Prevalence (y-axis) - The malware has been reported as related to elements that are part of an organization context (e.g. industry, peers, third parties, brand, IPs & Domains). \n
\n\nOpportunity (x-axis) - A correlation between the malware related capabilities and an organization’s vulnerabilities. Vulnerabilities include an organization's exposures, gaps, or technology-related vulnerabilities.
\nData is fetched from Recorded Future thru the playbook **RecordedFuture-ThreatMapMalware-Importer**.\n\n\n", "style": "info" }, "customWidth": "50", "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "RecordedFutureThreatMapMalware_V2_CL\n| where TimeGenerated {TimeRange:query}\n| mv-expand malware = todynamic(data)\n| extend id_s = tostring(malware.id), name_s = tostring(malware.name), prevalence_d = toreal(malware.prevalence), opportunity_d = toreal(malware.opportunity), categories_s = tostring(malware.categories), log_entries_s = tostring(malware.log_entries)\n| where categories_s has_any('{Category}')\n| where log_entries_s has_any('{Watchlist}')\n| project TimeGenerated, id_s, name_s, prevalence_d, opportunity_d, combine = prevalence_d + opportunity_d\n| order by combine desc \n| summarize MaxTimeGenerated = max(TimeGenerated) by id_s, name_s, prevalence_d, opportunity_d\n| take 100\n| project MaxTimeGenerated, id_s, name_s, prevalence_d, opportunity_d", "size": 0, "title": "Threat Malware Map", "noDataMessage": "No data found", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "scatterchart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "id_s", "formatter": 1 }, "centerContent": { "columnMatch": "intent_d", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "opportunity_d", "yAxis": [ "prevalence_d" ], "group": "name_s", "createOtherGroup": 0, "showMetrics": false, "showLegend": true, "xSettings": { "min": 0, "max": 99 }, "ySettings": { "min": 0, "max": 99 } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "intent_d", "sizeAggregation": "Sum", "legendMetric": "intent_d", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "intent_d", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 0 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "RecordedFutureThreatMapMalware_V2_CL \n| where TimeGenerated {TimeRange:query}\n| mv-expand malware = todynamic(data)\n| extend id_s = tostring(malware.id), name_s = tostring(malware.name), prevalence_d = toreal(malware.prevalence), opportunity_d = toreal(malware.opportunity), categories_s = tostring(malware.categories), log_entries_s = tostring(malware.log_entries)\n| where categories_s has_any('{Category}')\n| where log_entries_s has_any('{Watchlist}')\n| extend combine= prevalence_d+opportunity_d\n| summarize MaxTimeGenerated = max(TimeGenerated) by id_s, name_s, prevalence_d, opportunity_d,combine\n| project Name=name_s, Prevalence=prevalence_d, Opportunity=opportunity_d, id_s, combine\n| order by combine desc \n", "size": 0, "title": "Threat Malware", "exportFieldName": "id_s", "exportParameterName": "ThreatMalware", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "id_s", "formatter": 5 }, { "columnMatch": "combine", "formatter": 5 } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "RecordedFutureThreatMapMalware_V2_CL\n| where TimeGenerated {TimeRange:query}\n| mv-expand malware = todynamic(data)\n| extend id_s = tostring(malware.id), name_s = tostring(malware.name), categories_s = tostring(malware.categories), log_entries_s = tostring(malware.log_entries), alias_s = tostring(malware.alias)\n| where id_s == \"{ThreatMalware}\"\n| take 1\n| mv-expand watchlistArray = parse_json(log_entries_s)\n| mv-expand categoriesArray= parse_json(categories_s)\n| summarize [\"Threat Malware Categories\"] = make_set(categoriesArray.name), WatchLists= make_set(watchlistArray.watchlist.name) by Link=strcat(\"https://app.recordedfuture.com/live/sc/entity/\",id_s), Name=name_s, Id=id_s, Aliases=array_strcat(parse_json(alias_s),',')", "size": 4, "title": "Malware Details", "noDataMessage": "Please select a threat malware in the Threat Malware table to display details.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "External Link" } }, { "columnMatch": "Id", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkLabel": "Open Generic Details", "linkIsContextBlade": true } }, { "columnMatch": "Threat Malware Categories", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "150ch" } }, { "columnMatch": "https://app.recordedfuture.com/live/sc/entity/{Id}", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "" } }, { "columnMatch": "Categories", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "150ch" } }, { "columnMatch": "id_s", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkLabel": "Open Generic Details", "linkIsContextBlade": true } } ], "labelSettings": [ { "columnId": "Link", "label": "Recorded Future" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Id", "formatter": 1 }, "leftContent": { "columnMatch": "Intent", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicators\r\n| where ValidUntil > now()\r\n| where Data.description contains(\"{ThreatMalware}\")\r\n| summarize Indicators=count(Data.description) by tostring(Data.description)", "size": 0, "title": "Active Indicators for Hunting", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "Description", "formatter": 1 }, "leftContent": { "columnMatch": "Indicators", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "Indicators", "sortOrderField": 2, "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Description", "formatter": 1 }, "centerContent": { "columnMatch": "Indicators", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| where Title contains \"{ThreatMalware}\"\r\n| summarize CreateTime = max(CreatedTime) by IncidentUrl, Title,Description ", "size": 0, "title": "Incidents created", "noDataMessage": "No incidents found, but try different time range to display incidents future back in time.", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } } ] } }, "customWidth": "50", "name": "query - 8" }, { "type": 1, "content": { "json": "To generate incidents using imported indicators. Create analytic rules that correlates data from infrastructure logs with recorded future hunting indicators. Install and modify the provided analytic rule templates to match your environent. \r\n```\r\nRecorded Future - Threat Hunting - Domain - All Malware\r\nRecorded Future - Threat Hunting - IP - All Malware\r\nRecorded Future - Threat Hunting - Hash - All Malware\r\nRecorded Future - Threat Hunting - Url - All Malware\r\n```\r\nInstall and configure Recorded Future Incident Enrichment Playbook to get additional information when incidents are created ```RecordedFuture-IOC_Enrichment-IP_Domain_URL_Hash```\r\n", "style": "info" }, "name": "text - 7" } ], "styleSettings": { "paddingStyle": "none", "spacingStyle": "none" }, "fromTemplateId": "sentinel-RecordedFutureThreatActorHuntingWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }