{
"version": "Notebook/1.0",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "\r\n"
},
"customWidth": "50",
"name": "text - 1"
},
{
"type": 1,
"content": {
"json": "# Welcome to ReversingLabs for Microsoft Sentinel!\r\n\r\nThank you for activating ReversingLabs' solution for Microsoft Sentinel. In this workbook you will find a summary of the capabilities of ReversingLabs' Microsoft Sentinel content.\r\n\r\nClick the \"More information\" tab to view our offers in the Azure Marketplace."
},
"customWidth": "50",
"name": "welcome",
"styleSettings": {
"padding": "20px",
"showBorder": true
}
}
]
},
"name": "header group"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "e800163c-e34f-4e3a-a131-2376ea998b85",
"version": "KqlParameterItem/1.0",
"name": "guide",
"label": "โGuide",
"type": 10,
"isRequired": true,
"isGlobal": true,
"value": "Yes",
"jsonData": "[\"Yes\", \"No\"]",
"timeContext": {
"durationMs": 86400000
}
},
{
"id": "cc8e1a84-7479-4eb2-aa5a-d95ee81bc962",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"label": "๐๏ธ Subscription",
"type": 6,
"isRequired": true,
"typeSettings": {
"includeAll": true,
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"value": ""
},
{
"id": "1231613d-d734-40da-8baf-c55fdee75df1",
"version": "KqlParameterItem/1.0",
"name": "workspace",
"label": "๐ Workspace",
"type": 5,
"typeSettings": {
"resourceTypeFilter": {
"microsoft.operationalinsights/workspaces": true
}
},
"timeContext": {
"durationMs": 86400000
},
"value": ""
},
{
"id": "46ef1dfe-ea81-413c-a410-1ea67b7e61ab",
"version": "KqlParameterItem/1.0",
"name": "timerange",
"label": "โฑ๏ธ Time Range",
"type": 4,
"isRequired": true,
"isGlobal": true,
"value": {
"durationMs": 86400000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
}
},
{
"id": "3e436b2e-1d8c-43e5-8973-9dbe95d5b4d1",
"version": "KqlParameterItem/1.0",
"name": "rl_feed_check",
"type": 1,
"description": "Grabs list of TI sources and checks for a ReversingLabs feed",
"query": "ThreatIntelIndicatorsv2\r\n| where Tags contains \"ReversingLabs\"\r\n| summarize count()\r\n| extend rl_feed_exists = iff(count_ > 0, \"true\", \"false\")\r\n| project rl_feed_exists",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "c089844b-0cd0-4a36-b056-f21cecc1e340",
"version": "KqlParameterItem/1.0",
"name": "analyst_salary",
"type": 1,
"description": "Used to calculate automation savings in $ amount",
"isGlobal": true,
"query": "print salary = 90000",
"value": "90000",
"isHiddenWhenLocked": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "7b067269-07aa-43aa-8211-df299811d6d4",
"version": "KqlParameterItem/1.0",
"name": "offer",
"type": 1,
"isGlobal": true,
"value": "offer1",
"isHiddenWhenLocked": true
},
{
"id": "d5bd670d-29fe-4ab9-9a17-f152e731ab5e",
"version": "KqlParameterItem/1.0",
"name": "ti_feed_check",
"type": 1,
"description": "Checks if there are any items in the ThreatIntelIndicatorsv2s table in the selected workspace",
"query": "ThreatIntelIndicatorsv2\r\n| where TimeGenerated {timerange}\r\n|take 10\r\n| summarize count()\r\n| extend ti_check = iff(count_ > 0, \"true\", \"false\")\r\n| project ti_check",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "ceca17f7-5260-4d12-99a3-25fe08b2b512",
"version": "KqlParameterItem/1.0",
"name": "ticloud_api_check",
"type": 1,
"query": "// check for RLTiCloudQuotas_CL table\r\n// if sum equals 1, then table doesn't exist\r\n// if sum eqals 2, then connection error exists\r\n// any sum greater than 2 means API is working as expected\r\nlet RLTable = view (){ \r\n RLTiCloudQuotas_CL\r\n | where eventType_s == \"connection_check\"\r\n | summarize arg_max(TimeGenerated, *)\r\n | extend x = iff(RLAPIConnectionStatus_s == \"connected\", 1, 0)\r\n | project x};\r\nlet RLTableErrorCheck = view (){ \r\n RLTiCloudQuotas_CL\r\n | where eventType_s == \"connection_check\"\r\n | summarize arg_max(TimeGenerated, *)\r\n | extend x = iff(RLAPIConnectionStatus_s == \"error\", 1, 0)\r\n | project x\r\n};\r\nlet View_2 = view () { print x=1 };\r\nunion isfuzzy=true\r\n(RLTable | where x > 0),\r\n(RLTableErrorCheck),\r\n(View_2)\r\n| summarize sum(x)\r\n| extend status=case(sum_x > 2, \"error\", sum_x == 2, \"connected\", \"none\")\r\n| project status\r\n",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "9d4d6375-fda6-44e5-900e-ac905bb89422",
"version": "KqlParameterItem/1.0",
"name": "ticloud_api_user",
"type": 1,
"query": "RLTiCloudQuotas_CL\r\n| where eventType_s == \"connection_check\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| project RLAPIUser_s",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 2"
},
{
"type": 1,
"content": {
"json": "# How to use this workbook\r\n\r\nThis workbook is designed to give you a summary of your Microsoft Sentinel workspace. You'll find details about your implementation of the Threat Intelligence feature and your operations within Microsoft Sentinel. \r\n\r\nEnsure that you set the Subscription and Workspace parameters with values associated with your Microsoft Sentinel workspace.\r\n\r\nTo hide all informational messages, change the Guide parameter to \"No\"",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 6"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"tabStyle": "bigger",
"links": [
{
"id": "9f5bb9c2-95a4-4825-9b58-cda448650a8d",
"cellValue": "section",
"linkTarget": "parameter",
"linkLabel": "Threat Intelligence",
"subTarget": "ti",
"preText": "",
"style": "primary"
},
{
"id": "5f16aeff-f8a3-40eb-9101-4cd932beb2ff",
"cellValue": "section",
"linkTarget": "parameter",
"linkLabel": "Operations",
"subTarget": "operations",
"preText": "",
"style": "primary"
},
{
"id": "1d479265-1538-416b-a9ee-5654dc771b01",
"cellValue": "section",
"linkTarget": "parameter",
"linkLabel": "API Usage",
"subTarget": "api_usage",
"style": "link"
},
{
"id": "8e99b95f-7ab5-415c-b31d-5afdb4240e5f",
"cellValue": "section",
"linkTarget": "parameter",
"linkLabel": "More Information",
"subTarget": "info",
"style": "link"
}
]
},
"name": "links - 5"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# ๐ Your Threat Intel Summary\r\n"
},
"name": "text - 0"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Threat Intel Executive Summary"
},
"name": "text - 4"
},
{
"type": 1,
"content": {
"json": "**You could be getting more from your Threat Intelligence feeds!**",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "rl_feed_check",
"comparison": "isEqualTo",
"value": "false"
},
"name": "text - 8"
},
{
"type": 1,
"content": {
"json": "The ReversingLabs Ransomware Intel Feed injects indicators curated specifically to hunt ransomware. Our indicators are harvested from confirmed malware and vetted for accuracy, enhanced with additional intel, and evaluated for activeness. This provides your Microsoft Sentinel deployment with dynamic CTI to hunt ransomware in every stage of the ransomware lifecycle.\r\n\r\n**Unlock the unlimited potential of Microsoft Sentinel with an unmatched high-quality CTI dataset to protect your organization from ransomware**\r\n\r\n- Ransomware Focused Intelligence - Indicators harvested from the +2.5 million confirmed, unique malware files analyzed every day producing a wealth of ransomware-related datasets.\r\n- Focus on the Hunt - All indicators are enriched with metadata from the perceived vulnerability exploitation techniques, eliminating the need for manual technique identification and tagging.\r\n- Lower Alert Fatigue - All indicators are strictly vetted and curated to ensure indicators are not only accurate but active within the last 30 days, eliminating false positives.\r\n- Policy Driven by Intelligence - With indicators harvested from active, confirmed malware these indicators can be pushed to short-term policy with confidence.\r\n\r\n**[Click here to view the ReversingLabs Ransomware Threat Intel Feed in the Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/reversinglabs1597673283347.rw_feed_offer0?tab=Overview)**\r\n\r\n**[Click here for more info on ReversingLabs' Threat Intelligence offerings](https://www.reversinglabs.com/products/file-reputation-service)**"
},
"conditionalVisibility": {
"parameterName": "rl_feed_check",
"comparison": "isEqualTo",
"value": "false"
},
"name": "text - 5"
},
{
"type": 1,
"content": {
"json": "**Thank you for subscribing to the ReversingLabs threat intelligence feed!**",
"style": "success"
},
"conditionalVisibility": {
"parameterName": "rl_feed_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "text - 5 - Copy"
},
{
"type": 1,
"content": {
"json": "Here's how to get the most benefit out of the feed:\r\n\r\n- Enable analytic rules mapping threat intelligence indicators to your data sources\r\n- Deploy playbooks that will automatically enrich your incidents\r\n- Hunt for indicators in your environment"
},
"conditionalVisibility": {
"parameterName": "rl_feed_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "text - 7"
}
]
},
"conditionalVisibility": {
"parameterName": "ti_feed_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "TI Executive Summary",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "Threat intelligence is information about cyber threats (malware, ransomware, etc.) and threat actors that help identify malicious events. This information can be referred to as indicators of compromise (or IoC). It consists of objects such as IP addresses, file hashes, and URLs which can be used to identify an attack. Threat Feeds and Search/Query APIs automate processing, correlation, analysis, and threat status information gathering to enable orchestration to build the foundation of threat informed defense.\r\n\r\n### Indicator quality\r\n\r\nUse this table to check the overall quality of your existing threat intel feeds.\r\n* **Active Indicators**: the total number of active indicators\r\n* **Average Tags**: tags help provide add context indicators\r\n* **Average Age**: stale indicators potentially lead to more false positives\r\n* **Uniqueness Percentage**: this metric shows the percetnage of unique indicators in each of your feeds",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 1",
"styleSettings": {
"padding": "5px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let DomainQuery=view() { \r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(DomainName)\r\n| summarize dcount_=dcount(DomainName) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"DomainEntry\"\r\n};\r\nlet UrlQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(Url)\r\n| summarize dcount_=dcount(Url) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"UrlEntry\"\r\n};\r\nlet FileHashQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(FileHashValue)\r\n| summarize dcount_=dcount(FileHashValue) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"FileHashEntry\"\r\n};\r\nlet IPQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(NetworkIP) or isnotempty(NetworkSourceIP)\r\n| summarize dcount_=dcount(NetworkIP) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"IPEntry\"\r\n};\r\nlet EmailAddressQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSenderAddress)\r\n| summarize dcount_=dcount(EmailSenderAddress) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"EmailAddressEntry\"\r\n};\r\nlet EmailMessageQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSubject)\r\n| summarize dcount_=dcount(EmailSubject) by SourceSystem\r\n| project SourceSystem, dcount_, EntryType=\"EmailMessageEntry\"\r\n};\r\nlet AllIndicators=view(){\r\n DomainQuery\r\n | union UrlQuery\r\n | union FileHashQuery\r\n | union IPQuery\r\n | union EmailAddressQuery\r\n | union EmailMessageQuery\r\n | summarize sum(dcount_) by SourceSystem\r\n | project SourceSystem, sum_dcount_\r\n};\r\nAllIndicators",
"size": 3,
"title": "Summary of TI Sources",
"noDataMessage": "You don't have any TI sources!",
"noDataMessageStyle": 5,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "piechart"
},
"customWidth": "50",
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// get average age of indicators in source\r\nlet AvgAge = ThreatIntelIndicatorsv2 \r\n| extend indicator_age = datetime_diff('day', now(), TimeGenerated)\r\n| summarize round(avg(indicator_age)) by SourceSystem;\r\n// get average number of tags per indicator\r\nlet tagCount = ThreatIntelIndicatorsv2\r\n| extend iocTagCount = iff(isempty(array_length(todynamic(Tags))), 0, array_length(todynamic(Tags)))\r\n| summarize round(avg(iocTagCount)) by SourceSystem;\r\n// uniqueness\r\nlet DomainQuery=view() { \r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(DomainName)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by DomainName\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(DomainName) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"DomainEntry\"\r\n};\r\nlet UrlQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(Url)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by Url\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(Url) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"UrlEntry\"\r\n};\r\nlet FileHashQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(FileHashValue)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by FileHashValue\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(FileHashValue) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"FileHashEntry\"\r\n};\r\nlet IPQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(NetworkIP) or isnotempty(NetworkSourceIP)\r\n| extend IPIndicator = iff(isempty(NetworkIP) == true, NetworkSourceIP, NetworkIP)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IPIndicator, NetworkSourceIP\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(IPIndicator) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"IPEntry\"\r\n};\r\nlet EmailAddressQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(EmailSenderAddress)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSenderAddress\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(EmailSenderAddress) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"EmailAddressEntry\"\r\n};\r\nlet EmailMessageQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n| where isnotempty(EmailSubject)\r\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSubject\r\n| extend SourceSystemArray=array_sort_asc(SourceSystemArray)\r\n| summarize dcount_=dcount(EmailSubject) by tostring(SourceSystemArray)\r\n| project SourceSystemArray, dcount_, EntryType=\"EmailMessageEntry\"\r\n};\r\nlet SingleSourceIndicators=view(){\r\n DomainQuery\r\n | union UrlQuery\r\n | union FileHashQuery\r\n | union IPQuery\r\n | union EmailAddressQuery\r\n | union EmailMessageQuery\r\n | where array_length(todynamic(SourceSystemArray))==1\r\n | summarize sum(dcount_) by SourceSystemArray\r\n | extend counter=1 \r\n};\r\nlet MultipleSourceIndicators=view(){\r\n DomainQuery\r\n | union UrlQuery\r\n | union FileHashQuery\r\n | union IPQuery\r\n | union EmailAddressQuery\r\n | union EmailMessageQuery\r\n | where array_length(todynamic(SourceSystemArray))!=1\r\n | summarize sum(dcount_) by SourceSystemArray\r\n | extend counter=1\r\n};\r\nlet CountOfActiveIndicatorsBySource=view(){\r\n ThreatIntelIndicatorsv2\r\n\t| summarize arg_max(TimeGenerated, *) by IndicatorId, SourceSystem\r\n | where ExpirationDateTime > now() and Active == true\r\n | summarize count() by SourceSystem\r\n | project SourceSystem, count_\r\n | extend IndicatorSource = SourceSystem\r\n};\r\nlet UniquePercentage = view(){\r\n SingleSourceIndicators\r\n | join kind=fullouter MultipleSourceIndicators on counter \r\n | extend uniquetotal=iff(SourceSystemArray1 contains tostring(todynamic(SourceSystemArray)[0]), sum_dcount_1 + sum_dcount_, sum_dcount_)\r\n | where SourceSystemArray1 contains todynamic(SourceSystemArray)[0] \r\n | order by SourceSystemArray\r\n | extend solitary_count=sum_dcount_\r\n | summarize shared_count = sum(sum_dcount_1) by SourceSystemArray, solitary_count\r\n | extend total_count = shared_count + solitary_count\r\n | extend unique_percentage = round(toreal(solitary_count)/toreal(total_count)*100, 1)\r\n | extend IndicatorSource = tostring(todynamic(SourceSystemArray)[0])\r\n | union CountOfActiveIndicatorsBySource\r\n | summarize sum(unique_percentage) by IndicatorSource\r\n | extend sum_unique_percentage = iff(tolong(sum_unique_percentage) == 0, 100, tolong(sum_unique_percentage))\r\n | project IndicatorSource, UniquenessPercentage=sum_unique_percentage\r\n};\r\n// join on total count of indicators per source\r\nThreatIntelIndicatorsv2 \r\n| where Active == true\r\n| summarize dcount(IndicatorId) by SourceSystem\r\n| join AvgAge on SourceSystem\r\n| join tagCount on SourceSystem\r\n| join UniquePercentage on $left.SourceSystem == $right.IndicatorSource\r\n| project [\"Source Feed\"]=SourceSystem, [\"Total Active Indicators\"]=dcount_IndicatorId, [\"Avg. Tags\"]=avg_iocTagCount, [\"Avg. Age\"]=avg_indicator_age, UniquenessPercentage\r\n| sort by [\"Total Active Indicators\"]",
"size": 3,
"showAnalytics": true,
"title": "Indicator Quality",
"timeContextFromParameter": "timerange",
"exportFieldName": "Source Feed",
"exportParameterName": "sourceFeed",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Avg. Tags",
"formatter": 0,
"tooltipFormat": {
"tooltip": "Average count of tags per indicator"
}
},
{
"columnMatch": "Avg. Age",
"formatter": 0,
"tooltipFormat": {
"tooltip": "Average age of an indicator in the source"
}
},
{
"columnMatch": "UniquenessPercentage",
"formatter": 4,
"formatOptions": {
"min": 0,
"max": 100,
"palette": "blue",
"customColumnWidthSetting": "15%"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
},
"tooltipFormat": {
"tooltip": "{0} of indicators are unique to this feed"
}
},
{
"columnMatch": "SourceSystem",
"formatter": 0,
"tooltipFormat": {
"tooltip": "TI Feed"
}
},
{
"columnMatch": "Total Indicators",
"formatter": 0,
"tooltipFormat": {
"tooltip": "Total indicators in the source"
}
}
],
"sortBy": [
{
"itemKey": "$gen_bar_UniquenessPercentage_4",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_bar_UniquenessPercentage_4",
"sortOrder": 2
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "Source",
"formatter": 1
},
"leftContent": {
"columnMatch": "Avg. Age",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "Source",
"formatter": 1
},
"centerContent": {
"columnMatch": "Avg. Age",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "50",
"name": "query - 3"
},
{
"type": 1,
"content": {
"json": "Select a feed from the dropdown and indicator type below to view more details",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 17"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{workspace}"
],
"parameters": [
{
"id": "6a1e142a-62c3-4e27-875e-a01c921f3095",
"version": "KqlParameterItem/1.0",
"name": "sourceFeed",
"label": "Threat Intelligence Feed",
"type": 2,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "ThreatIntelIndicatorsv2\r\n| summarize by SourceSystem\r\n| project SourceSystem",
"crossComponentResources": [
"{workspace}"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange",
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "3031a525-f8dc-48b9-a756-cb70bfcad48f",
"version": "KqlParameterItem/1.0",
"name": "indicatorParam",
"type": 1,
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 16"
},
{
"type": 1,
"content": {
"json": "### Feed indicator summary by type\r\n\r\n"
},
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "text - 15"
},
{
"type": 1,
"content": {
"json": "View a breakdown of your indicators by type below. Clicking on a tile will provide a summary of the indicator type by feed, and trend in newly added indicators over time.",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
{
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "text - 15 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(DomainName)\r\n| summarize dcount_=dcount(DomainName)\r\n| project dcount_, IndicatorType=\"Domain Indicators\", indicatorParam=\"DomainName\"",
"size": 3,
"noDataMessage": "No DomainName indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"exportDefaultValue": "",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Globe",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "query - 9 - Copy - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(Url)\r\n| summarize dcount_=dcount(Url)\r\n| project dcount_, IndicatorType=\"URL Indicators\", indicatorParam=\"Url\"",
"size": 3,
"noDataMessage": "No URL Indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Link",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "query - 9 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(FileHashValue)\r\n| summarize dcount_=dcount(FileHashValue)\r\n| project dcount_, IndicatorType=\"FileHash Indicators\", indicatorParam=\"FileHashValue\"",
"size": 3,
"noDataMessage": "No FileHash indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "File",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true,
"size": "auto"
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "query - 9 - Copy - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(NetworkIP)\r\n| summarize dcount_=dcount(NetworkIP)\r\n| project dcount_, IndicatorType=\"IP Indicators\", indicatorParam=\"NetworkIP\"",
"size": 3,
"noDataMessage": "No IP indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Connect",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "query - 9 - Copy - Copy - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSenderAddress)\r\n| summarize dcount_=dcount(EmailSenderAddress)\r\n| project dcount_, IndicatorType=\"EmailSenderAddress Indicators\", indicatorParam=\"EmailSenderAddress\"",
"size": 3,
"noDataMessage": "No EmailSenderAddress indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Person",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"name": "EmailSenderAddressCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| where SourceSystem in ({sourceFeed})\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSubject)\r\n| summarize dcount_=dcount(EmailSubject)\r\n| project dcount_, IndicatorType=\"EmailSubject Indicators\", indicatorParam=\"EmailSubject\"",
"size": 3,
"noDataMessage": "No EmailSubject indicators found",
"exportFieldName": "indicatorParam",
"exportParameterName": "indicatorParam",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "IndicatorType",
"formatter": 1
},
"leftContent": {
"columnMatch": "dcount_",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Mail",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"customWidth": "16.6",
"conditionalVisibility": {
"parameterName": "sourceFeed",
"comparison": "isNotEqualTo"
},
"showPin": false,
"name": "EmailSubjectCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicatorsv2\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where SourceSystem in ({sourceFeed})\r\n| where isnotempty({indicatorParam})\r\n| make-series Trend = dcount({indicatorParam}) default = 0 on TimeGenerated from ago({timerange:seconds}s) to now() step 1d by SourceSystem\r\n| project-away TimeGenerated\r\n| extend FeedName=SourceSystem\r\n| join kind = inner (ThreatIntelIndicatorsv2\r\n | summarize arg_max(TimeGenerated, *) by IndicatorId\r\n | where isnotempty({indicatorParam})\r\n | summarize dcount_=dcount({indicatorParam}) by SourceSystem\r\n | project FeedName=SourceSystem, dcount_\r\n ) on FeedName\r\n| project FeedName, Total=dcount_, Trend",
"size": 3,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "dcount_",
"formatter": 1
},
{
"columnMatch": "Trend",
"formatter": 10,
"formatOptions": {
"palette": "red"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "indicatorParam",
"comparison": "isNotEqualTo"
},
"name": "query - 17"
}
]
},
"conditionalVisibility": {
"parameterName": "ti_feed_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "TI used",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# You don't have any Threat Intelligence feeds!*\r\n\r\n** Based on query of ThreatIntelIndicatorsv2 table over last 90 days.*",
"style": "error"
},
"name": "text - 0"
},
{
"type": 1,
"content": {
"json": "### What is threat intelligence?\r\nThreat intelligence is information about cyber threats (malware, ransomware, etc.) and threat actors that help identify malicious events. This information can be referred to as indicators of compromise (or IoC). It consists of objects such as IP addresses, file hashes, and URLs which can be used to identify an attack. Threat Feeds and Search/Query APIs automate processing, correlation, analysis, and threat status information gathering to enable orchestration to build the foundation of threat informed defense.\r\n\r\n### Why implement a threat intelligence feed?\r\n\r\n* โ
**Less false positives:** using threat intelligence feeds with high quality, vetted indicators can help you filter out the noise and identify real threats in your environment.\r\n* โ
**Informed incident response:** quality threat intelligence feeds will contextualize indicators with information such as malware family and threat type, which allow defenders to quickly develop well-informed response activities. \r\n* โ
**Competitive advantage:** Organizations that can effectively use threat intelligence to protect themselves from cyber attacks can gain a competitive advantage in their industry.\r\n\r\n### Resources to learn how to get started with threat intelligence in Microsoft Sentinel:\r\n* [Understand threat intelligence in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence?WT.mc_id=Portal-fx#adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence---taxii-data-connector)\r\n* [Connect Microsoft Sentinel to STIX/TAXII threat intelligence feeds](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence-taxii)\r\n* [ReversingLabs - Explainable Threat Intelligence Overview (YouTube)](https://www.youtube.com/watch?v=s0N5oWxZdh4)\r\n* [ReversingLabs - How to evaluate threat intelligence feeds (eBook)](https://www.reversinglabs.com/ebook/how-to-evaluate-threat-intelligence-feeds)"
},
"name": "text - 1"
},
{
"type": 1,
"content": {
"json": "## See what you're misssing:\r\n\r\nThe tiles below show the total count of common IoC entity types based on the {timerange:label} of security incidents in your Microsoft Sentinel environment."
},
"name": "text - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join (\r\n SecurityAlert\r\n) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| extend entityType = tostring(Entities.Type)\r\n| where entityType in (\"file\", \"url\", \"ip\", \"filehash\")\r\n| summarize count() by entityType, IncidentNumber\r\n| summarize count() by entityType",
"size": 3,
"title": "Incidents created with associated entity type",
"timeContextFromParameter": "timerange",
"exportFieldName": "entityType",
"exportParameterName": "entity_type",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "entityType",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "file",
"representation": "File",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "url",
"representation": "Globe",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "ip",
"representation": "Connect",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "filehash",
"representation": "Capture",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "Blank",
"text": "{0}{1}"
}
]
}
},
"leftContent": {
"columnMatch": "count_",
"formatter": 12,
"formatOptions": {
"palette": "none"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"name": "query - 6"
},
{
"type": 1,
"content": {
"json": "Set your acceptable false positive ratio percentage here, using a value from 0-100. 20% is used by default.",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 9"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "d1eac740-562b-4d7c-92f5-57980a14e90b",
"version": "KqlParameterItem/1.0",
"name": "threshold",
"label": "Threshold",
"type": 1,
"timeContext": {
"durationMs": 86400000
},
"value": "20"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 8"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "05dec1f5-0230-48bb-a1c8-63c76dffd536",
"version": "KqlParameterItem/1.0",
"name": "fpthreshold",
"type": 1,
"query": "let fpcount = SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join (\r\n SecurityAlert\r\n) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where tostring(Entities.Type) in (\"ip\", \"file\", \"url\", \"filehash\")\r\n| where Status == \"Closed\"\r\n| where Classification == \"FalsePositive\" or Classification == \"Undetermined\"\r\n| distinct IncidentNumber, Classification, tostring(Entities.Type)\r\n| summarize count() by IncidentNumber, Entities_Type\r\n| summarize FalsePositiveCount=count()\r\n| extend joiner = 1;\r\nlet tpcount = SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join (\r\n SecurityAlert\r\n) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where tostring(Entities.Type) in (\"ip\", \"file\", \"url\", \"filehash\")\r\n| where Status == \"Closed\"\r\n| where Classification == \"TruePositive\"\r\n| distinct IncidentNumber, Classification, tostring(Entities.Type)\r\n| summarize count() by IncidentNumber, Entities_Type\r\n| summarize TruePositiveCount=count()\r\n| extend joiner = 1;\r\nfpcount\r\n| join tpcount on joiner\r\n| extend totalCount = FalsePositiveCount + TruePositiveCount\r\n| extend ratio=(todouble(FalsePositiveCount) / todouble(totalCount))\r\n| project totalCount, ratio\r\n| extend fpthreshold = case(ratio > {threshold}.0 / 100.0, \"true\", isnan(ratio) == true, \"none\", \"false\")\r\n| project fpthreshold",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let fpcount = SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join (\r\n SecurityAlert\r\n) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Status == \"Closed\"\r\n| where Classification == \"FalsePositive\" or Classification == \"Undetermined\"\r\n| where tostring(Entities.Type) != \"\"\r\n| distinct IncidentNumber, Classification, tostring(Entities.Type)\r\n| summarize count() by IncidentNumber, Entities_Type\r\n| summarize FalsePositiveCount=count() by Entities_Type\r\n| extend joiner = 1;\r\nlet tpcount = SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertId = tostring(AlertIds)\r\n| join (\r\n SecurityAlert\r\n) on $left.AlertId == $right.SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Status == \"Closed\"\r\n| where Classification == \"TruePositive\"\r\n| where tostring(Entities.Type) != \"\"\r\n| distinct IncidentNumber, Classification, tostring(Entities.Type)\r\n| summarize count() by IncidentNumber, Entities_Type\r\n| summarize TruePositiveCount=count() by Entities_Type\r\n| extend joiner = 1;\r\nfpcount\r\n| join tpcount on joiner\r\n| extend totalCount = FalsePositiveCount + TruePositiveCount\r\n| extend ratio=(todouble(FalsePositiveCount) / todouble(totalCount))\r\n| project ratio, Entities_Type1\r\n| extend fpthreshold = iff(ratio > 0.2, true, false)",
"size": 3,
"title": "False positive % of total closed incidents with given entitiy type",
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Entities_Type1",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "file",
"representation": "File",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "url",
"representation": "Globe",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "ip",
"representation": "Connect",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "filehash",
"representation": "Capture",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "Blank",
"text": "{0}{1}"
}
]
}
},
"leftContent": {
"columnMatch": "ratio",
"formatter": 12,
"formatOptions": {
"palette": "none"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "percent",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"showBorder": true
}
},
"name": "query - 6 - Copy"
},
{
"type": 1,
"content": {
"json": "## The percentage of false positives in the {timerange:label} is greater than {threshold}%!\r\n\r\nThe precentage of all incidents seen in your environment that also have typical entity types found in threat intelligence feeds is high. Consider implementing a threat intelligence feed to augment your existing detections and reduce the volume of false positives.",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "fpthreshold",
"comparison": "isEqualTo",
"value": "true"
},
"name": "text - 6"
},
{
"type": 1,
"content": {
"json": "## Nice work! The percentage of false positives seen in the {timerange:label} is lower than {threshold}%!\r\n\r\nYou can still benefit from the addition of a threat intelligence feed. Check the \"More Information\" tab to learn more.",
"style": "success"
},
"conditionalVisibility": {
"parameterName": "fpthreshold",
"comparison": "isEqualTo",
"value": "false"
},
"name": "text - 6 - Copy"
}
]
},
"conditionalVisibility": {
"parameterName": "ti_feed_check",
"comparison": "isEqualTo",
"value": "false"
},
"name": "TI unused",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Incidents created from Threat Intelligence indicators"
},
"name": "text - 2"
},
{
"type": 1,
"content": {
"json": "Use this section to see how your threat intelligence feeds impact your Microsoft Sentinel incidents.\r\n\r\n* Incidents created from TI indicators by severity - a summary of incidents created from a threat intelligence indicator by severity\r\n* Closed incident classifications by TI feed - view a breakdown of closing classifications (True Positive, Benign Positive, False Positive, Undetermined) by each feed.",
"style": "info"
},
"name": "text - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let AlertIDs = SecurityAlert\r\n| extend Query_ = tostring(parse_json(ExtendedProperties).Query)\r\n| extend OriginalQuery_ = tostring(parse_json(ExtendedProperties).OriginalQuery)\r\n| where Query_ contains \"ThreatIntel\" or OriginalQuery_ contains \"ThreatIntel\"\r\n| project TimeGenerated, SystemAlertId;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertIds = tostring(AlertIds)\r\n| join AlertIDs on $left.AlertIds == $right.SystemAlertId\r\n| summarize dcount(IncidentName) by Severity\r\n\r\n",
"size": 3,
"title": "Incidents created from TI indicators by severity",
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "piechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Medium",
"color": "orange"
},
{
"seriesName": "High",
"color": "redBright"
},
{
"seriesName": "Low",
"color": "blue"
}
]
}
},
"customWidth": "50",
"name": "query - 7"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let ioclookback = 30d;\r\nlet DomainQuery=view() { \r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(DomainName)\r\n| extend IndicatorValue=DomainName\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, Tags\r\n};\r\nlet UrlQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(Url)\r\n| extend IndicatorValue=Url\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, Tags\r\n};\r\nlet FileHashQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(FileHashValue)\r\n| extend IndicatorValue=FileHashValue\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, Tags\r\n};\r\nlet IPQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(NetworkIP) or isnotempty(NetworkSourceIP)\r\n| extend IndicatorValue=NetworkIP\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, NetworkSourceIP, Tags\r\n};\r\nlet EmailAddressQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSenderAddress)\r\n| extend IndicatorValue=EmailSenderAddress\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, Tags\r\n};\r\nlet EmailMessageQuery=view(){\r\nThreatIntelIndicatorsv2\r\n| where TimeGenerated > ago(ioclookback)\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| where isnotempty(EmailSubject)\r\n| extend IndicatorValue=EmailSubject\r\n| summarize SourceSystemArray=make_set(SourceSystem) by IndicatorValue, Tags\r\n};\r\nlet AllIndicators=view(){\r\n DomainQuery\r\n | union UrlQuery\r\n | union FileHashQuery\r\n | union IPQuery\r\n | union EmailAddressQuery\r\n | union EmailMessageQuery\r\n};\r\n// get alert IDs and entities where the alert query contains the ThreatIntelIndicatorsv2 table\r\nlet AlertIDs = SecurityAlert\r\n| where TimeGenerated {timerange}\r\n| extend Query_ = tostring(parse_json(ExtendedProperties).Query)\r\n| extend OriginalQuery_ = tostring(parse_json(ExtendedProperties).OriginalQuery)\r\n| where Query_ contains \"ThreatIntelIndicatorsv2\" or OriginalQuery_ contains \"ThreatIntelIndicatorsv2\"\r\n| project TimeGenerated, SystemAlertId, Entities;\r\n// query incidents that match AlertIDs value\r\nSecurityIncident\r\n| where TimeGenerated {timerange}\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertIds = tostring(AlertIds)\r\n| join AlertIDs on $left.AlertIds == $right.SystemAlertId\r\n| extend entity = parse_json(Entities)[0]\r\n| extend IndicatorValue = case(\r\n entity.Value!=\"\", tostring(entity.Value),\r\n entity.Address!=\"\", tostring(entity.Address),\r\n entity.Url!=\"\", tostring(entity.Url),\r\n entity.DomainName!=\"\", tostring(entity.DomainName),\r\n \"\")\r\n| where Status == \"Closed\"\r\n| join kind=inner AllIndicators on $left.IndicatorValue == $right.IndicatorValue\r\n| summarize dcount(IncidentName) by Status, Classification, tostring(SourceSystemArray)\r\n| project [\"Incidents closed\"]=dcount_IncidentName, Classification, FeedName=SourceSystemArray",
"size": 3,
"title": "Closed incident classifications by TI feed",
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Classification",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "TruePositive",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "FalsePositive",
"representation": "Noisy",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Undetermined",
"representation": "question",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "BenignPositive",
"representation": "warning",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "Blank",
"text": "{0}{1}"
}
],
"compositeBarSettings": {
"labelText": "",
"columnSettings": [
{
"columnName": "Classification",
"color": "blue"
}
]
}
}
}
]
},
"chartSettings": {
"showLegend": true
}
},
"customWidth": "50",
"name": "query - 8"
}
]
},
"conditionalVisibility": {
"parameterName": "ti_feed_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "TI incident summary",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibility": {
"parameterName": "section",
"comparison": "isEqualTo",
"value": "ti"
},
"name": "ti summary"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 1,
"content": {
"json": "# ๐ Your Operations Summary"
},
"name": "text - 0"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Operations Executive Summary"
},
"name": "text - 4"
},
{
"type": 1,
"content": {
"json": "Resolution of alerts with the help of actionable threat intelligence can improve the speed and accuracy of triage. Below you will find a summary of your environment's incidents and how a ReversingLabs Threat Intel feed combined with the ReversingLabs solution for Microsoft Sentinel can help take your operations to the next level.\r\n\r\n### Summary of incidents\r\nThis line chart provides a summary of all incidents created over the selected time range, and how many of those incidents where created from Threat Intelligence indicators.\r\n\r\n\r\n### Operational efficiency summary\r\nSee how playbooks from ReversingLabs impact your operational efficiency:\r\n\r\n* **No Enrichment**: incidents that have not had any enrichment \r\n* **Enriched**: incidents that have been enriched with automation\r\n* **Auto-triaged**: incidents that have been automatically worked via automation",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let AlertIDs = SecurityAlert\r\n| extend Query_ = tostring(parse_json(ExtendedProperties).Query)\r\n| extend OriginalQuery_ = tostring(parse_json(ExtendedProperties).OriginalQuery)\r\n| where Query_ contains \"ThreatIntelIndicatorsv2\" or OriginalQuery_ contains \"ThreatIntelIndicatorsv2\"\r\n| project TimeGenerated, SystemAlertId;\r\nlet TIIncidents = SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| extend AlertIds = tostring(AlertIds)\r\n| join AlertIDs on $left.AlertIds == $right.SystemAlertId\r\n| summarize dcount(IncidentName) by bin(TimeGenerated, 1d)\r\n| extend [\"Number of incidents\"] = dcount_IncidentName\r\n| extend label = \"TI\"\r\n| project TimeGenerated, [\"Number of incidents\"], label;\r\nSecurityIncident\r\n| summarize arg_min(TimeGenerated, *) by IncidentName\r\n| summarize count() by bin(TimeGenerated, 1d)\r\n| project TimeGenerated, [\"Number of incidents\"]=count_\r\n| extend label = \"All\"\r\n| union TIIncidents",
"size": 1,
"title": "Summary of Incidents",
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "linechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "TI",
"color": "redBright"
}
]
}
},
"customWidth": "50",
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// find all incidents that had a comment with a ReversingLabs playbook\r\nlet RLEnrichedIncidents = SecurityIncident\r\n| mv-expand Comments\r\n| extend CommenterName = tostring(parse_json(tostring(Comments.author)).name)\r\n| where CommenterName contains \"Comment created from playbook - ReversingLabs\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize count()\r\n| extend type = \"Enriched by ReversingLabs\";\r\n// find incidents that had a playbook comment, non RL\r\nlet enrichedIncidents = SecurityIncident\r\n| mv-expand Comments\r\n| extend CommenterName = tostring(parse_json(tostring(Comments.author)).name)\r\n| where CommenterName == \"Comment created from playbook\"\r\n| where CommenterName !contains \"ReversingLabs\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize count()\r\n| extend type = \"Enriched\";\r\n// find all incidents closed by a playbook\r\nlet autoTriage = SecurityIncident\r\n| where Status == \"Closed\"\r\n| summarize arg_min(TimeGenerated, *) by IncidentName\r\n| where ModifiedBy contains \"Playbook - \"\r\n| summarize count()\r\n| extend type = \"Auto-triaged\";\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| where Comments !contains \"Comment created from playbook\"\r\n| summarize count()\r\n| extend type = \"No Enrichment\"\r\n| union RLEnrichedIncidents, enrichedIncidents, autoTriage\r\n| project Type=type, [\"Total\"]=count_",
"size": 3,
"title": "Operational Efficiency Summary",
"noDataMessage": "None of your incidents are currently being enriched!",
"noDataMessageStyle": 5,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "piechart",
"gridSettings": {
"sortBy": [
{
"itemKey": "Type",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "Type",
"sortOrder": 2
}
]
},
"customWidth": "50",
"name": "query - 3"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Time and Cost analysis"
},
"name": "text - 3"
},
{
"type": 1,
"content": {
"json": "The following data is based on average time spent performing manual enrichment lookups compared to a default SOC analyst salary of $90,000 USD defined in the analyst_salary parameter.\r\n\r\n* Time saved - the amount of time saved on performing lookups when using a ReversingLabs playbook\r\n* Current cost savings - based on incidents that have been enriched by a ReversingLabs playbook, this is the amount of money you've saved\r\n* Estimated potential cost savings - this is the amount of money you could be saving when performing enrichment lookups on incidents\r\n\r\n**NOTE:** if you modified any ReversingLabs playbook names from the default value during solution deployment, you will need to update the KQL query for each tile below.\r\n",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// average time to manually perform a lookup ~2 minutes\r\nlet avg_lookup_time = 120;\r\nlet avg_playbook_time = 10;\r\nSecurityIncident\r\n| extend CommenterName = tostring(parse_json(tostring(Comments[0].author)).name)\r\n| where CommenterName == \"Comment created from playbook - ReversingLabs-EnrichFileHash\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize count()\r\n| extend manual_time = count_ * avg_lookup_time\r\n| extend auto_time = count_ * avg_playbook_time\r\n| extend time_saved = manual_time - auto_time\r\n| project time_saved\r\n| extend title = \"Time saved\"",
"size": 3,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "title",
"formatter": 1
},
"leftContent": {
"columnMatch": "time_saved",
"formatter": 1,
"numberFormat": {
"unit": 24,
"options": {
"style": "decimal",
"maximumFractionDigits": 0
}
}
},
"showBorder": true
}
},
"customWidth": "33",
"name": "query - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// average time to manually perform a lookup ~2 minutes\r\nlet avg_lookup_time = 120;\r\n// salary in $ per hour assuming 2080 work hours in a year\r\nlet salary_per_second = round(todecimal({analyst_salary}/2080)/60/60, 5);\r\nSecurityIncident\r\n| extend CommenterName = tostring(parse_json(tostring(Comments[0].author)).name)\r\n| where CommenterName == \"Comment created from playbook - ReversingLabs-EnrichFileHash\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize count()\r\n| extend cost = (salary_per_second) * (avg_lookup_time * count_)\r\n| project cost, title=\"Current cost savings\"",
"size": 3,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "title",
"formatter": 1
},
"leftContent": {
"columnMatch": "cost",
"formatter": 1,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"useGrouping": true
}
},
"tooltipFormat": {
"tooltip": "Assuming average lookup time of 15 seconds"
}
},
"showBorder": true
}
},
"customWidth": "33",
"name": "query - 10"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// average time to perform a manual lookup ~2 minutes\r\nlet avg_lookup_time = 120;\r\n// salary in $ per hour assuming 2080 work hours in a year\r\nlet salary_per_second = round(todecimal({analyst_salary}/2080)/60/60, 2);\r\nSecurityIncident\r\n| extend CommenterName = tostring(parse_json(tostring(Comments[0].author)).name)\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| where CommenterName != \"Comment created from playbook - ReversingLabs-EnrichFileHash\"\r\n| summarize count()\r\n| extend cost = (salary_per_second) * (avg_lookup_time * count_)\r\n| project cost, title=\"Estimated potential cost savings\"",
"size": 3,
"timeContextFromParameter": "timerange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "title",
"formatter": 1
},
"leftContent": {
"columnMatch": "cost",
"formatter": 1,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"useGrouping": true
}
},
"tooltipFormat": {
"tooltip": "Assuming average lookup time of 15 seconds"
}
},
"showBorder": true,
"size": "auto"
}
},
"customWidth": "33",
"name": "query - 10 - Copy"
}
]
},
"name": "Ops - Costs"
}
]
},
"name": "Operations Executive Summary",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibility": {
"parameterName": "section",
"comparison": "isEqualTo",
"value": "operations"
},
"name": "operations"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 1,
"content": {
"json": "# More Information\r\n\r\nCheck out our offerings in the Azure Marketplace! Select an option using the buttons on the right.",
"style": "info"
},
"customWidth": "50",
"conditionalVisibilities": [
{
"parameterName": "offer",
"comparison": "isEqualTo"
},
{
"parameterName": "section",
"comparison": "isEqualTo",
"value": "info"
}
],
"name": "text - 7"
},
{
"type": 1,
"content": {
"json": "# Reversinglabs Ransomware Intel Feed\r\n\r\n```\r\nI AM RANSOMWARE\r\n\r\nI came in through your redacted and \r\nI have already communicated to my team that I'm in... \r\nnow I wait.\r\nIt could be a day, it could be a month, \r\nbut I am waiting for the moment when we're positioned \r\nfor mass effect. \r\nThe only thing that can stop what's happening is \r\nif one of my copies gets busted and gives up its code \r\nand my indicators get put into a list to watch out for.\r\n\r\nNot worried about that, ain't too many creating that kind of info...\r\n```\r\n\r\n## Threat Actor Overview\r\n\r\nThreat actors have significantly increased the complexity of their operations to the point where they're run like a business to ensure efforts are coordinated and efficient. They work tirelessly to create malicious code that hides in plain site and avoids modern detection methods and they're not going to initiate the final phase of attack until they're positioned to maximize their effectiveness.\r\nThis provides you with precious time that can be used to seek, identify, and remove ransomware waiting to be detonated.\r\n\r\n## Solution Overview\r\n\r\nEnter ReversingLabs Ransomware Intel Feed for the Microsoft Sentinel TAXII data connector that injects indicators **curated specifically to hunt ransomware** into your Threat Intelligence blade. Our indicators are harvested from confirmed malware and vetted for accuracy, enhanced with additional intel, and evaluated for activeness. This provides your Microsoft Sentinel deployment with dynamic CTI to hunt ransomware in every stage of the ransomware lifecycle.\r\n\r\n**Unlock the unlimited potential of Microsoft Sentinel with an unmatched high-quality CTI dataset to protect your organization from ransomware**\r\n* Ransomware Focused Intelligence - Indicators harvested from the +2.5 million confirmed, unique malware files analyzed every day producing a wealth of ransomware-related datasets.\r\n* Focus on the Hunt - All indicators are enriched with metadata from the perceived vulnerability exploitation techniques, eliminating the need for manual technique identification and tagging.\r\n* Lower Alert Fatigue - All indicators are strictly vetted and curated to ensure indicators are not only accurate but active within the last 30 days, eliminating false positives.\r\n* Policy Driven by Intelligence - With indicators harvested from active, confirmed malware these indicators can be pushed to short-term policy with confidence.\r\n\r\n### View the ReversingLabs Ransomware Intel Feed in the Azure Marketplace here: [LINK](https://azuremarketplace.microsoft.com/marketplace/apps/reversinglabs1597673283347.rw_feed_offer0?tab=Overview)",
"style": "info"
},
"customWidth": "50",
"conditionalVisibilities": [
{
"parameterName": "offer",
"comparison": "isEqualTo",
"value": "offer1"
},
{
"parameterName": "section",
"comparison": "isEqualTo",
"value": "info"
}
],
"name": "text - 0"
},
{
"type": 1,
"content": {
"json": "# TitaniumCloud API\r\n\r\nTitaniumCloud is a threat intelligence solution providing up-to-date file reputation services, threat classification and rich context on over 10 billion goodware and malware files. Files are processed using ReversingLabs [File Decomposition Technology](https://www.reversinglabs.com/technology/active-file-decomposition). A powerful set of REST API query and feed functions deliver targeted file and malware intelligence for threat identification, analysis, intelligence development, and threat hunting services.\r\n\r\n\r\n## OVERVIEW\r\n\r\nTitaniumCloud Reputation Services are powerful threat intelligence solutions with up-to-date, threat classification and rich context on over 10 billion goodware and malware files. ReversingLabs does not depend on crowd-sourced collection, but instead curates the harvesting of files from software vendors and diverse malware sources. All files are processed using unique ReversingLabs File Decomposition Technology, combined with other dynamic and detection information, to provide industry reputation consensus. TitaniumCloud supports a powerful set of REST API query and feed functions that deliver targeted file and malware intelligence for threat identification, analysis, intelligence development, and hunting.\r\n\r\n## Global File Reputation\r\n\r\nTitaniumCloud continually processes goodware and malware files providing early intelligence about attacks before they infiltrate customer infrastructures. This visibility to threats โin-the-wildโ enables preparation for new attacks and quickly identifies the threat levels of new files as they arrive. TitaniumCloud enables more effective and efficient file analysis, development of better threat intelligence, and implementation of proactive threat hunting programs.\r\n\r\n## Contact us to learn more about TitaniumCloud: [LINK](https://www.reversinglabs.com/contact-us)",
"style": "info"
},
"customWidth": "50",
"conditionalVisibilities": [
{
"parameterName": "offer",
"comparison": "isEqualTo",
"value": "offer2"
},
{
"parameterName": "section",
"comparison": "isEqualTo",
"value": "info"
}
],
"name": "text - 0 - Copy"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "7a3bd117-b6a5-47c4-aae1-dd22dbae0116",
"cellValue": "offer",
"linkTarget": "parameter",
"linkLabel": "Ransomware Intel Feed",
"subTarget": "offer1",
"style": "primary"
},
{
"id": "6eaf2743-0db8-495f-95a1-cad9a980d3d9",
"cellValue": "offer",
"linkTarget": "parameter",
"linkLabel": "TitaniumCloud API",
"subTarget": "offer2",
"style": "primary"
}
]
},
"customWidth": "50",
"name": "links - 0"
}
],
"exportParameters": true
},
"conditionalVisibility": {
"parameterName": "section",
"comparison": "isEqualTo",
"value": "info"
},
"name": "moreinfo"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# โ๏ธ TitaniumCloud API Usage"
},
"name": "text - 0"
},
{
"type": 1,
"content": {
"json": "Use this tab to monitor your TitaniumCloud API usage. To check your current usage, click the \"Check quotas\" button below and refresh the page.",
"style": "info"
},
"name": "text - 6"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "b9059e5f-55bb-4e6d-9745-f7fe6497824d",
"linkTarget": "ArmAction",
"linkLabel": "โ
Check quotas",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "",
"httpMethod": "POST",
"title": "Check quota",
"description": "# โ
Check ReversingLabs TitaniumCloud API quotas\n\n## This action will execute a Logic App that will make calls to the TitaniumCloud TCA-9999 Quota API. The results will be loaded into your log analytics workspace under the RLTiCloudQuotas_CL table.\n\n# โ ๏ธ Please refresh the workbook after running this action to view updated data.",
"actionName": "Check RL TiCloud API Quotas"
}
}
]
},
"customWidth": "50",
"name": "links - 4",
"styleSettings": {
"padding": "0px"
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Quotas last checked",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "582ef114-793e-4bcf-8aed-62386f9cdabf",
"version": "KqlParameterItem/1.0",
"name": "outdated_check",
"type": 1,
"query": "RLTiCloudQuotas_CL\r\n| summarize arg_max(TimeGenerated, *)\r\n| extend timediff = datetime_diff('hour', TimeGenerated, now())\r\n| extend outdated = iff(timediff <= -1, \"true\", \"false\")\r\n| project outdated",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 3"
},
{
"type": 1,
"content": {
"json": "### Outdated Information\r\nIt has been over an hour since quotas were last checked. We recommend clicking the \"check quotas\" button to get the latest usage information.",
"style": "warning"
},
"conditionalVisibility": {
"parameterName": "outdated_check",
"comparison": "isEqualTo",
"value": "true"
},
"name": "text - 4"
},
{
"type": 1,
"content": {
"json": "### API Connection Error\r\nThere was an error during the most recent check for your API usage. Please check that your license is active and that you have configured the playbooks correctly.",
"style": "error"
},
"conditionalVisibility": {
"parameterName": "ticloud_api_check",
"comparison": "isEqualTo",
"value": "error"
},
"name": "text - 4 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "RLTiCloudQuotas_CL\r\n| summarize arg_max(TimeGenerated, *)\r\n| project TimeGenerated, Title=\"Quotas last checked\"\r\n| extend TimeGenerated = format_datetime(TimeGenerated, 'yyyy-MM-dd HH:mm:ss')",
"size": 3,
"title": "Timestamp",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"formatter": 1
},
"leftContent": {
"columnMatch": "TimeGenerated",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"showBorder": true,
"size": "auto"
}
},
"customWidth": "33",
"name": "query - 5",
"styleSettings": {
"margin": "0px",
"padding": "0px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "RLTiCloudQuotas_CL\r\n| where eventType_s == \"connection_check\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| extend errorMessage = \"\"\r\n| extend errorMessage = column_ifexists(\"errorMessage_s\", errorMessage)\r\n| extend finalErrorMessage = strcat(\"Response code: \", errorMessage)",
"size": 3,
"title": "Connection status",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"formatter": 1
},
"leftContent": {
"columnMatch": "RLAPIConnectionStatus_s",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "connected",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "error",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"representation": "success",
"text": "{0}{1}"
}
]
}
},
"secondaryContent": {
"columnMatch": "finalErrorMessage",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Response code: ",
"representation": "green",
"text": ""
},
{
"operator": "!=",
"thresholdValue": "Response code: 401",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": "Default",
"text": "{0}{1}"
}
]
}
},
"showBorder": true,
"size": "auto"
}
},
"customWidth": "33",
"name": "query - 5",
"styleSettings": {
"margin": "0px",
"padding": "0px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "RLTiCloudQuotas_CL\r\n| where eventType_s == \"connection_check\"\r\n| summarize arg_max(TimeGenerated, *)",
"size": 3,
"title": "API user",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"formatter": 1
},
"leftContent": {
"columnMatch": "RLAPIUser_s",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"representation": "Person",
"text": "{0}{1}"
}
]
}
},
"showBorder": true,
"size": "auto"
}
},
"customWidth": "33",
"name": "query - 5 - Copy",
"styleSettings": {
"margin": "0px",
"padding": "0px"
}
}
]
},
"name": "group - api - check quotas"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let userDailyUsage = RLTiCloudQuotas_CL\r\n| where TimeGenerated > startofday(now())\r\n| where eventType_s == \"user_daily_usage\"\r\n| summarize arg_max(TimeGenerated, *) by product_s\r\n| project product_s, numberOfQueries_d;\r\nRLTiCloudQuotas_CL\r\n| where TimeGenerated > startofday(now())\r\n| where eventType_s == \"company_quota_limits\"\r\n| where limit_type_s == \"daily\"\r\n| where users_s contains \"{ticloud_api_user}\"\r\n| summarize arg_max(TimeGenerated, *) by products_s\r\n| extend products = todynamic(products_s)\r\n| mv-expand products\r\n| project TimeGenerated, tostring(products), [\"Limit Type\"]=limit_type_s, [\"Limit Exceeded\"]=limit_exceeded_s, [\"Limit\"]=limit_d, [\"Users\"]=users_s\r\n| join userDailyUsage on $left.products == $right.product_s\r\n| project TimeGenerated, products, [\"Limit Type\"]= strcat(\"Limit type: \", [\"Limit Type\"]), [\"Limit Exceeded\"], [\"# of queries used\"]=numberOfQueries_d, [\"Limit\"], [\"Users\"]\r\n| extend percentUsed = ([\"# of queries used\"]/Limit)\r\n| extend fullDetails = strcat(split(tostring([\"# of queries used\"]), \".\")[0], \" / \", split(tostring(Limit), \".\")[0])\r\n",
"size": 3,
"title": "Summary of Daily Limit API usage",
"noDataMessage": "No API usage found for today.",
"noDataMessageStyle": 3,
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "products",
"formatter": 1
},
"leftContent": {
"columnMatch": "fullDetails",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 1,
"palette": "greenRed",
"compositeBarSettings": {
"labelText": "",
"columnSettings": [
{
"columnName": "percentUsed",
"color": "lightBlue"
}
]
}
},
"numberFormat": {
"unit": 17,
"options": {
"style": "percent",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "percentUsed",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">=",
"thresholdValue": "0.9",
"representation": "red",
"text": "{0}{1}"
},
{
"operator": ">=",
"thresholdValue": "0.75",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": ">=",
"thresholdValue": "0.5",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "<=",
"thresholdValue": "0",
"representation": "green",
"text": "{0}{1}"
},
{
"operator": "Default",
"text": "{0}{1}"
}
],
"compositeBarSettings": {
"labelText": ""
}
},
"numberFormat": {
"unit": 0,
"options": {
"style": "percent"
}
}
},
"secondaryContent": {
"columnMatch": "Limit Exceeded",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "true",
"representation": "3",
"text": "Limit Reached"
},
{
"operator": "Default",
"text": ""
}
]
}
},
"showBorder": true,
"size": "auto"
}
},
"name": "query - 5"
},
{
"type": 1,
"content": {
"json": "The metrics below represent the combined TitaniumCloud API usage for all users tied to your organization.",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "guide",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "RLTiCloudQuotas_CL\r\n| where TimeGenerated > startofmonth(now())\r\n| where eventType_s == \"company_monthly_usage\"\r\n| summarize arg_max(TimeGenerated, *) by eventType_s, product_s\r\n| where product_s != \"TCA-9999\"\r\n| project TimeGenerated, product_s, numberOfQueries_d, month_s\r\n| order by numberOfQueries_d",
"size": 3,
"title": "Current Monthly Usage",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart",
"gridSettings": {
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
],
"tileSettings": {
"titleContent": {
"columnMatch": "product_s",
"formatter": 1
},
"leftContent": {
"columnMatch": "numberOfQueries_d",
"formatter": 12,
"formatOptions": {
"palette": "redBright"
}
},
"showBorder": false,
"size": "full"
},
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "product_s",
"formatter": 12,
"formatOptions": {
"palette": "blue"
}
},
"centerContent": {
"columnMatch": "numberOfQueries_d",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
},
"nodeIdField": "product_s",
"graphOrientation": 3,
"showOrientationToggles": false,
"staticNodeSize": 150,
"colorSettings": {
"nodeColorField": "numberOfQueries_d",
"type": 4,
"heatmapPalette": "red",
"emptyValueColor": "redDark"
},
"hivesMargin": 5
},
"chartSettings": {
"xAxis": "month_s"
}
},
"customWidth": "50",
"name": "query - 1",
"styleSettings": {
"showBorder": true
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "RLTiCloudQuotas_CL\r\n| where eventType_s == \"company_daily_usage\"\r\n| summarize arg_max(TimeGenerated, *) by date_s, product_s\r\n| where product_s != \"TCA-9999\"\r\n| project TimeGenerated, product_s, numberOfQueries_d, date_s\r\n| extend Date=todatetime(date_s)",
"size": 0,
"title": "Daily Usage - Last 30 days",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "barchart",
"gridSettings": {
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "product_s",
"formatter": 1
},
"leftContent": {
"columnMatch": "numberOfQueries_d",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"xAxis": "Date",
"showLegend": true
}
},
"customWidth": "50",
"name": "query - 1 - Copy",
"styleSettings": {
"showBorder": true
}
}
]
},
"name": "group - api_metrics",
"styleSettings": {
"padding": "10px",
"showBorder": true
}
}
]
},
"conditionalVisibilities": [
{
"parameterName": "section",
"comparison": "isEqualTo",
"value": "api_usage"
},
{
"parameterName": "ticloud_api_check",
"comparison": "isNotEqualTo",
"value": "none"
}
],
"name": "group - api"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "# โ๏ธ TitaniumCloud API Usage"
},
"name": "text - 0"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "You don't appear to be using any TitaniumCloud APIs! ",
"style": "warning"
},
"name": "text - 6"
},
{
"type": 1,
"content": {
"json": "## First time setup\r\nEnsure that you have deployed the ReversingLabs-CheckQuota playbook. Next, enter the workbook advanced editor, then search for ```armActionContext```. In the ```path``` value, paste the ARM path of the ReversingLabs-CheckQuota playbook. There should be two (2) of these values that you will need to update.\r\n\r\nExample: ```\"path\": \"/subscriptions//resourceGroups//providers/Microsoft.Logic/workflows/ReversingLabs-CheckQuota/triggers/manual/run?api-version=2016-06-01\"```\r\n\r\n\r\nOnce the above is completed, click the \"Check quotas\" button below and refresh the workbook after a few minutes.",
"style": "info"
},
"name": "text - 2"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "b9059e5f-55bb-4e6d-9745-f7fe6497824d",
"linkTarget": "ArmAction",
"linkLabel": "โ
Check quotas",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "",
"httpMethod": "POST",
"title": "Check quota",
"description": "# โ
Check ReversingLabs TitaniumCloud API quotas\n\n## This action will execute a Logic App that will make calls to the TitaniumCloud TCA-9999 Quota API. The results will be loaded into your log analytics workspace under the RLTiCloudQuotas_CL table.\n\n# โ ๏ธ Please refresh the workbook after running this action to view updated data.",
"actionName": "Check RL TiCloud API Quotas"
}
}
]
},
"name": "links - 4",
"styleSettings": {
"padding": "10px"
}
}
]
},
"customWidth": "50",
"name": "group - api - check quotas - Copy"
}
]
},
"name": "group - api not purchased - text",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibilities": [
{
"parameterName": "section",
"comparison": "isEqualTo",
"value": "api_usage"
},
{
"parameterName": "ticloud_api_check",
"comparison": "isEqualTo",
"value": "none"
}
],
"name": "group - api - not purchased"
}
],
"fromTemplateId": "sentinel-ReversingLabs-CapabilitiesOverview",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}