{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5b5bf4e9-62b8-4ef2-aeb3-ecd249fb6187", "version": "KqlParameterItem/1.0", "name": "CustomTimeRange", "label": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } }, { "id": "a40ffccc-08a0-4e15-9bf2-3ed99658d4d8", "version": "KqlParameterItem/1.0", "name": "selectedseverity", "label": "Severity", "type": 2, "description": "Filter on Security Events by Severity", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\"high\", \"med\",\"low\"]", "value": [ "value::all" ] }, { "id": "e2572416-ae1f-42db-8c31-8d0d4c4315d4", "version": "KqlParameterItem/1.0", "name": "selectedtype", "label": "Type", "type": 2, "description": "Filter on Security Events by Type", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\"Audit\",\"Application\", \"Process\", \"User\", \"Network\", \"System\"]", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nlet starttime = {CustomTimeRange:start};\nlet endtime = {CustomTimeRange:end};\nlet timeRange = datetime_diff('minute', endtime, starttime);\nlet binsize = case(\n timeRange <= 30, 1m,\n timeRange <= 60, 2m,\n timeRange <= 180, 5m,\n timeRange <= 720, 15m,\n timeRange <= 1440, 30m,\n timeRange <= 4320, 1h,\n timeRange <= 10080, 4h,\n timeRange <= 43200, 1d,\n 7d\n);\nunion \n (Samsung_Knox_Audit_CL | where \"Audit\" in (selectedtables) | extend Type = \"Audit\"),\n (Samsung_Knox_Application_CL | where \"Application\" in (selectedtables) | extend Type = \"Application\"),\n (Samsung_Knox_Process_CL | where \"Process\" in (selectedtables) | extend Type = \"Process\"),\n (Samsung_Knox_User_CL | where \"User\" in (selectedtables) | extend Type = \"User\"),\n (Samsung_Knox_Network_CL | where \"Network\" in (selectedtables) | extend Type = \"Network\"),\n (Samsung_Knox_System_CL | where \"System\" in (selectedtables) | extend Type = \"System\")\n| where TimeGenerated >= starttime and TimeGenerated < endtime\n| where \"{selectedseverity}\" == \"value::all\" or Severity in (severityParam)\n| summarize EventCount=count() by EventName=Name, TimeBin=bin(TimeGenerated, binsize)\n| where TimeBin >= starttime and TimeBin < endtime\n| extend TimeBinFormatted = TimeBin\n| order by TimeBin asc\n| project TimeBin=TimeBinFormatted, EventName, EventCount", "size": 2, "title": "Total events", "noDataMessage": "No security event data found for the selected time period, severity or type. Please update the filters applied.", "timeBrushParameterName": "CustomTimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "TimeBin", "yAxis": [ "EventCount" ], "group": "EventName", "createOtherGroup": 100, "showLegend": true, "legendPosition": "bottom", "seriesLabelSettings": [], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } }, "min": 0 } } }, "customWidth": "60", "name": "query - 7", "styleSettings": { "margin": "0px", "padding": "0px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nunion \n (Samsung_Knox_Audit_CL | where \"Audit\" in (selectedtables) | extend Type = \"Audit\"),\n (Samsung_Knox_Application_CL | where \"Application\" in (selectedtables) | extend Type = \"Application\"),\n (Samsung_Knox_Process_CL | where \"Process\" in (selectedtables) | extend Type = \"Process\"),\n (Samsung_Knox_User_CL | where \"User\" in (selectedtables) | extend Type = \"User\"),\n (Samsung_Knox_Network_CL | where \"Network\" in (selectedtables) | extend Type = \"Network\"),\n (Samsung_Knox_System_CL | where \"System\" in (selectedtables) | extend Type = \"System\")\n| where TimeGenerated {CustomTimeRange}\n| where \"{selectedseverity}\" == \"value::all\" or Severity in (severityParam)\n| summarize count() by Severity\n| where Severity in ('high', 'med', 'low')\n| order by case(Severity == 'high', 3, Severity == 'med', 2, Severity == 'low', 1, 0)", "size": 4, "title": "Events by severity", "noDataMessage": "No security event data found for the selected time period, severity or type. Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "severity", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "severity", "color": "redBright" }, { "columnName": "severity", "color": "orange" }, { "columnName": "severity", "color": "lightBlue" } ] } } }, { "columnMatch": "count_", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "severity", "color": "lightBlue" }, { "columnName": "severity", "color": "lightBlue" }, { "columnName": "severity", "color": "lightBlue" } ] } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "low", "representation": "yellow", "text": "{0}" }, { "operator": "==", "thresholdValue": "med", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "sortOrderField": 1 } }, "customWidth": "100", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nlet allSelected = \"{selectedtype}\" == \"value::all\" or array_length(selectedtables) == 6;\nlet results = union \n (Samsung_Knox_Audit_CL | extend EventType = \"Audit\"),\n (Samsung_Knox_Application_CL | extend EventType = \"Application\"),\n (Samsung_Knox_Process_CL | extend EventType = \"Process\"),\n (Samsung_Knox_User_CL | extend EventType = \"User\"),\n (Samsung_Knox_Network_CL | extend EventType = \"Network\"),\n (Samsung_Knox_System_CL | extend EventType = \"System\")\n| where TimeGenerated {CustomTimeRange}\n| where \"{selectedseverity}\" == \"value::all\" or Severity in (severityParam)\n| where allSelected or EventType in (selectedtables)\n| summarize EventCount = count() by EventType;\nresults\n| render piechart with (legend=hidden)", "size": 3, "title": "Events by type", "noDataMessage": "No security event data found for the selected time period, severity or type. Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Audit", "label": "Audit", "color": "purple" }, { "seriesName": "Application", "label": "Application", "color": "blue" }, { "seriesName": "Process", "label": "Process", "color": "turquoise" }, { "seriesName": "User", "label": "User", "color": "green" }, { "seriesName": "Network", "label": "Network", "color": "orange" }, { "seriesName": "System", "label": "System", "color": "redBright" } ] } }, "name": "query - 11" } ] }, "name": "group - 9" } ] }, "customWidth": "40", "name": "group - 8", "styleSettings": { "margin": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let selectedtables = dynamic([{selectedtype}]);\nlet severityParam = dynamic([{selectedseverity}]);\nunion \n (Samsung_Knox_Audit_CL | where \"Audit\" in (selectedtables) | extend Type = \"Audit\"),\n (Samsung_Knox_Application_CL | where \"Application\" in (selectedtables) | extend Type = \"Application\"),\n (Samsung_Knox_Process_CL | where \"Process\" in (selectedtables) | extend Type = \"Process\"),\n (Samsung_Knox_User_CL | where \"User\" in (selectedtables) | extend Type = \"User\"),\n (Samsung_Knox_Network_CL | where \"Network\" in (selectedtables) | extend Type = \"Network\"),\n (Samsung_Knox_System_CL | where \"System\" in (selectedtables) | extend Type = \"System\")\n| where TimeGenerated {CustomTimeRange}\n| where \"{selectedseverity}\" == \"value::all\" or Severity in (severityParam)\n| extend SeverityDisplay = case(\n tolower(Severity) == \"low\", \"1-low\",\n tolower(Severity) == \"med\", \"2-med\",\n tolower(Severity) == \"high\", \"3-high\",\n Severity\n)\n| project Time = TimeGenerated,\n Name,\n Severity = SeverityDisplay,\n [\"Device Model\"] = DeviceModel,\n Type,\n Profile,\n [\"Primary IMEI\"] = PrimaryImei,\n [\"MITRE Technique ID(s)\"] = array_strcat(MitreTtp, \", \")\n| sort by Time desc", "size": 2, "title": "Event list", "noDataMessage": "No security event data found for the selected time period, severity or type. Please update the filters applied.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "3-high", "representation": "dot-redBright", "text": "high" }, { "operator": "==", "thresholdValue": "2-med", "representation": "dot-orange", "text": "med" }, { "operator": "==", "thresholdValue": "1-low", "representation": "dot-yellow", "text": "low" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}" } ] } } ], "rowLimit": 1000 } }, "name": "query - 9" } ] }, "name": "group - 6" } ], "fromTemplateId": "sentinel-SamsungKnoxAssetIntelligence", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }