{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": ">**NOTE:** This workbook depends on a parser based on a Kusto Function to work as expected [**Corelight**](https://aka.ms/sentinel-Corelight-parser) which is deployed with the Microsoft Sentinel Solution." }, "name": "text - 23" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c64d5d3d-90c6-484a-ab88-c70652b75b6e", "version": "KqlParameterItem/1.0", "name": "GlobalTimeRestriction", "label": "Global Time Restriction", "type": 4, "description": "Select Time Range", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "a076210e-a47c-43c2-97e1-1f663fedbd01", "version": "KqlParameterItem/1.0", "name": "Sensor", "label": "Corelight Sensor", "type": 2, "description": "Select Corelight Sensor", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "corelight_conn\n| distinct sensor_name\n| sort by sensor_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "cd6cc63c-c1a8-49fc-89c7-b2ae5e0674d9", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Secure Channel Insights", "subTarget": "SecureChannelInsights", "style": "link" }, { "id": "c2140a1d-ad51-4d22-a0ed-b433d3131b54", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Name Resolution Insights", "subTarget": "NameResolutionInsights", "style": "link" }, { "id": "cf92c03c-d98e-4a02-bc53-b127708c83f8", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Remote Activity Insights", "subTarget": "RemoteActivityInsights", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Secure Channel Insights\r\n#### Deep dive from Security Posture Encrypted, non-encrypted SSL, SSH, TLS and x509 facts.\r\n" }, "name": "text - 0" }, { "type": 1, "content": { "json": "### Encrypted Traffic Notables\r\n----" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Weak Certs. Used Internally", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_x509\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend key_length=certificate_key_length, match_fingerprint=fingerprint\r\n| where toint(key_length) < 2048\r\n| project match_fingerprint, key_length, TimeGenerated\r\n| join kind=inner (\r\n corelight_ssl\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | mv-expand todynamic(cert_chain_fps)\r\n | extend match_fingerprint=cert_chain_fps\r\n | project tostring(match_fingerprint), uid, src_ip, dest_ip, id_resp_p, is_dest_internal_ip, server_name, TimeGenerated)\r\n on match_fingerprint\r\n| summarize arg_max(TimeGenerated, *) by match_fingerprint\r\n| extend Host_Type=iff(is_dest_internal_ip==\"true\", \"Internal\", \"External\"), Resp_port=id_resp_p\r\n| where Host_Type == \"Internal\"\r\n| summarize Count= count() by server_name, dest_ip, Resp_port, key_length, Host_Type\r\n| summarize Sum = count()", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "server_name", "formatter": 1 }, "leftContent": { "columnMatch": "Sum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### SSL/TLS sessions utilizing weak keys are vulnerable to cryptographic attacks. This traffic may indicate the presence of old and/or unpatched resources on the network. It could also be the result of a successful downgrade attack." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CertResults = corelight_x509\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend key_length=certificate_key_length\r\n| extend match_fingerprint=fingerprint\r\n| where toint(key_length) < 2048\r\n| project match_fingerprint, key_length, TimeGenerated\r\n| join kind=inner ( \r\n corelight_ssl\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | mv-expand todynamic(cert_chain_fps)\r\n | extend match_fingerprint=cert_chain_fps\r\n | project tostring(match_fingerprint), uid, src_ip, dest_ip, id_resp_p, is_dest_internal_ip, server_name, TimeGenerated)\r\n on match_fingerprint\r\n| summarize arg_max(TimeGenerated, *) by match_fingerprint\r\n| extend [\"Host Type\"]=iff(is_dest_internal_ip==\"true\", \"Internal\", \"External\"), Resp_Port=id_resp_p, Dest_Host=dest_ip, [\"Key Length\"]=key_length, [\"Server Name\"]=server_name\r\n| where [\"Host Type\"] == \"Internal\"\r\n| summarize Count= count() by [\"Server Name\"], Dest_Host, Resp_Port, [\"Key Length\"], [\"Host Type\"]\r\n| sort by [\"Server Name\"] desc;\r\nlet CertCount = CertResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable([\"Server Name\"]: string, Dest_Host: string, Resp_Port: string, [\"Key Length\"]: string, [\"Host Type\"]: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(CertResults| where toscalar(CertCount) != 0),\r\n(NoResults| where toscalar(CertCount) == 0)\r\n| extend Resp_Port = coalesce(tostring(toint(Resp_Port_int)), Resp_Port_string)\r\n| extend [\"Key Length\"] = coalesce(tostring(tolong(['Key Length_long'])), ['Key Length_string'])\r\n| project-away Resp_Port_*, [\"Key Length_*\"]\r\n| project-reorder [\"Server Name\"], Dest_Host, Resp_Port, [\"Key Length\"], [\"Host Type\"], Count\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for Weak Key Length Certs", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Less Secure Ciphers", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where cipher matches regex (\"RC4|DES|3DES|MD5|NULL|EXPORT\")\r\n| extend Host_Type=iff(is_src_internal_ip==\"true\", \"Internal\", \"External\")\r\n| extend Direction=iff(is_src_internal_ip==\"true\" and is_dest_internal_ip==\"false\", \"Outbound\", \"Inbound\")\r\n| summarize Unique_Conns=dcount(uid), Count=count() by cipher\r\n| summarize TotalCount = count()", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### SSL/TLS sessions utilizing weak cipher suites (eg. RC4) are easily decrypted. This traffic may indicate the presence of old and/or unpatched resources on the network. It could also be the result of a successful downgrade attack." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let QueryResults = corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where cipher matches regex (\"RC4|DES|3DES|MD5|NULL|EXPORT\")\r\n| extend Host_Type=iff(is_src_internal_ip==\"true\", \"Internal\", \"External\")\r\n| extend Direction=iff(is_src_internal_ip==\"true\" and is_dest_internal_ip==\"false\", \"Outbound\", \"Inbound\")\r\n| summarize dest_ip = make_list(dest_ip)[-1], Unique_Conns=dcount(uid), Host_Type=strcat_array(make_set(Host_Type), \",\"), Direction=strcat_array(make_set(Direction), \",\"), Count=count() by cipher\r\n| project-rename Cipher=cipher\r\n| sort by Unique_Conns desc, Count desc;\r\nlet QueryCount = QueryResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(Cipher: string, dest_ip: dynamic, Unique_Conns: string, Host_Type: string, Direction: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(QueryResults| where toscalar(QueryCount) != 0),\r\n(NoResults| where toscalar(QueryCount) == 0)\r\n| extend Unique_Conns = coalesce(tostring(tolong(Unique_Conns_long)), Unique_Conns_string)\r\n| project-away Unique_Conns_*\r\n", "size": 0, "showAnalytics": true, "title": "Less Secure Ciphers seen in the period", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Connections using Less Secure TLS Versions (< TLS1.2)", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0054d601-4a2f-41d2-8f2b-5633e412ff29", "version": "KqlParameterItem/1.0", "name": "TrafficDirection", "label": "Traffic Direction", "type": 2, "description": "Select Traffic Direction", "isRequired": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\"Inbound\", \"Outbound\", \"Internal\", \"EEther\"]\r\n", "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "GlobalTimeRestriction", "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(src_ip) and isnotempty(version)\r\n| extend ip_class = iff(is_dest_internal_ip == \"true\", \"Internal\", \"External\")\r\n| extend src_int = iff(isnull(is_src_internal_ip) or is_src_internal_ip==\"false\", \"f\", \"t\"), \r\n dst_int = iff(isnull(is_dest_internal_ip) or is_dest_internal_ip==\"false\", \"f\", \"t\") \r\n| extend \r\n connection_type=case(\r\n src_int==\"t\" and dst_int==\"f\", \"Outbound\",\r\n src_int==\"f\" and dst_int==\"t\", \"Inbound\",\r\n src_int==\"t\" and dst_int==\"t\", \"Internal\",\r\n \"EEther\"\r\n ),\r\n version_status=case(\r\n version==\"TLSv13\", \"Most Secure (v1.3)\",\r\n version==\"TLSv12\", \"Secure (v1.2)\",\r\n version==\"DTLSv12\", \"Secure (v1.2)\", \r\n version==\"unknown-64282\", \"Unknown\",\r\n \"Old Version < (v1.2)\") \r\n| extend Classification=version_status, [\"Traffic Direction\"]=connection_type, Version=version\r\n| where ('*' == ('{TrafficDirection}') or [\"Traffic Direction\"] == ('{TrafficDirection}'))\r\n| where Classification !contains \"Secure\"\r\n| summarize Counter=dcount(uid) by tostring(Version), Classification, \"Traffic Direction\"\r\n| summarize Sum=sum(Counter)", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Sum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 1" }, { "type": 1, "content": { "json": "#### Connections employing TLS versions older than 1.2 are recognized as less secure, presenting a higher risk of being compromised. These outdated protocols may indicate legacy systems with configurations that are not aligned with modern security standards." }, "customWidth": "60", "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where isnotempty(src_ip) and isnotempty(version)\r\n| extend ip_class = iff(is_dest_internal_ip == \"true\", \"Internal\", \"External\")\r\n| extend src_int = iff(isnull(is_src_internal_ip) or is_src_internal_ip==\"false\", \"f\", \"t\"), \r\n dst_int = iff(isnull(is_dest_internal_ip) or is_dest_internal_ip==\"false\", \"f\", \"t\") \r\n| extend \r\n connection_type=case(\r\n src_int==\"t\" and dst_int==\"f\", \"Outbound\",\r\n src_int==\"f\" and dst_int==\"t\", \"Inbound\",\r\n src_int==\"t\" and dst_int==\"t\", \"Internal\",\r\n \"EEther\"\r\n ),\r\n version_status=case(\r\n version==\"TLSv13\", \"Most Secure (v1.3)\",\r\n version==\"TLSv12\", \"Secure (v1.2)\",\r\n version==\"DTLSv12\", \"Secure (v1.2)\", \r\n version==\"unknown-64282\", \"Unknown\",\r\n \"Old Version < (v1.2)\") \r\n| extend Classification=version_status, [\"Traffic Direction\"]=connection_type, Version=version\r\n| where ('*' == ('{TrafficDirection}') or [\"Traffic Direction\"] == ('{TrafficDirection}'))\r\n| summarize Counter=dcount(uid), [\"Responder Location\"] = strcat_array(make_set(ip_class), \",\") by tostring(Version), Classification, [\"Traffic Direction\"]\r\n| project-reorder Version, [\"Traffic Direction\"], Counter, [\"Responder Location\"], Classification\r\n| sort by Counter desc;\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(Version: string, Counter: long)\r\n[\"No Results Found\", 0];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for All TLS versions seen (Classification based on Industry best practices)", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Version", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Version", "sortOrder": 1 } ] }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 2-Connections using Less Secure TLS Versions (< TLS1.2)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Interactive Sessions and Keystrokes", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh \r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences), todynamic(Descriptions)\r\n| where Inferences in (\"KS\", \"AUTO\") \r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| extend src_ip = id_orig_h, dest_ip = id_resp_h, Inference=Inferences, Description=Descriptions\r\n| summarize Count = count() by uid, src_ip, dest_ip, tostring(Inference), tostring(Description) \r\n| summarize TotalCount = count()", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0", "styleSettings": { "margin": "60px 0px 0px 0px" } }, { "type": 1, "content": { "json": "#### Highlight interactive sessions (KS) and automated interactions (AUTO) to understand the nature of SSH traffic — manual vs. automated.\r\n" }, "customWidth": "60", "name": "text - 2", "styleSettings": { "margin": "60px 0px 0px 0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssh \r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences), todynamic(Descriptions)\r\n| where Inferences in (\"KS\", \"AUTO\") \r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| extend src_ip = id_orig_h, dest_ip = id_resp_h, Inference=Inferences, Description=Descriptions\r\n| summarize Count = count() by uid, src_ip, dest_ip, tostring(Inference), tostring(Description);\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(uid: string, src_ip: string, dest_ip: string, Inference: string, Description: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for Interactive Sessions and Keystrokes - SSH Inferences", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1", "styleSettings": { "margin": "2px 0px 0px 0px", "showBorder": true } } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Self Signed Certs", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where validation_status==\"self signed certificate\" and is_dest_internal_ip==\"true\" and isnotempty(dest_ip)\r\n| extend Source_Host_Type = case(is_src_internal_ip==\"true\", \"Internal\",is_src_internal_ip==\"false\", \"External\", \"Undefined\") , \r\nDestination_Host_Type = case(is_dest_internal_ip==\"true\", \"Internal\",is_dest_internal_ip==\"false\", \"External\", \"Undefined\")\r\n| extend Traffic_Direction = case(Source_Host_Type==\"Internal\" and Destination_Host_Type==\"External\", \"Outbound\",Source_Host_Type==\"External\" and Destination_Host_Type==\"Internal\", \"Inbound\",Source_Host_Type==\"Internal\" and Destination_Host_Type==\"Internal\", \"East-West\",Source_Host_Type==\"External\" and Destination_Host_Type==\"External\", \"Ether\",\"Undefined\") \r\n| summarize count() by ssl_subject_common_name, dest_ip \r\n| count ", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### This dashboard panel identifies self-signed certificates in use within internal networks, highlighting a key security concern due to their lack of third-party validation. Addressing this issue by transitioning to certificates from trusted authorities enhances network security and trustworthiness." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where validation_status==\"self signed certificate\" and is_dest_internal_ip==\"true\" and isnotempty(dest_ip)\r\n| extend Source_Host_Type = case(is_src_internal_ip==\"true\", \"Internal\",is_src_internal_ip==\"false\", \"External\", \"Undefined\") , \r\nDestination_Host_Type = case(is_dest_internal_ip==\"true\", \"Internal\",is_dest_internal_ip==\"false\", \"External\", \"Undefined\")\r\n| extend Traffic_Direction = case(Source_Host_Type==\"Internal\" and Destination_Host_Type==\"External\", \"Outbound\",Source_Host_Type==\"External\" and Destination_Host_Type==\"Internal\", \"Inbound\",Source_Host_Type==\"Internal\" and Destination_Host_Type==\"Internal\", \"East-West\",Source_Host_Type==\"External\" and Destination_Host_Type==\"External\", \"Ether\",\"Undefined\") \r\n| summarize Destination_Host_Type=strcat_array(make_set(Destination_Host_Type), \",\"), Status=strcat_array(make_set(validation_status), \",\"), Traffic_Direction=strcat_array(make_set(Traffic_Direction), \",\") \r\n by ssl_subject_common_name, dest_ip \r\n| project Subject=ssl_subject_common_name, Destination=dest_ip, Status, Destination_Host_Type, Traffic_Direction;\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(Subject: string)\r\n[\"No Results Found\"];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for Self Signed Internal Certificates", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Subject", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Subject", "sortOrder": 1 } ] }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 4-Self Signed Certs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Possible File Uploaded", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' == ('*') or sensor_name == ('*'))\r\n| mv-expand todynamic(Inferences), todynamic(Descriptions)\r\n| where Inferences in (\"SFD\", \"LFD\", \"SFU\", \"LFU\")\r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| project-rename\r\n Inference = Inferences,\r\n Description = Descriptions\r\n| summarize Count = count() by uid, src_ip, dest_ip,tostring(Inference), tostring(Description)\r\n| summarize TotalCount = count()\r\n", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### This use case tracks SSH file transfer activity (inferences SFD, LFD, SFU, LFU). It uncovers potential data exfiltration by attackers or the introduction of malicious files. Focus on file names, sizes, unusual source IPs, and sensitive destination systems." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssh\r\n| where ('*' == ('*') or sensor_name == ('*'))\r\n| mv-expand todynamic(Inferences), todynamic(Descriptions)\r\n| where Inferences in (\"SFD\", \"LFD\", \"SFU\", \"LFU\")\r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| project-rename\r\n Inference = Inferences,\r\n Description = Descriptions\r\n| summarize Count = count() by uid, src_ip, dest_ip,tostring(Inference), tostring(Description);\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(uid: string, src_ip: string, dest_ip: string, Inference: string, Description: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Possible File Transfer", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 5-Possible File Uploaded" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Certificates about to Expire", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where is_dest_internal_ip==\"true\"\r\n| mv-expand todynamic(fingerprint)\r\n| extend fingerprint=tostring(fingerprint)\r\n| join kind=inner \r\n (corelight_x509\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where days_to_expiry > 0 and days_to_expiry < 30)\r\n on fingerprint\r\n| summarize count() by ssl_subject, dest_ip\r\n| count\r\n\r\n", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### A SSL certificate that is about to expire (default window is 30 days) was observed. Expiration of an SSL certificate may result in unexpected behaviour such as refused network connections or unencrypted network traffic.\r\n" }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssl\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where is_dest_internal_ip==\"true\"\r\n| mv-expand todynamic(fingerprint)\r\n| extend fingerprint=tostring(fingerprint)\r\n| join kind=inner \r\n (corelight_x509\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where days_to_expiry > 0 and days_to_expiry < 30)\r\n on fingerprint\r\n| summarize Port = strcat_array(make_list(toint(dest_port)), \",\"), [\"Not Valid After\"] = strcat_array(make_list(not_valid_after), \",\"), [\"Days to Expire\"] = strcat_array(make_list(days_to_expiry), \",\") by ssl_subject, dest_ip\r\n| project-rename Subject = ssl_subject, Host = dest_ip\r\n| sort by tostring([\"Days to Expire\"]) desc; \r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(Subject: string)\r\n[\"No Results Found\"];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for Self Signed Internal Certificates", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 6-Certificates about to Expire" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Potential Security Risks", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"SC\", \"SP\", \"SV\", \"SA\", \"AFR\", \"BAN\") \r\n| summarize Count = count() by uid, src_ip, dest_ip, tostring(Inferences) \r\n| summarize TotalCount = count()\r\n", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Monitors for signs of scanning (SC, SP, SV, SA), banner messages (BAN), and agent forwarding (AFR) for compliance and security risk identification." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"SC\", \"SP\", \"SV\", \"SA\", \"AFR\", \"BAN\") \r\n| summarize Count = count() by uid, src_ip, dest_ip, tostring(Inferences)\r\n| project-reorder uid, src_ip, dest_ip, Count, Inferences;\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(uid: string)\r\n[\"No Results\"];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "SSH Inferences for Potential Security Risks", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 7-Potential Security Risks" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Automated SSH Session Indicators", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"PKA\", \"AUTO\", \"KS\", \"CTS\")\r\n| summarize\r\n src_ip = strcat_array(make_list(id_orig_h), \",\"),\r\n dest_ip = strcat_array(make_list(id_resp_h), \",\"),\r\n Inferences = strcat_array(make_list(Inferences), \",\"),\r\n Count = count()\r\n by uid\r\n| summarize TotalCount = count()\r\n", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Tracks automated SSH sessions to enhance security and operational efficiency, highlighting potential risks and compliance issues. It identifies anomalies and unauthorized activities, ensuring that automation tools are used securely and efficiently. This tool is crucial for SOC analysts to monitor for security breaches and optimize system management." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"PKA\", \"AUTO\", \"KS\", \"CTS\")\r\n| summarize\r\n src_ip = strcat_array(make_list(id_orig_h), \",\"),\r\n dest_ip = strcat_array(make_list(id_resp_h), \",\"),\r\n Inferences = strcat_array(make_list(Inferences), \",\"),\r\n Count = count()\r\n by uid;\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(uid: string, src_ip: string, dest_ip: string, Inferences: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "SSH Session Inferences", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 8 - Automated SSH Session Indicators" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Advanced Threat Indicators", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"ABP\", \"RSP\", \"RSI\", \"RSIA\", \"RSL\", \"RSK\")\r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| summarize Count = count() by uid, id_orig_h, id_resp_h, tostring(Inferences)\r\n| summarize TotalCount = count()\r\n", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "uid", "formatter": 1 }, "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true } }, "customWidth": "40", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Helps to identify potential advanced threat indicators such as Client Authentication Bypass (ABP) and Reverse SSH tunneling activities (RSP, RSI, RSIA, RSL, RSK) for in-depth investigation." }, "customWidth": "60", "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SSHResults = corelight_ssh\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| mv-expand todynamic(Inferences)\r\n| where Inferences in (\"ABP\", \"RSP\", \"RSI\", \"RSIA\", \"RSL\", \"RSK\")\r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| summarize Count = count() by uid, id_orig_h, id_resp_h, tostring(Inferences)\r\n| project-rename Inference = Inferences, src_ip = id_orig_h , dest_ip = id_resp_h;\r\nlet SSHCount = SSHResults\r\n| summarize count()\r\n| project count_;\r\nlet NoResults = datatable(uid: string, src_ip: string, dest_ip: string, Inference: string, Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", 0];\r\nunion isfuzzy=true\r\n(SSHResults| where toscalar(SSHCount) != 0),\r\n(NoResults| where toscalar(SSHCount) == 0)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "SSH Advanced Threats Inferences", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 9 - Advanced Threat Indicators" } ] }, "name": "group - Encrypted Traffic Notables" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "SecureChannelInsights" }, "name": "Secure Channel Insights" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Name Resolution Insights\r\n##### Insights on Name Resolution (DNS)" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### DNS Hygiene\r\n----" }, "name": "text - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Responding DNS Servers", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize count() by dest_ip\r\n| count", "size": 3, "showAnalytics": true, "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### DNS servers actively responding in the network are key to secure operations, translating domain names to IP addresses and directing traffic. It also logs the number of queries and unique clients interacting with the DNS servers, offering insights into possible rogue DNS servers and detecting patterns that may suggest data exfiltration attempts." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "11px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| extend IPInfo = geo_info_from_ip_address(dest_ip)\r\n| summarize\r\n [\"# of Queries\"] = count(),\r\n [\"# of Unique Clients\"] = dcount(src_ip),\r\n Country = any(IPInfo.country),\r\n any(is_dest_internal_ip)\r\n by dest_ip\r\n| extend\r\n Internal = iff(\r\n any_is_dest_internal_ip == \"true\",\r\n \"Yes\",\r\n \"No\"\r\n ),\r\n Country = iff(isempty(Country), \"Unknown\", Country)\r\n| project\r\n Destination = dest_ip,\r\n ['# of Queries'],\r\n ['# of Unique Clients'],\r\n Country,\r\n Internal\r\n| sort by ['# of Queries'], ['# of Unique Clients'] desc ", "size": 0, "showAnalytics": true, "title": "DNS Servers actively responding to queries", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "responding dns servers" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Unusual Qtypes", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where qtype_name in (\"AXFR\", \"IXFR\", \"ANY\", \"TXT\")\r\n| summarize count() by qtype_name, dest_ip\r\n| summarize Count = sum(count_)", "size": 3, "showAnalytics": true, "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Unusual DNS query types can indicate misconfigurations, experimental features, or potential security threats like data exfiltration or tunneling. Analysts should scrutinize such queries for anomalies and address identified risks to safeguard network security." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "21px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredDNS = (\r\ncorelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where qtype_name in (\"AXFR\", \"IXFR\", \"ANY\", \"TXT\")\r\n);\r\nlet DNSRecords = (\r\nFilteredDNS\r\n| summarize count() by qtype_name, dest_ip\r\n);\r\nFilteredDNS\r\n| join kind=leftouter(DNSRecords) on $left.qtype_name == $right.qtype_name, $left.dest_ip == $right.dest_ip\r\n| summarize arg_max(TimeGenerated, *) by qtype_name, dest_ip\r\n| project Qtype = qtype_name, Responder = dest_ip, Source = src_ip, Query = query, Count = count_\r\n| sort by Count", "size": 0, "showAnalytics": true, "title": "Unusual Query Types found", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "unusual qtypes" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "NXDOMAIN Responses", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where tolower(rcode_name) in (\"nxdomain\", \"noerror\")\r\n| extend query_rejected = iff(rejected == true, \"Yes\", \"No\")\r\n| summarize count() by src_ip, dest_ip, query, query_rejected\r\n| summarize sum(count_)", "size": 3, "showAnalytics": true, "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "sum_count_", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### High rates of DNS NXDOMAIN responses might suggest misconfigured domains, typographical errors in network requests, or malicious activities such as DNS reconnaissance. Close examination is advised to correct configurations or identify security incidents. Review DNS logs for patterns, validate domain configurations, and check endpoint security for signs of malware." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "7px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where tolower(rcode_name) in (\"nxdomain\", \"noerror\")\r\n| extend query_rejected = iff(rejected == true, \"Yes\", \"No\")\r\n| summarize count() by src_ip, dest_ip, query, query_rejected\r\n| project Source = src_ip, Responder = dest_ip, Query = query, Rejected = query_rejected, Count = count_\r\n| sort by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "Network Evidence for NXDOMAIN Responses", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "nxdomain responses" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Monitoring DNS Query Response Times > 15ms", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_rtt = avg(todouble(rtt)) by query, dest_ip\r\n| where avg_rtt > 0.015\r\n| extend avg_rtt = round(avg_rtt*1000, 2)\r\n| count ", "size": 3, "showAnalytics": true, "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Long DNS query response times may indicate network congestion, server performance issues, or potential security threats. Timely analysis is crucial for maintaining optimal network performance and security. Investigate extended response times by examining server configurations, network traffic, and potential external attacks." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "19px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize avg_rtt = avg(todouble(rtt)) by query, dest_ip\r\n| where avg_rtt > 0.015\r\n| extend avg_rtt = round(avg_rtt*1000, 2)\r\n| project Query = query, Responder = dest_ip, [\"Avg. Response Time (ms)\"] = avg_rtt", "size": 0, "showAnalytics": true, "title": "Monitoring DNS Query Types by AVG time", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "monitoring DNS query response times > 15ms" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Failed DNS Queries", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where tolower(rcode_name) in (\"servfail\", \"refused\", \"formerr\", \"notimp\", \"notauth\")\r\n| summarize count() by rcode_name\r\n| count", "size": 3, "showAnalytics": true, "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Failed DNS queries may point to misconfigurations, outdated systems, or security threats such as network infiltration or DNS poisoning. Analysts should investigate the sources and patterns of these failures to identify and remediate underlying causes, thereby ensuring network integrity and security." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "10px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredDNS = (\r\n corelight_dns\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where tolower(rcode_name) in (\"servfail\", \"refused\", \"formerr\", \"notimp\", \"notauth\")\r\n );\r\nlet RcodeCount = (\r\n FilteredDNS\r\n | summarize count() by rcode_name, dest_ip, src_ip\r\n );\r\nFilteredDNS\r\n| join kind=innerunique (RcodeCount) on rcode_name, dest_ip, src_ip\r\n| project\r\n Source = src_ip,\r\n Responder = dest_ip,\r\n Query = query,\r\n [\"Response Code\"] = toupper(rcode_name),\r\n Count = count_\r\n| sort by Count desc ", "size": 0, "showAnalytics": true, "title": "Network Evidence for Failed DNS Queries", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "failed DNS queries" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "DNS Query Volume Over Time", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_conn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where service == \"dns\"\r\n| summarize TotalTraffic = sum(todouble(orig_bytes))", "size": 3, "showAnalytics": true, "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalTraffic", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Monitor total DNS-related network traffic in MB/GB. Sudden spikes or unusual patterns could signal configuration errors, compromised devices making excessive queries, or potential data exfiltration attempts." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "18px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_dns\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| summarize Count = count() by bin(TimeGenerated, bin_duration), uid", "size": 0, "showAnalytics": true, "title": "Monitoring Query Types by AVG time", "noDataMessage": "No data found", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "Count" ], "group": "uid", "createOtherGroup": 99 } }, "name": "query - 2", "styleSettings": { "margin": "10px" } } ] }, "customWidth": "50", "name": "DNS query volume over time" } ] }, "name": "dns hygiene" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "NameResolutionInsights" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Remote Activity Insights" }, "name": "title" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Remote Access Hygiene\r\n---" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "RDP Authentication Attempts", "expandable": true, "items": [ { "type": 1, "content": { "json": "Total count of RDP success and failed actions within the specified time.\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action != \"unknown\"\r\n| summarize count() by action\r\n| summarize Total = sum(count_)", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Total", "exportParameterName": "count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Total", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Monitoring RDP authentications is crucial for identifying unauthorized access and distinguishing between successful and failed login attempts. Security teams should analyze trends and cross-reference user activity for rapid response and mitigation." }, "customWidth": "65", "name": "text - 2", "styleSettings": { "margin": "36px 36px 0px 0px", "padding": "0px 0px 30px 0px" } }, { "type": 1, "content": { "json": "#### Click on the Count in above tile to view more information.", "style": "info" }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action != \"unknown\"", "size": 0, "showAnalytics": true, "title": "Details of RDP Authentication Attempts", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "action", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "action", "label": "Action" } ] } }, "conditionalVisibility": { "parameterName": "count", "comparison": "isNotEqualTo" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet interval_in_days= datetime_diff('day', {GlobalTimeRestriction:end}, {GlobalTimeRestriction:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\ncorelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action != \"unknown\"\r\n| make-series Count=count() default = 0 on TimeGenerated from {GlobalTimeRestriction:start} to {GlobalTimeRestriction:end} step bin_duration by action", "size": 0, "showAnalytics": true, "title": "Failed vs Successful Authentications", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "Time", "defaultValue": "none" }, { "fieldName": "series", "parameterName": "Action", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "action", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "action", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "TimeGenerated", "group": "action", "createOtherGroup": 0, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "success", "color": "green" }, { "seriesName": "failure", "color": "redBright" } ], "ySettings": { "label": "Count" } } }, "name": "query - 1", "styleSettings": { "padding": "10px" } }, { "type": 1, "content": { "json": "#### Click on the datapoints in panel Failed vs Successful Authentications above to view more information.", "style": "info" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action == \"{Action}\"", "size": 0, "showAnalytics": true, "title": "Details of Failed vs Successful Authentications", "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Time", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 4", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "rdp authentication attempts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Identifying Failed RDP Logins", "expandable": true, "items": [ { "type": 1, "content": { "json": "Total count of users with login failures within the specified time.\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action == \"failure\" or auth_success == \"false\"\r\n| where isnotempty(cookie)\r\n| extend User = cookie\r\n| summarize dcount(User)", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "dcount_User", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Monitoring failed RDP logins is essential for detecting unauthorized access attempts. Security teams should analyze patterns of failed entries against user and IP data to identify potential breaches. This focus helps in quickly addressing vulnerabilities in RDP security. Effective monitoring of these incidents is crucial for maintaining system integrity." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "25px", "padding": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredRDP = (\r\ncorelight_rdp\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where action == \"failure\" or auth_success == \"false\"\r\n| where isnotempty(cookie)\r\n);\r\nlet CookieCount = (\r\nFilteredRDP\r\n| summarize Count = count() by cookie\r\n);\r\nlet QueryResult = (\r\nFilteredRDP\r\n| join kind=leftouter(CookieCount) on $left.cookie == $right.cookie\r\n| extend User = cookie, Source = src_ip, Responder = dest_ip, Auth_Success = tostring(auth_success), Result = result\r\n| summarize arg_max(TimeGenerated, *) by User\r\n| project User, Source, Responder, ['Auth Success'] = Auth_Success, Result, Count\r\n| sort by Count\r\n);\r\nlet QueryCount = (\r\nQueryResult\r\n| count\r\n);\r\nlet NoResults = (\r\ndatatable ( User: string, Source: string, Responder: string, ['Auth Success']: string, Result: string, Count: long) [ \"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0]\r\n);\r\nunion isfuzzy=true \r\n(QueryResult| where toscalar(QueryCount) != 0),\r\n(NoResults | where toscalar (QueryCount) == 0)", "size": 0, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "identifying failed rdp logins" } ] }, "name": "remote access hygiene" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### VPN Insights\r\n---" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Unusual Remote Activity", "expandable": true, "items": [ { "type": 1, "content": { "json": "Total count of VPN connections that have the following inferences NSP - Non-Standard Port RW - Road warrior configuration detected (i.e. Cisco Anyconnect) COM - Commercial VPN service occurring at the same time which is deemed suspicious.\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where Inferences has_all (\"COM\", \"RW\", \"NSP\")\r\n| summarize count() by src_ip, dest_ip, tostring(Inferences), vpn_type\r\n| count", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### The combination of the \"COM\", \"RW\", and \"NSP\" inferences in a single VPN connection raises questions: Policy Violation: Is the use of commercial VPNs allowed in your organization's security policy? If not, this could indicate a violation. Hidden Activity: Is the non-standard port usage an attempt to mask other activities happening over the VPN tunnel?" }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "34px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredVPN = (\r\n corelight_vpn\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where Inferences has_all (\"COM\", \"RW\", \"NSP\")\r\n );\r\nlet VPNCount = (\r\n FilteredVPN\r\n | extend Inferences = tostring(Inferences)\r\n | summarize Count = count() by src_ip, dest_ip, Inferences, vpn_type\r\n | project src_ip, dest_ip, Inferences, vpn_type, Count\r\n );\r\nlet QueryResults = (\r\nFilteredVPN\r\n| extend Inferences_string = tostring(Inferences)\r\n| join kind=innerunique(VPNCount)\r\n on\r\n $left.src_ip == $right.src_ip,\r\n $left.dest_ip == $right.dest_ip,\r\n $left.Inferences_string == $right.Inferences,\r\n $left.vpn_type == $right.vpn_type\r\n| extend\r\n Source = src_ip,\r\n Responder = dest_ip,\r\n [\"VPN Type\"] = vpn_type,\r\n Count\r\n| extend NewInferences = strcat_array(Inferences, \",\")\r\n| project Source, Responder, Inferences = NewInferences, ['VPN Type'], Count\r\n| sort by Count\r\n);\r\nlet QueryCount = (\r\nQueryResults\r\n| count\r\n);\r\nlet NoResults = (\r\ndatatable ( Source: string, Responder: string , Inferences: string, ['VPN Type']: string, Count: long)\r\n[\"N/A\", \"N/A\", \"N/A\", \"N/A\", 0]\r\n);\r\nunion isfuzzy=true \r\n(QueryResults | where toscalar(QueryCount) != 0),\r\n(NoResults | where toscalar(QueryCount) == 0)", "size": 0, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "VPN Type", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "unusual remote activity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Suspected Data Exfiltration", "expandable": true, "items": [ { "type": 1, "content": { "json": "Total count of VPN connections using potentially unusual connection configurations such as static TLS key auth." }, "name": "text - 0" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where Inferences has_any (\"TLS\", \"SK\")\r\n| summarize count() by src_ip, dest_ip\r\n| count", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": true } }, "customWidth": "35", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Unmonitored commercial VPNs with a typical traffic patterns or static keys could be used to bypass security controls for data theft.\r\n\r\n#### **Investigate:** Examine VPN sessions with large outgoing transfers, focusing on unusual destinations or protocols." }, "customWidth": "65", "name": "text - 1", "styleSettings": { "margin": "30px", "padding": "10px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredVPN = (\r\n corelight_vpn\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where Inferences has_any (\"TLS\", \"SK\")\r\n );\r\nlet VPNCount = ( \r\n FilteredVPN\r\n | summarize Count = count() by src_ip, dest_ip\r\n );\r\nlet QueryResults = (\r\nFilteredVPN\r\n| extend inferences_string = tostring(replace(\",\", \":\", strcat_array(Inferences, \":\")))\r\n| join kind=leftouter(VPNCount) on src_ip, dest_ip\r\n| summarize arg_max(TimeGenerated, *) by src_ip, dest_ip\r\n| project\r\n Source = src_ip,\r\n Responder = dest_ip,\r\n Inferences = inferences_string,\r\n [\"Responder Country\"] = resp_cc,\r\n [\"VPN Type\"] = vpn_type,\r\n Count\r\n| sort by Count\r\n);\r\nlet QueryCount = (\r\nVPNCount\r\n| count \r\n);\r\nlet NoResults = (\r\ndatatable ( Source: string, Responder: string, Inferences: string, [\"Responder Country\"]: string, [\"VPN Type\"]: string, Count: long)\r\n[\"N/A\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0]\r\n);\r\nunion isfuzzy=true \r\n(QueryResults | where toscalar(QueryCount) != 0),\r\n(NoResults | where toscalar(QueryCount) == 0)", "size": 0, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Responder Country", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "3%" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "margin": "12px", "showBorder": true } } ] }, "customWidth": "50", "name": "suspected data exfiltration" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Possible Unauthorized Remote Access Attempts", "expandable": true, "items": [ { "type": 1, "content": { "json": "Total count of VPN connections that are using the RW- Road warrior configuration detected (i.e. Cisco Anyconnect) and FW - Firewall subversion inferences." }, "name": "text - 0" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "corelight_vpn\r\n| where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n| where Inferences has_any (\"RW\", \"FW\")\r\n| summarize count() by uid\r\n| count", "size": 3, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true } }, "customWidth": "30", "name": "query - 0" }, { "type": 1, "content": { "json": "#### Monitoring for \"RW\" (Road Warrior) and \"FW\" (Firewall subversion) inferences is crucial for detecting potential unauthorized access, as these patterns may indicate attempts to bypass security controls. Security teams should prioritize correlating these inferences with internal IP ranges and device logs to identify suspicious activities." }, "customWidth": "70", "name": "text - 1", "styleSettings": { "padding": "50px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FilteredVPN = (\r\n corelight_vpn\r\n | where ('*' in ({Sensor}) or sensor_name in ({Sensor}))\r\n | where Inferences has_any (\"RW\", \"FW\")\r\n );\r\nlet VPNCount = ( \r\n FilteredVPN\r\n | summarize Count = count() by uid\r\n );\r\nlet QueryResults = (\r\nFilteredVPN\r\n| join kind=leftouter(VPNCount) on uid\r\n| summarize arg_max(TimeGenerated, *) by uid\r\n| extend\r\n Source = src_ip,\r\n Responder = dest_ip,\r\n Proto = proto,\r\n Inferences = Inferences,\r\n Bytes = orig_bytes\r\n| extend NewInferences = strcat_array(todynamic(Inferences), \",\")\r\n| project\r\n Source,\r\n Responder,\r\n Proto,\r\n Inferences = NewInferences,\r\n [\"Dest Port\"] = dest_port,\r\n Bytes,\r\n Count\r\n| sort by Count\r\n);\r\nlet QueryCount = (\r\nVPNCount\r\n| count \r\n);\r\nlet NoResults = (\r\ndatatable ( Source: string, Responder: string, Proto: string, Inferences: string, [\"Dest Port\"]: string, Bytes: string , Count: long)\r\n[\"No Results\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", \"N/A\", 0]\r\n);\r\nunion isfuzzy=true \r\n(QueryResults | where toscalar(QueryCount) != 0),\r\n(NoResults | where toscalar(QueryCount) == 0)\r\n| extend [\"Dest Port\"] = coalesce(tostring(toint(['Dest Port_int'])), ['Dest Port_string']), Bytes = coalesce(tostring(tolong(Bytes_long)), Bytes_string)\r\n| project-away ['Dest Port_*'], Bytes_*\r\n| project-reorder \r\n Source,\r\n Responder,\r\n Proto,\r\n Inferences,\r\n [\"Dest Port\"],\r\n Bytes,\r\n Count", "size": 0, "showAnalytics": true, "noDataMessage": "No data found.", "timeContextFromParameter": "GlobalTimeRestriction", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "name": "possible unauthorized remote access attempts" } ] }, "name": "vpn insights" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "RemoteActivityInsights" }, "name": "group - 14" } ] }, "name": "Data Insights" }, { "type": 1, "content": { "json": "📝 **Refresh the web page to fetch details of recently collected events**" }, "name": "text - 5" } ], "fromTemplateId": "sentinel-Corelight_Data_Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }