = \"\", UserPrincipalName, AppDisplayName, IPAddress, Location, ResultType, ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\n// ASIM Network Sessions\r\nlet ASIMNetworkIPMatches = ASimNetworkSessionLogs\r\n | extend IP = coalesce(DstIpAddr, SrcIpAddr)\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"ASimNetworkSessionLogs\", MatchedIndicator = IP, SourceIP = tostring(SrcIpAddr), DestinationIP = tostring(DstIpAddr), SourcePort = tostring(SrcPortNumber), DestinationPort = tostring(DstPortNumber), RemoteIP = \"\", RemotePort = \"\", NetworkProtocol, EventResult, ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\n// ASIM DNS Activity\r\nlet ASIMDnsMatches = ASimDnsActivityLogs\r\n | extend Domain = DnsQuery\r\n | where isnotempty(Domain)\r\n | join kind=inner (tiDomains | project Domain, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on Domain\r\n | project TimeGenerated, DataSource = \"ASimDnsActivityLogs\", MatchedIndicator = Domain, SourceIP = tostring(SrcIpAddr), DestinationIP = \"\", SourcePort = \"\", DestinationPort = \"\", RemoteIP = \"\", RemotePort = \"\", DnsQuery, DnsQueryType = tostring(DnsQueryType), ResponseCode = tostring(column_ifexists('ResponseCodeName', column_ifexists('DnsResponseCode', ''))), ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"Domain\";\r\n// ASIM Authentication Events\r\nlet ASIMAuthIPMatches = ASimAuthenticationEventLogs\r\n | extend IP = SrcIpAddr\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"ASimAuthenticationEventLogs\", MatchedIndicator = IP, SourceIP = tostring(SrcIpAddr), DestinationIP = \"\", SourcePort = \"\", DestinationPort = \"\", RemoteIP = \"\", RemotePort = \"\", TargetUsername, TargetAppName, EventResult, LogonMethod, ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\n// ASIM Web Sessions\r\nlet ASIMWebMatches = ASimWebSessionLogs\r\n | extend IP = coalesce(DstIpAddr, SrcIpAddr)\r\n | where isnotempty(IP)\r\n | join kind=inner (tiIPs | project IP, TI_ThreatType=ThreatType, TI_Description=Description, TI_Tags=Tags, TI_Confidence=Confidence) on IP\r\n | project TimeGenerated, DataSource = \"ASimWebSessionLogs\", MatchedIndicator = IP, SourceIP = tostring(SrcIpAddr), DestinationIP = tostring(DstIpAddr), SourcePort = tostring(SrcPortNumber), DestinationPort = tostring(DstPortNumber), RemoteIP = \"\", RemotePort = \"\", Url, HttpStatusCode = tostring(column_ifexists('HttpStatusCode', column_ifexists('EventResultDetails', ''))), ThreatType = TI_ThreatType, Description = TI_Description, Tags = TI_Tags, IndicatorConfidence = TI_Confidence\r\n | extend IndicatorType = \"IP\";\r\n// Union all matches\r\nunion IPMatches, DomainMatches, DeviceIPMatches, SignInIPMatches, ASIMNetworkIPMatches, ASIMDnsMatches, ASIMAuthIPMatches, ASIMWebMatches\r\n| extend Category = extract(@\"\\b(attack|bot|c2|darknet|hacktool|malware|newly_registered_domain|phish|popular|proxy|reflector|scan|service|sinkhole|spam|suspicious|victim)\\b\", 1, Tags)\r\n| extend SourceIPPort = iff(isnotempty(SourceIP) and isnotempty(SourcePort), strcat(SourceIP, \":\", SourcePort), SourceIP)\r\n| extend DestIPPort = iff(isnotempty(coalesce(DestinationIP, RemoteIP)) and isnotempty(coalesce(DestinationPort, RemotePort)), strcat(coalesce(DestinationIP, RemoteIP), \":\", coalesce(DestinationPort, RemotePort)), coalesce(DestinationIP, RemoteIP))\r\n| project TimeGenerated, DataSource, IndicatorType, MatchedIndicator, SourceIPPort, DestIPPort, Category, ThreatType, Confidence = IndicatorConfidence, Tags, Description\r\n| top 500 by TimeGenerated desc",
"size": 0,
"showAnalytics": true,
"title": "Observed Indicator Matches - Sample Logs (Top 500)",
"noDataMessage": "No indicator matches found",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeGenerated",
"formatter": 6
},
{
"columnMatch": "DataSource",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Log",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "IndicatorType",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "IP",
"representation": "Loc",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Domain",
"representation": "Server",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Unknown",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "MatchedIndicator",
"formatter": 1
},
{
"columnMatch": "Category",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "malware",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "c2",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "phish",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "bot",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "scan",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "ThreatType",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Pre attack",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Confidence",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "100",
"representation": "redBright",
"text": "{0}{1}"
},
{
"operator": ">=",
"thresholdValue": "80",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": ">=",
"thresholdValue": "60",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "gray",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"rowLimit": 500,
"filter": true,
"labelSettings": [
{
"columnId": "TimeGenerated",
"label": "Time"
},
{
"columnId": "DataSource",
"label": "Log Source"
},
{
"columnId": "IndicatorType",
"label": "Type"
},
{
"columnId": "MatchedIndicator",
"label": "Indicator"
},
{
"columnId": "SourceIPPort",
"label": "Source IP:Port"
},
{
"columnId": "DestIPPort",
"label": "Dest IP:Port"
},
{
"columnId": "Category",
"label": "Threat Category"
},
{
"columnId": "ThreatType",
"label": "Threat Type"
},
{
"columnId": "Confidence",
"label": "Confidence"
}
]
}
},
"name": "query - 8 - Indicator Matches",
"id": "7778a0ac-47be-4652-920a-d43460a59dfa"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | project IndicatorId, Tags, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem\r\n | extend ThreatCategory = extract(@\"\\b(attack|bot|c2|darknet|hacktool|malware|newly_registered_domain|phish|popular|proxy|reflector|scan|service|sinkhole|spam|suspicious|victim)\\b\", 1, Tags)\r\n | extend ThreatCategory = coalesce(ThreatCategory, \"other\");\r\nlet alertEntity = SecurityAlert \r\n | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity) \r\n | project entity, SystemAlertId, AlertTime;\r\nlet IncidentAlerts = SecurityIncident\r\n | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator;\r\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\r\nIncidentsWithAlertsWithTiObservables\r\n| where Indicator contains '{Indicator}' or Indicator == \"*\"\r\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, ThreatCategory, Source = SourceSystem, Description\r\n| sort by Incidents, Alerts desc",
"size": 0,
"showAnalytics": true,
"title": "Lumen Threat Intelligence Alerts",
"noDataMessage": "No indicators observed within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "ThreatCategory",
"formatter": 0
},
{
"columnMatch": "Source",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Incidents",
"formatter": 4,
"formatOptions": {
"palette": "redBright"
}
},
{
"columnMatch": "Alerts",
"formatter": 4,
"formatOptions": {
"palette": "orange"
}
}
],
"filter": true
}
},
"customWidth": "75",
"name": "query - 5",
"id": "e7b00eb3-5a4c-4dee-895c-70846cf201c4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | project IndicatorId, ThreatType, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem, Tags;\r\nlet alertEntity = SecurityAlert \r\n | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity) \r\n | project entity, SystemAlertId, AlertTime;\r\nlet IncidentAlerts = SecurityIncident\r\n | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator;\r\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\r\nIncidentsWithAlertsWithTiObservables\r\n| where Indicator contains '{Indicator}' or Indicator == \"*\"\r\n// Split tags and filter for high-level categories\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| summarize Alerts=dcount(SystemAlertId) by Tag\r\n| order by Alerts desc",
"size": 3,
"showAnalytics": true,
"title": "Alert Categories",
"noDataMessage": "No category data available",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"chartSettings": {
"group": "Tag",
"createOtherGroup": 10
}
},
"customWidth": "25",
"name": "query - 5b",
"id": "15d8ff30-6a24-47dd-a0f7-3b05c87135f4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| extend SystemAlertId = tostring(AlertIds[0])\r\n| join (SecurityAlert \r\n| where Entities <> \"\"\r\n| mv-expand parse_json(Entities)\r\n| where Entities contains '{Indicator}'\r\n| project SystemAlertId, Entities\r\n) on SystemAlertId\r\n| where Title <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, IncidentNumber desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade, Entities\r\n| limit 2500",
"size": 0,
"showAnalytics": true,
"title": "Security Incidents",
"noDataMessage": "No incidents observed within these thresholds",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Incident Name",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Alert",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "IncidentUrl",
"formatter": 7,
"formatOptions": {
"linkTarget": "OpenBlade",
"linkLabel": "Incident >>",
"bladeOpenContext": {
"bladeName": "CaseBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "id",
"source": "column",
"value": "IncidentBlade"
}
]
}
}
},
{
"columnMatch": "IncidentBlade",
"formatter": 5
}
],
"rowLimit": 2500,
"filter": true,
"sortBy": [
{
"itemKey": "IncidentNumber",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "IncidentNumber",
"sortOrder": 2
}
]
},
"customWidth": "75",
"name": "query - 3",
"id": "667a83ad-c88a-4323-9cac-20efcb9f2cc8"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | project IndicatorId, ThreatType, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem, Tags;\r\nlet alertEntity = SecurityAlert \r\n | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity) \r\n | project entity, SystemAlertId, AlertTime;\r\nlet IncidentAlerts = SecurityIncident\r\n | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator;\r\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\r\nIncidentsWithAlertsWithTiObservables\r\n| where Indicator contains '{Indicator}' or Indicator == \"*\"\r\n// Split tags and filter for high-level categories\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| summarize Incidents=dcount(IncidentNumber) by Tag\r\n| order by Incidents desc",
"size": 3,
"showAnalytics": true,
"title": "Incident Categories",
"noDataMessage": "No category data available",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"chartSettings": {
"group": "Tag",
"createOtherGroup": 10
}
},
"customWidth": "25",
"name": "query - 3b",
"id": "4cf7380d-2c1b-4600-b883-7dfc65e9e50a"
}
]
},
"conditionalVisibility": {
"parameterName": "TAB",
"comparison": "isEqualTo",
"value": "Observed"
},
"name": "Indicators Observed",
"id": "8edd586d-a3c6-468c-8d01-43c36b02a4d0"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Risk Category Heat Maps\r\n\r\nVisualize the distribution of high-level threat categories across different severity levels."
},
"name": "text - Categories Header",
"id": "4de4f70b-c139-4c9d-a802-6019c2d97da6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for severe indicators only (confidence = 100)\r\n| where isnotnull(Confidence) and Confidence == 100\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Filter for high-level categories only\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by category\r\n| summarize CountOfIndicators = count() by Tag\r\n| extend ConfidenceRange = \"Severe (100)\"\r\n| order by Tag asc",
"size": 2,
"showAnalytics": true,
"title": "Severe Risk Categories",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "greenRed"
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5
}
},
"customWidth": "50",
"name": "query - 16",
"id": "691d0431-be26-4a83-a546-34abef8c8e0e"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for very high indicators (81-99)\r\n| where isnotnull(Confidence) and Confidence >= 81 and Confidence <= 99\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Filter for high-level categories only\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by category\r\n| summarize CountOfIndicators = count() by Tag\r\n| extend ConfidenceRange = \"Very High (81-99)\"\r\n| order by Tag asc",
"size": 2,
"showAnalytics": true,
"title": "Very High Risk Categories",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "greenRed"
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5
}
},
"customWidth": "50",
"name": "query - 17",
"id": "3adb7aaa-6090-4083-8048-028d72b0549f"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for high indicators (61-80)\r\n| where isnotnull(Confidence) and Confidence >= 61 and Confidence <= 80\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Filter for high-level categories only\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by category\r\n| summarize CountOfIndicators = count() by Tag\r\n| extend ConfidenceRange = \"High (61-80)\"\r\n| order by Tag asc",
"size": 2,
"showAnalytics": true,
"title": "High Risk Categories",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "greenRed"
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5
}
},
"customWidth": "50",
"name": "query - 18",
"id": "c7d6abd1-c65f-4831-a756-a834826b51e7"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for medium indicators (41-60)\r\n| where isnotnull(Confidence) and Confidence >= 41 and Confidence <= 60\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Filter for high-level categories only\r\n| where Tag in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by category\r\n| summarize CountOfIndicators = count() by Tag\r\n| extend ConfidenceRange = \"Medium (41-60)\"\r\n| order by Tag asc",
"size": 2,
"showAnalytics": true,
"title": "Medium Risk Categories",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "greenRed"
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5
}
},
"customWidth": "50",
"name": "query - 19",
"id": "3d810536-36dc-45db-8ff6-55adea8edb54"
},
{
"type": 1,
"content": {
"json": "---\r\n\r\n## Threat Family Heat Maps\r\n\r\nVisualize the distribution of specific threat families (excluding high-level categories) across different severity levels."
},
"name": "text - Families Header",
"id": "f07aabdd-930a-41c3-b688-8da916cafc97"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for severe indicators only (confidence = 100)\r\n| where isnotnull(Confidence) and Confidence == 100\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 20 by CountOfIndicators desc\r\n| extend ConfidenceRange = \"Severe (100)\"\r\n| order by CountOfIndicators desc",
"size": 2,
"showAnalytics": true,
"title": "Severe Risk Threat Families (Top 20)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "blueOrange",
"heatmapMin": null,
"heatmapMax": null
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5,
"edgeColorSettings": null
}
},
"customWidth": "50",
"name": "query - 20",
"id": "85bdfeaa-7f6f-4474-93ee-913381c713d6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for very high indicators (81-99)\r\n| where isnotnull(Confidence) and Confidence >= 81 and Confidence <= 99\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 20 by CountOfIndicators desc\r\n| extend ConfidenceRange = \"Very High (81-99)\"\r\n| order by CountOfIndicators desc",
"size": 2,
"showAnalytics": true,
"title": "Very High Risk Threat Families (Top 20)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "blueOrange",
"heatmapMin": null,
"heatmapMax": null
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5,
"edgeColorSettings": null
}
},
"customWidth": "50",
"name": "query - 21",
"id": "7132700a-b2d8-4624-b6ca-75059907a4e0"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for high indicators (61-80)\r\n| where isnotnull(Confidence) and Confidence >= 61 and Confidence <= 80\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 20 by CountOfIndicators desc\r\n| extend ConfidenceRange = \"High (61-80)\"\r\n| order by CountOfIndicators desc",
"size": 2,
"showAnalytics": true,
"title": "High Risk Threat Families (Top 20)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "blueOrange",
"heatmapMin": null,
"heatmapMax": null
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5,
"edgeColorSettings": null
}
},
"customWidth": "50",
"name": "query - 22",
"id": "0167ad57-b38a-4f4b-9cf2-0068c7f92a94"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n// Restrict to active, non-expired, latest indicators only\r\n| where TimeGenerated < now()\r\n and ExpirationDateTime > now()\r\n and Active == true\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n// Filter for medium indicators (41-60)\r\n| where isnotnull(Confidence) and Confidence >= 41 and Confidence <= 60\r\n// Split comma-separated Tags into individual tag values\r\n| where isnotempty(Tags)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n// Count indicators by threat family\r\n| summarize CountOfIndicators = count() by Tag\r\n| top 20 by CountOfIndicators desc\r\n| extend ConfidenceRange = \"Medium (41-60)\"\r\n| order by CountOfIndicators desc",
"size": 2,
"showAnalytics": true,
"title": "Medium Risk Threat Families (Top 20)",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "Tag",
"formatter": 1
},
"centerContent": {
"columnMatch": "CountOfIndicators",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"hivesContent": {
"columnMatch": "ConfidenceRange",
"formatter": 1
},
"nodeIdField": "Tag",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 100,
"colorSettings": {
"nodeColorField": "CountOfIndicators",
"type": 4,
"heatmapPalette": "blueOrange",
"heatmapMin": null,
"heatmapMax": null
},
"groupByField": "ConfidenceRange",
"hivesMargin": 5,
"edgeColorSettings": null
}
},
"customWidth": "50",
"name": "query - 23",
"id": "9d0403ef-86a6-4f44-bf6c-230c2a2e7f33"
}
]
},
"conditionalVisibility": {
"parameterName": "TAB",
"comparison": "isEqualTo",
"value": "HeatMaps"
},
"name": "Heat Maps",
"id": "1f0c3239-f3a8-454f-a417-621d2778df77"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## 📊 SOC Value Dashboard\r\n\r\nThis dashboard demonstrates the value provided by Lumen Defender Threat Feed to your Security Operations Center. Metrics focus on incidents that were enriched with Lumen threat intelligence, showing how the threat feed improves detection speed, response times, and overall security posture.\r\n\r\n**Key Metrics:**\r\n- **MTTD (Mean Time to Detect)**: Average time between when a threat indicator first appears in your logs and when Sentinel detects it\r\n- **MTTR (Mean Time to Respond)**: Average time from incident creation to closure for Lumen-enriched incidents\r\n- **Enrichment Coverage**: Percentage of incidents that benefit from Lumen threat intelligence\r\n- **High-Confidence Detections**: Incidents triggered by Lumen's most reliable indicators (Confidence ≥ 80)"
},
"name": "Value Dashboard Header",
"id": "18120b91-0aa7-4adf-837d-80f0d092f689"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Total incidents that contain Lumen threat intelligence indicators\r\n// Use the same pattern as the working \"Lumen Threat Intelligence Alerts\" query\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, tostring(AlertIds);\r\nlet IncidentsWithLumen = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\r\nIncidentsWithLumen\r\n| summarize TotalIncidents = dcount(IncidentNumber)",
"size": 4,
"title": "Lumen-Enriched Incidents",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "TotalIncidents",
"formatter": 1
},
"leftContent": {
"columnMatch": "TotalIncidents",
"formatter": 12,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"useGrouping": true
}
}
},
"showBorder": true
}
},
"customWidth": "25",
"name": "Total Lumen Incidents",
"id": "b4ee5d68-90ca-43eb-8870-f46b5d59e2fa"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Calculate MTTD: Time from alert generation to incident creation\r\n// For Lumen-enriched incidents\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId, AlertTime = TimeGenerated\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId, AlertTime;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, IncidentCreated = CreatedTime, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, IncidentCreated, tostring(AlertIds);\r\nlet IncidentsWithLumen = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n | extend MTTD_Hours = datetime_diff('hour', IncidentCreated, AlertTime)\r\n | where MTTD_Hours >= 0 and MTTD_Hours < 720;\r\nIncidentsWithLumen\r\n| summarize AvgMTTD = avg(MTTD_Hours)",
"size": 4,
"title": "Mean Time to Detect (MTTD)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "AvgMTTD",
"formatter": 1
},
"leftContent": {
"columnMatch": "AvgMTTD",
"formatter": 12,
"formatOptions": {
"palette": "greenDark"
},
"numberFormat": {
"unit": 26,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumFractionDigits": 2
}
}
},
"showBorder": true
}
},
"customWidth": "25",
"name": "MTTD Metric",
"id": "42450ae1-6ffb-4317-88d9-371d77fa319a"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Calculate MTTR: Time from incident creation to closure\r\n// Only for Lumen-enriched incidents\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | where Status == \"Closed\"\r\n | where isnotnull(ClosedTime) and isnotnull(CreatedTime)\r\n | project IncidentNumber, CreatedTime, ClosedTime, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, CreatedTime, ClosedTime, tostring(AlertIds);\r\nlet IncidentsWithLumen = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n | extend MTTR_Hours = datetime_diff('hour', ClosedTime, CreatedTime)\r\n | where MTTR_Hours >= 0 and MTTR_Hours < 720;\r\nIncidentsWithLumen\r\n| summarize AvgMTTR = avg(MTTR_Hours)",
"size": 4,
"title": "Mean Time to Respond (MTTR)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "AvgMTTR",
"formatter": 1
},
"leftContent": {
"columnMatch": "AvgMTTR",
"formatter": 12,
"formatOptions": {
"palette": "orange"
},
"numberFormat": {
"unit": 26,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumFractionDigits": 2
}
}
},
"showBorder": true
}
},
"customWidth": "25",
"name": "MTTR Metric",
"id": "2d57b85f-388b-4fb6-a08b-2c8f56a0e25a"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Calculate enrichment coverage percentage\r\nlet TotalIncidents = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize Total = dcount(IncidentNumber);\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, tostring(AlertIds);\r\nlet LumenIncidents = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n | summarize Enriched = dcount(IncidentNumber);\r\nTotalIncidents\r\n| extend Enriched = toscalar(LumenIncidents)\r\n| extend EnrichmentPercentage = round((Enriched * 100.0) / Total, 2)\r\n| project EnrichmentPercentage",
"size": 4,
"title": "Enrichment Coverage",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "EnrichmentPercentage",
"formatter": 1
},
"leftContent": {
"columnMatch": "EnrichmentPercentage",
"formatter": 12,
"formatOptions": {
"palette": "purple"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumFractionDigits": 1
}
}
},
"showBorder": true
}
},
"customWidth": "25",
"name": "Enrichment Coverage",
"id": "26bce798-ba4a-47b9-9a65-77190a294436"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Lumen-enriched incidents over time\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, CreatedTime, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, CreatedTime, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| summarize Incidents = dcount(IncidentNumber) by bin(CreatedTime, 1d)\r\n| order by CreatedTime asc",
"size": 0,
"title": "Lumen-Enriched Incidents Over Time",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "50",
"name": "Incidents Over Time",
"id": "807a33a6-38d6-4733-87a6-959c2194d342"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Severity distribution of Lumen-enriched incidents\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, Severity, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, Severity, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| summarize Incidents = dcount(IncidentNumber) by Severity\r\n| order by Severity asc",
"size": 0,
"title": "Incidents by Severity",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart"
},
"customWidth": "50",
"name": "Severity Distribution",
"id": "77c5e20d-e682-4c4d-9e92-8b247412c5d6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// High-confidence Lumen indicators that contributed to incidents\r\n// Shows active Lumen indicators with high confidence scores\r\nThreatIntelIndicatorsv2\r\n| where SourceSystem == \"Lumen\"\r\n| where TimeGenerated {TimeRange:query}\r\n| where TimeGenerated < now()\r\n| where ExpirationDateTime > now()\r\n| where Active == true\r\n| where isnotnull(Confidence) and Confidence >= 80\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| extend IndicatorType = case(\r\n isnotempty(NetworkIP) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP) or isnotempty(EmailSourceIpAddress), \"IP Address\",\r\n isnotempty(DomainName), \"Domain\",\r\n isnotempty(Url), \"URL\",\r\n isnotempty(FileHashValue), \"File Hash\",\r\n \"Other\"\r\n)\r\n// Extract threat families from Tags field (comma-separated)\r\n| extend TagList = split(Tags, ',')\r\n| mv-expand TagList\r\n| extend Tag = trim(' ', tostring(TagList))\r\n| where Tag != ''\r\n// Exclude high-level categories - only show threat families\r\n| where Tag !in (\"attack\", \"bot\", \"c2\", \"darknet\", \"hacktool\", \"malware\", \"newly_registered_domain\", \"phish\", \"popular\", \"proxy\", \"reflector\", \"scan\", \"service\", \"sinkhole\", \"spam\", \"suspicious\", \"victim\")\r\n| summarize \r\n IndicatorCount = dcount(IndicatorId),\r\n AvgConfidence = avg(Confidence),\r\n ThreatFamilies = make_set(Tag, 20)\r\n by IndicatorType\r\n| extend ThreatFamiliesStr = iff(array_length(ThreatFamilies) > 0, strcat_array(ThreatFamilies, \", \"), \"(No specific families)\")\r\n| project IndicatorType, IndicatorCount, AvgConfidence, ThreatFamilies = ThreatFamiliesStr\r\n| order by IndicatorCount desc",
"size": 0,
"title": "High-Confidence Indicators (≥80%) Contributing to Security",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "IndicatorType",
"formatter": 1
},
{
"columnMatch": "IndicatorCount",
"formatter": 4,
"formatOptions": {
"palette": "blue"
}
},
{
"columnMatch": "AvgConfidence",
"formatter": 8,
"formatOptions": {
"palette": "greenRed",
"aggregation": "Average"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 1
}
}
},
{
"columnMatch": "ThreatTypes",
"formatter": 1
}
],
"labelSettings": [
{
"columnId": "IndicatorType",
"label": "Indicator Type"
},
{
"columnId": "IndicatorCount",
"label": "Count"
},
{
"columnId": "AvgConfidence",
"label": "Avg Confidence"
},
{
"columnId": "ThreatTypes",
"label": "Threat Families"
}
]
}
},
"customWidth": "50",
"name": "High Confidence Indicators",
"id": "0cdc4a7f-53ad-4d4d-9cdc-aabf7b13d705"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// MTTR trend over time for Lumen-enriched incidents\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | where Status == \"Closed\"\r\n | where isnotnull(ClosedTime) and isnotnull(CreatedTime)\r\n | project IncidentNumber, CreatedTime, ClosedTime, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, CreatedTime, ClosedTime, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| extend MTTR_Hours = datetime_diff('hour', ClosedTime, CreatedTime)\r\n| where MTTR_Hours >= 0 and MTTR_Hours < 720\r\n| summarize AvgMTTR = avg(MTTR_Hours) by bin(CreatedTime, 1d)\r\n| order by CreatedTime asc",
"size": 0,
"title": "MTTR Trend Over Time (Hours)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "linechart"
},
"customWidth": "50",
"name": "MTTR Trend",
"id": "ebba89b4-f952-4846-bf30-f1fcf7904209"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Top tactics observed in Lumen-enriched incidents\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, AdditionalData, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, AdditionalData, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| extend Tactics = todynamic(AdditionalData).tactics\r\n| mv-expand Tactics\r\n| extend Tactic = tostring(Tactics)\r\n| where isnotempty(Tactic)\r\n| summarize IncidentCount = dcount(IncidentNumber) by Tactic\r\n| top 10 by IncidentCount desc",
"size": 0,
"title": "Top 10 Attack Tactics Detected (MITRE ATT&CK)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "barchart"
},
"customWidth": "50",
"name": "Attack Tactics",
"id": "a7938352-81f1-492b-ae67-d174c85806b0"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Incident status breakdown\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, Status, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, Status, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| summarize IncidentCount = dcount(IncidentNumber) by Status\r\n| order by IncidentCount desc",
"size": 0,
"title": "Incident Status Distribution",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart"
},
"customWidth": "50",
"name": "Status Distribution",
"id": "524d27c0-c1a3-447a-bf55-d493349410a3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// Detailed incident list with key metrics\r\nlet tiObservables = ThreatIntelIndicatorsv2\r\n | where SourceSystem == \"Lumen\"\r\n | where TimeGenerated < now()\r\n | where Active == true\r\n | project Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName);\r\nlet alertEntity = SecurityAlert\r\n | where TimeGenerated {TimeRange:query}\r\n | project parse_json(Entities), SystemAlertId\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity)\r\n | project entity, SystemAlertId;\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator\r\n | project SystemAlertId;\r\nlet IncidentAlerts = SecurityIncident\r\n | where TimeGenerated {TimeRange:query}\r\n | project IncidentNumber, Title, Severity, Status, CreatedTime, ClosedTime, AdditionalData, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentNumber, Title, Severity, Status, CreatedTime, ClosedTime, AdditionalData, tostring(AlertIds);\r\nAlertsWithTiObservables\r\n| join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds\r\n| extend \r\n IncidentAge_Hours = datetime_diff('hour', now(), CreatedTime),\r\n TimeToClose_Hours = iff(Status == \"Closed\", datetime_diff('hour', ClosedTime, CreatedTime), long(null)),\r\n Tactics = tostring(todynamic(AdditionalData).tactics),\r\n AlertCount = tostring(todynamic(AdditionalData).alertsCount)\r\n| summarize arg_max(CreatedTime, *) by IncidentNumber\r\n| project \r\n IncidentNumber,\r\n Title,\r\n Severity,\r\n Status,\r\n CreatedTime,\r\n IncidentAge_Hours,\r\n TimeToClose_Hours,\r\n AlertCount,\r\n Tactics\r\n| order by CreatedTime desc\r\n| take 100",
"size": 0,
"title": "Recent Lumen-Enriched Incidents (Top 100)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 1
},
{
"columnMatch": "Title",
"formatter": 1
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "warning",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "info",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "unknown",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "New",
"representation": "pending",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "more",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "CreatedTime",
"formatter": 6
},
{
"columnMatch": "IncidentAge_Hours",
"formatter": 8,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 26,
"options": {
"style": "decimal",
"maximumFractionDigits": 1
}
}
},
{
"columnMatch": "TimeToClose_Hours",
"formatter": 8,
"formatOptions": {
"palette": "green"
},
"numberFormat": {
"unit": 26,
"options": {
"style": "decimal",
"maximumFractionDigits": 1
}
}
},
{
"columnMatch": "AlertCount",
"formatter": 4,
"formatOptions": {
"palette": "blue"
}
},
{
"columnMatch": "Tactics",
"formatter": 1
}
],
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "Incident #"
},
{
"columnId": "IncidentAge_Hours",
"label": "Age (Hours)"
},
{
"columnId": "TimeToClose_Hours",
"label": "Time to Close (Hours)"
},
{
"columnId": "AlertCount",
"label": "Alerts"
}
]
}
},
"name": "Incident Details Table",
"id": "698bf9c9-c7ee-4ad1-bf6b-623aa12027fe"
}
]
},
"conditionalVisibility": {
"parameterName": "TAB",
"comparison": "isEqualTo",
"value": "ValueDashboard"
},
"name": "Value Dashboard",
"id": "a33aa24a-f9f9-455e-98ef-334a4d626feb"
}
],
"isLocked": true,
"fallbackResourceIds": [
"/subscriptions/010b5909-4bf2-4181-a784-74f295aa7cf4/resourcegroups/bll-poc/providers/microsoft.operationalinsights/workspaces/threatfeed"
],
"fromTemplateId": "sentinel-UserWorkbook",
"context": {
"ownerId": "/subscriptions/010b5909-4bf2-4181-a784-74f295aa7cf4/resourcegroups/bll-poc/providers/microsoft.operationalinsights/workspaces/threatfeed"
}
}