{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6de26de7-0eec-4312-b568-9fbbaf5c7f71", "version": "KqlParameterItem/1.0", "name": "bhe_tenant", "label": "BHE Tenant", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL \n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "cb118fcd-4473-4470-ac89-28c6ea644d5d", "version": "KqlParameterItem/1.0", "name": "domain_name", "label": "Environment", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL \n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| distinct domain_name", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "9e7a3119-3a53-4df7-8878-d2b56a948732", "version": "KqlParameterItem/1.0", "name": "severity", "label": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "BHEAttackPathsData_CL\r\n| where isnotempty(Severity)\r\n| where tenant_url in~ ({bhe_tenant})\r\n| where domain_name in~ ({domain_name})\r\n| distinct Severity\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "dafad90f-2d00-41cd-9463-efbe87d3888f", "version": "KqlParameterItem/1.0", "name": "time", "label": "Time Range Picker", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 604800000 }, "key": "dafad90f-2d00-41cd-9463-efbe87d3888f" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| summarize arg_max(TimeGenerated, *) by id, domain_name, tenant_url\n| summarize TotalAttackPathsFindings = dcount(id) by DomainName = domain_name\n| sort by TotalAttackPathsFindings desc", "size": 1, "title": "Total Attack Paths Findings per Domain", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "DomainName", "formatter": 1 }, "centerContent": { "columnMatch": "TotalAttackPathsFindings", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showLegend": true } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| summarize arg_max(TimeGenerated, *) by id, domain_name, tenant_url\n| summarize Count = dcount(id) by Severity\n| sort by Count desc\n", "size": 0, "title": "Severity Breakdown", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| summarize arg_max(TimeGenerated, *) by id\n| where isnotempty(NonTierZeroPrincipalName)\n| summarize FindingsCount = count() by NonTierZeroPrincipalName, domain_name\n| project-rename Environment = domain_name\n| sort by FindingsCount desc\n| take 5\n", "size": 1, "aggregation": 2, "title": "Top 5 Non-Tier Zero Principals Involved in Findings", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "chartSettings": { "xAxis": "FindingsCount", "yAxis": [ "FindingsCount" ], "showLegend": true } }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| summarize arg_max(TimeGenerated, *) by id, domain_name, tenant_url\n| summarize Frequency = dcount(id) by Finding\n| project-rename [\"Finding Key\"] = Finding\n| sort by Frequency desc\n| take 5\n", "size": 1, "title": "Top 5 Most Common Findings (Finding Keys)", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Frequency", "formatter": 3, "formatOptions": { "palette": "blue" } } ] }, "chartSettings": { "showLegend": true } }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| partition by domain_name\n(\n summarize arg_max(TimeGenerated, *) by id, domain_name, tenant_url\n| summarize Frequency = dcount(id) by domain_name, Finding\n| sort by Frequency desc\n| take 5\n)\n| sort by Frequency desc", "size": 0, "title": "Top 5 Most Common Findings (Finding Keys) per Environment", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Frequency", "formatter": 3, "formatOptions": { "palette": "blue" } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "domain_name" ], "expandTopLevel": true }, "labelSettings": [ { "columnId": "domain_name", "label": "Environment" } ] }, "chartSettings": { "showLegend": true } }, "name": "query - 9 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BHEAttackPathsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where Severity in~ ({severity})\n| where updated_at {time}\n| summarize arg_max(TimeGenerated, *) by id, domain_name, tenant_url\n| extend exposure_val = toreal(ExposurePercentage),\n impact_val = toreal(ImpactPercentage)\n| extend exposure_pct = iif(isnull(exposure_val), round(impact_val, 2), round(exposure_val, 2))\n| extend impact_pct = round(impact_val, 2)\n| summarize \n ExposurePercent = max(exposure_pct),\n ImpactPercent = max(impact_pct),\n Count = count()\n by Environment = domain_name, AttackPath = PathTitle, Severity\n| project Environment, AttackPath, Severity, Count, ['Exposure (%)'] = ExposurePercent, ['Impact (%)'] = ImpactPercent\n| sort by ['Exposure (%)'] desc\n", "size": 0, "title": "All Attack Paths List", "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 500 } }, "name": "query - 11" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-BloodHoundEnterprise", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }