{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f0dfd85a-6c9c-4dab-91d7-d67cb23b1fb2", "version": "KqlParameterItem/1.0", "name": "bhe_tenant", "label": "BHE Tenant", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL\n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "390213b5-e0d3-476c-99ca-89c76f417e7a", "version": "KqlParameterItem/1.0", "name": "domain_name", "label": "Environment", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL\n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| distinct domain_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "3d301840-15be-455d-bb48-d2ca8e3d4c2f", "version": "KqlParameterItem/1.0", "name": "finding_type", "label": "Attack Path Types", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL \n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| extend CleanPathTitle = trim(\" \", replace_string(replace_string(PathTitle, \"\\n\", \"\"), \"\\'\", \"\"))\n| distinct CleanPathTitle", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "9e7a3119-3a53-4df7-8878-d2b56a948732", "version": "KqlParameterItem/1.0", "name": "severity", "label": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL\r\n| where isnotempty(Severity)\r\n| where tenant_url in~ ({bhe_tenant})\r\n| where domain_name in~ ({domain_name})\r\n| distinct Severity\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "7e02e873-7550-447e-88aa-fc99dc923c14", "version": "KqlParameterItem/1.0", "name": "time", "label": "Time Range Picker", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 604800000 }, "key": "7e02e873-7550-447e-88aa-fc99dc923c14" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| summarize arg_max(TimeGenerated, *) by id, domain_name\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| extend CleanPathTitle = trim(\" \", replace_string(PathTitle, \"\\n\", \"\"))\n| where CleanPathTitle in~ ({finding_type})\n| extend \n NonTierZeroPrincipalDistinguishedName = tostring(parse_json(NonTierZeroPrincipalProps).distinguishedname),\n NonTierZeroPrincipalSAMAccountName = tostring(parse_json(NonTierZeroPrincipalProps).samaccountname),\n NonTierZeroPrincipalLastLogon = todatetime(unixtime_seconds_todatetime(tolong(parse_json(NonTierZeroPrincipalProps).lastlogon))),\n NonTierZeroPrincipalLastLogonTimestamp = todatetime(unixtime_seconds_todatetime(tolong(parse_json(NonTierZeroPrincipalProps).lastlogontimestamp))),\n NonTierZeroPrincipalCreated = todatetime(unixtime_seconds_todatetime(tolong(parse_json(NonTierZeroPrincipalProps).whencreated))),\n IsTierZero = case(\n tostring(parse_json(ImpactedPrincipalProps).system_tags) contains \"admin_tier_0\", true,\n false\n )\n| project \n [\"Non Tier Zero Principal\"] = NonTierZeroPrincipalName,\n [\"Non Tier Zero Principal Type\"] = NonTierZeroPrincipalKind,\n [\"Impacted Principal\"] = ImpactedPrincipalName,\n [\"Impacted Principal Type\"] = ImpactedPrincipalKind,\n [\"Finding Type\"] = PathTitle,\n [\"Finding Key\"] = Finding,\n [\"Environment (domain)\"] = domain_name,\n [\"Severity\"] = Severity,\n [\"Impact %\"] = round(todouble(ImpactPercentage), 0),\n [\"Impact Count\"] = toint(ImpactCount),\n [\"Exposure %\"] = round(todouble(ExposurePercentage), 0),\n [\"Exposure Count\"] = toint(ExposureCount),\n [\"First Seen\"] = todatetime(created_at),\n [\"Last Updated\"] = todatetime(updated_at),\n [\"Impacted Distinguished Name\"] = NonTierZeroPrincipalDistinguishedName,\n [\"SAM Account Name\"] = NonTierZeroPrincipalSAMAccountName,\n [\"Impacted ObjectID\"] = ImpactedPrincipal\n| order by [\"Last Updated\"] desc\n\n\n\n\n\n", "size": 0, "title": "Principals", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsTimelineData_CL\n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where created_at {time}\n| extend CleanPathTitle = trim(\" \", replace_string(path_title, \"\\n\", \"\"))\n| where CleanPathTitle in~ ({finding_type})\n| extend event_day = format_datetime(todatetime(updated_at), \"yyyy-MM-dd\")\n| summarize arg_max(updated_at, *) by event_day, tenant_url, domain_name, CleanPathTitle\n| extend _time = todatetime(event_day)\n| extend CompositeRisk = round(todouble(CompositeRisk), 2)\n| summarize LatestCompositeRisk = max(CompositeRisk) by bin(_time, 1d)\n| order by _time asc\n", "size": 0, "aggregation": 2, "title": "Maximum Exposure Percentage", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "showBorder": false } }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsTimelineData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| extend CleanPathTitle = trim(\" \", replace_string(path_title, \"\\n\", \"\"))\n| where created_at {time}\n| where CleanPathTitle in~ ({finding_type})\n| extend _time = todatetime(updated_at)\n| where isnotnull(_time)\n| summarize arg_max(TimeGenerated, *) by Finding, domain_name, tenant_url\n| summarize SumFindingCount = sum(toint(FindingCount)) by bin(_time, 1d)\n| order by _time asc\n", "size": 0, "title": "Total Number of Findings", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "name": "query - 6" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-BloodHoundEnterprise", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }