{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "3ac5e194-a6a4-4405-8370-6da952e8bc5b", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "id": "1ba43bf0-5c1a-4081-b357-34f5389cf5f2", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "DataSource Statistics", "subTarget": "DataSourceStatistics", "style": "link" }, { "id": "c5d475b0-86f9-4e78-8b32-d19631bc68de", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Microsoft Sentinel Github", "subTarget": "MicrosoftSentinelGithub", "style": "link" }, { "id": "90261d23-b3d6-4b6c-a22c-c74cfe8d2e23", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Detection Platform Services", "subTarget": "DetectionPlatformServices", "style": "link" } ] }, "name": "links - 0" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/r/UjQS9t0TSr)" }, "name": "Survey" }, { "type": 1, "content": { "json": "# Getting Started\r\n---\r\n\r\nThis workbook enables SecOps Analysts, Threat Intelligence Professionals, and Threat Hunters to map out-of-the box Microsoft Sentinel detections coverage across MITRE ATT&CK framework. \r\n
With this workbook, analysts will be able to get insights into what out-of-the box detections are already available and can make informed decision to either onboard new datasources or enable new analytics and hunting queries to increase MITRE ATT&CK coverage or fill existing gaps. \r\n\r\nThe workbook is designed into separate tabs as deascribed below.\r\n\r\n## DataSource Statistics\r\n---\r\nThis section provides dataSources currently being populated based on Usage Table and security alerts triggered across those datasources from SecurityAlerts Table across Microsoft Sentinel workspace.\r\n\r\n## Microsoft Sentinel Github\r\n---\r\nThis section provides breakdown of existig out-of-the box content by Detection type such as Analytics, Hunting Queries and Fusion detections as well as by MITRE ATT&CK Tactics. \r\n\r\n## Detection Platform Services\r\n---\r\nThis section provides breakdown of built-in alerts from Microsoft suite of security products such as Azure Defender for various cloud resource types/services, Microsoft Defender for Identity (MDI), Microsoft Cloud Application Security (MCAS) and others. \r\n
These alerts can be visually represented by products as well as cloud resource types. \r\n\r\n## MITRE ATT&CK Heatmaps (Deprecated)\r\n---\r\n### Navigate to the MITRE ATT&CK (Preview) tab under Threat Management in the Sentinel portal to explore visual heatmaps categorized by cloud platforms such as Azure, AWS, and GCP, as well as by environments like Entra ID, Office 365, Windows, and Linux.\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Links and Resources\r\n\r\n- Microsoft Sentinel Github : https://github.com/Azure/Azure-Sentinel/\r\n- Microsoft Sentinel Fusion : https://docs.microsoft.com/azure/sentinel/fusion-scenario-reference\r\n- Microsoft Defender for Cloud: https://docs.microsoft.com/azure/security-center/alerts-reference\r\n- Azure Identity Protection (AIP): https://docs.microsoft.com/azure/active-directory/identity-protection/concept-identity-protection-risks\r\n- Microsoft Defender for Identity: https://docs.microsoft.com/advanced-threat-analytics/suspicious-activity-guide\r\n- Microsoft Defender for Cloud Apps : https://docs.microsoft.com/cloud-app-security/investigate-anomaly-alerts" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Overview" }, "name": "text - 2" }, { "type": 1, "content": { "json": "\r\n# ** Data Sources Available in Current Microsoft Sentinel **\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage \r\n| summarize SizeinMB = round(sum(Quantity),2) by DataType \r\n| sort by SizeinMB desc", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "query - 4" }, { "type": 1, "content": { "json": "# Detections Coverage in Existing Microsoft Sentinel" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize Count=dcount(AlertName) by ProviderName, VendorName", "size": 0, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ProviderName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "ProviderName", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "maxWidth": "50" } }, { "type": 1, "content": { "json": "# Alert Volume by Provider (Table view)" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize Count=count() by ProviderName, VendorName, AlertName\r\n| sort by ProviderName", "size": 0, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "query - 8" }, { "type": 1, "content": { "json": "# Alert Volume by Provider" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize Count=count() by ProviderName, VendorName, AlertName\r\n| sort by ProviderName", "size": 0, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "rowLimit": 500, "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ProviderName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "ProviderName", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "ProviderName", "yAxis": [ "Count" ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DataSourceStatistics" }, "customWidth": "50", "name": "query -10", "styleSettings": { "maxWidth": "50" } }, { "type": 1, "content": { "json": "## MITRE ATT&CK Coverage against Microsoft Sentinel Github\r\n\r\n# Links and Resources :\r\n- Tactics : https://attack.mitre.org/tactics/enterprise/\r\n- Enterprise Matrix : https://attack.mitre.org/matrices/enterprise/\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where isnotempty(Tactic)\r\n| summarize Count=dcount(DetectionName) by DetectionType", "size": 0, "title": "Query Type Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "50", "name": "query - 12", "styleSettings": { "maxWidth": "20" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Tactic)\r\n| extend Tactic = iff(Tactic in (\"Privilege Escalation\",\"Privilege escalation\") ,\"PrivilegeEscalation\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Persistance\",\"Persistence\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"Command and control\",\"CommandandControl\"), \"CommandAndControl\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"Defense Evasion\",\"Defense evasion\"), \"DefenseEvasion\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Lateral movement\",\"LateralMovement\",Tactic)\r\n| extend Tactic = iff(Tactic==\"Credential Access\",\"CredentialAccess\",Tactic)\r\n| extend Tactic = iff(Tactic in (\"IntialAccess\",\"InitalAccess\", \"Initial access\"),\"InitialAccess\",Tactic)\r\n| where Tactic in (\"InitialAccess\", \"Collection\", \"Discovery\", \"Execution\", \"Exfiltration\", \"LateralMovement\", \"Persistence\", \"PrivilegeEscalation\", \"DefenseEvasion\", \"CredentialAccess\", \"LateralMovement\", \"Reconnaissance\", \"Impact\")\r\n| summarize Count=dcount(DetectionId), make_set(DetectionName) by Tactic\r\n| sort by Count desc", "size": 0, "title": "Tactic Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Tactic", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "50", "name": "query - 13", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Platform)\r\n| summarize Count=dcount(DetectionId) by Platform\r\n| sort by Count desc", "size": 0, "title": "Platform Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "100", "name": "query - 14", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Tactic) and isnotempty(Platform)\r\n| distinct Platform, DataTypes, DetectionType, DetectionName,DetectionUrl \r\n| sort by Platform asc, DetectionType asc", "size": 0, "title": "DataSource Level Breakdown (Table View)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SentinelGithub = (externaldata(Tactic: string, TechniqueId: string, Platform: string, DetectionType: string, DetectionService: string, DetectionId: guid, DetectionName: string, DetectionDescription: string, ConnectorId: string, DataTypes: string, Query: string, QueryFrequency: string, QueryPeriod: string, TriggerOperator: string, TriggerThreshold: real, DetectionSeverity: string, DetectionUrl: string, IngestedDate: datetime)\r\n[@\"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/MITREATT%26CK/MicrosoftSentinel.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nSentinelGithub\r\n| where DetectionService == \"Azure Sentinel Community Github\"\r\n| where isnotempty(Tactic) and isnotempty(Platform)\r\n| summarize DetectionCount = count() by Platform\r\n| sort by DetectionCount desc\r\n", "size": 0, "title": "DataSource Level Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "gridSettings": { "rowLimit": 9000, "filter": true }, "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "xAxis": "Platform", "yAxis": [ "DetectionCount" ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "DetectionCount", "sizeAggregation": "Sum", "legendMetric": "DetectionCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "DetectionCount", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "MicrosoftSentinelGithub" }, "customWidth": "100", "name": "query - 16", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n| summarize Count=count() by DetectionService\r\n| sort by Count desc", "size": 0, "title": "Detections by Microsoft Services", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "customWidth": "50", "name": "query - 17", "styleSettings": { "maxWidth": "30" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n| where Provider != \"N.A.\"\r\n| summarize Count=count() by Provider\r\n| sort by Count desc", "size": 0, "title": "ASC - Resource Type Breakdown", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Provider", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "customWidth": "50", "name": "query - 18", "styleSettings": { "maxWidth": "70" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n", "size": 0, "title": "List of Alerts by Microsoft Services (Table View)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "name": "query - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MSFTBuiltinAlerts = (externaldata(Alert: string, Description: string, Tactics:string, Severity:string, Provider:string, DetectionService: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/MITREATT%26CK-LayerGeneration-Notebook/MSFT-Builtin-Alerts.csv\"] with (format=\"csv\", ignoreFirstRecord=True)\r\n);\r\nMSFTBuiltinAlerts\r\n| where isnotempty(Provider)\r\n| summarize AlertCount = count() by Provider\r\n| sort by AlertCount desc\r\n", "size": 0, "title": "List of Alerts by Microsoft Services", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "rowLimit": 500, "filter": true }, "chartSettings": { "xAxis": "Provider", "yAxis": [ "AlertCount" ] } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "DetectionPlatformServices" }, "name": "query - 20" }, { "type": 1, "content": { "json": "" }, "name": "text - 21" } ], "fromTemplateId": "sentinel-ThreatAnalysis&Response", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }