{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "8b56c36b-adee-4fe0-94e5-eeecafe26a52", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "primary" }, { "id": "d1df2068-b4ad-4de0-ab42-7d574bb04fa7", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Effective Attacks", "subTarget": "effective", "style": "link" }, { "id": "995f23fe-3d59-4512-b184-a526d52ed053", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "All Attacks", "subTarget": "all", "style": "link" } ] }, "name": "tabs" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "313cd4f2-172f-4ec1-ba58-90780f21472c", "version": "KqlParameterItem/1.0", "name": "Time_range", "type": 4, "description": "Select the time range for this Overview", "isRequired": true, "value": { "durationMs": 172800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "label": "Select Time Range" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'| extend Outcome = replace(@'INEFFECTIVE', @'PROBED',\n coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n tostring(extract_data(AdditionalExtensions, 'outcome')),\n \"\"\n )\n )\n| summarize Count=count() by tostring(Outcome)\n| where Outcome != 'success'", "size": 0, "title": "Attacks by Outcome", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Outcome", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Outcome", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "EXPLOITED", "color": "redBright" }, { "seriesName": "PROBED", "color": "gray" }, { "seriesName": "BLOCKED", "color": "green" }, { "seriesName": "SUSPICIOUS", "color": "orange" } ] } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "33", "name": "Outcome" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| where Outcome != 'success'\n| summarize Count=count() by tostring(Rule)", "size": 0, "title": "Attacks by Rule", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "33", "name": "Rule" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| where Outcome != 'success'\n| summarize Events = count() by ApplicationProtocol, bin(TimeGenerated, 1h)", "size": 0, "showAnnotations": true, "title": "Attacks by Hour", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "33", "name": "Attacks" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| where Outcome in ('EXPLOITED','BLOCKED','SUSPICIOUS')\n| summarize Count=count() by ApplicationProtocol, tostring(Outcome)\n", "size": 0, "title": "Effective Attacks by Application/Outcome", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "RequestURL", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "RequestURL", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "hivesContent": { "columnMatch": "ApplicationProtocol", "formatter": 1 }, "nodeIdField": "RequestURL", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "Count", "type": 4, "heatmapPalette": "coldHot", "heatmapMin": null, "heatmapMax": null }, "groupByField": "ApplicationProtocol", "hivesMargin": 5 }, "chartSettings": { "xAxis": "ApplicationProtocol", "group": "Outcome", "createOtherGroup": null, "seriesLabelSettings": [ { "seriesName": "EXPLOITED", "color": "redBright" }, { "seriesName": "BLOCKED", "color": "green" }, { "seriesName": "SUSPICIOUS", "color": "orange" } ] } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "50", "name": "by Application", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n| where Outcome in ('EXPLOITED','BLOCKED','SUSPICIOUS')\n| summarize Count=count() by ApplicationProtocol, tostring(Rule)\n", "size": 0, "title": "Effective Attacks by Application/Rule", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ], "graphSettings": { "type": 2, "topContent": { "columnMatch": "Rule", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "hivesContent": { "columnMatch": "ApplicationProtocol", "formatter": 1 }, "nodeIdField": "Rule", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "Count", "type": 4, "heatmapPalette": "coldHot", "heatmapMin": null, "heatmapMax": null }, "groupByField": "ApplicationProtocol", "hivesMargin": 5 }, "chartSettings": { "xAxis": "Rule", "group": "ApplicationProtocol", "createOtherGroup": null } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "50", "name": "byrule", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| where Outcome in ('EXPLOITED','BLOCKED','SUSPICIOUS')\n| summarize Count=count() by ApplicationProtocol, RequestURL, tostring(Outcome)\n ", "size": 0, "title": "Effective Attacks by Application/Route", "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Outcome", "formatter": 1 } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "ApplicationProtocol" ], "expandTopLevel": true }, "sortBy": [ { "itemKey": "RequestURL", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "ApplicationProtocol", "label": "Application" }, { "columnId": "RequestURL" }, { "columnId": "Outcome" }, { "columnId": "Count" } ] }, "sortBy": [ { "itemKey": "RequestURL", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "RequestURL", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "RequestURL", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "hivesContent": { "columnMatch": "ApplicationProtocol", "formatter": 1 }, "nodeIdField": "RequestURL", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "Count", "type": 4, "heatmapPalette": "coldHot", "heatmapMin": null, "heatmapMax": null }, "groupByField": "ApplicationProtocol", "hivesMargin": 5 } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "name": "byroute", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n| where Outcome in ('EXPLOITED','BLOCKED','SUSPICIOUS')\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n| project TimeGenerated, ApplicationProtocol, Rule, Activity, Outcome, RequestURL, SourceIP\n| order by TimeGenerated desc\n", "size": 2, "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100%" } }, { "columnMatch": "Outcome", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "EXPLOITED", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "BLOCKED", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "SUSPICIOUS", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "INEFFECTIVE", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "TimeGenerated" }, { "columnId": "ApplicationProtocol", "label": "Application" }, { "columnId": "Rule" }, { "columnId": "Activity" }, { "columnId": "Outcome" }, { "columnId": "RequestURL" }, { "columnId": "SourceIP" } ] } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "effective" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\nCommonSecurityLog \n| where DeviceVendor == 'Contrast Security'\n| extend Outcome = replace(@'INEFFECTIVE', @'PROBED', \n coalesce(\n column_ifexists(\"EventOutcome\", \"\"),\n extract_data(AdditionalExtensions, 'outcome'),\n \"\"\n )\n )\n| where Outcome != 'success'\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n| project TimeGenerated, ApplicationProtocol, Rule, Activity, Outcome, RequestURL, SourceIP\n| order by TimeGenerated desc\n", "size": 2, "timeContext": { "durationMs": 172800000 }, "timeContextFromParameter": "Time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100%" } }, { "columnMatch": "Outcome", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "EXPLOITED", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "BLOCKED", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "SUSPICIOUS", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "PROBED", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "TimeGenerated" }, { "columnId": "ApplicationProtocol", "label": "Application" }, { "columnId": "Rule" }, { "columnId": "Activity" }, { "columnId": "Outcome" }, { "columnId": "RequestURL" }, { "columnId": "SourceIP" } ] } }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "all" }, "name": "query - 6 - Copy" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-ContrastProtect", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }