{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Network Session Essentials\n---\n" }, "name": "text - 2" }, { "type": 1, "content": { "json": "The Microsoft Sentinel Domain Solution for Network sessions provides real-time insights into activity and potential threats in your network. This solution is designed for Network teams, Security Architects, Analysts and Consultants to monitor network assets, as well as identify and investigate network threats. The workbook gives a summary of analyzed traffic, helps with threat analysis and investigating suspicious IP’s, it also gives traffic analysis. ", "style": "info" }, "name": "text - 6" }, { "type": 1, "content": { "json": "The \"SummarizedData\" playbook installed along with the Solution helps in summarizing the logs and improves the performance of workbooks and data searches. It is highly recommended to run the playbook to utilize the best capabilities of this workbook.", "style": "warning" }, "name": "text - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "af8c6e44-af5f-49b3-b64c-b35f1db29003", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 1209600000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 } ], "allowCustom": false }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "4326117d-592d-452d-82a2-c06837937d89", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "Traffic Analysis - Summary", "subTarget": "summary", "style": "link" }, { "id": "e8ec7baf-fada-4dbc-bd28-e1b939636787", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "Traffic Analysis - Detailed", "subTarget": "detailed", "style": "link" }, { "id": "22b74130-7c95-43b4-8439-def057191a35", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "Threat Analysis", "subTarget": "threat", "style": "link" }, { "id": "c9b48e95-0d96-4526-86af-b40b817c683b", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "IP Investigation", "subTarget": "ipinvest", "style": "link" } ] }, "name": "links - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Summary of Traffic Analysis", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTimeIp = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet maxSummarizedTimeSource = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_sourceInfo_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet totalConnection = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTimeIp),endtime=now())\r\n\t\t| where isnotempty(SrcIpAddr) and isnotempty(DstIpAddr)\r\n\t\t| summarize count() by SrcIpAddr, DstIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where isnotempty(SrcIpAddr_s) and isnotempty(DstIpAddr_s)\r\n\t\t| summarize count() by SrcIpAddr=SrcIpAddr_s, DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize count() by SrcIpAddr, DstIpAddr\r\n | count\r\n | extend Product = \"Total Connections\", orderNum = 1\r\n;\r\nlet products = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTimeSource),endtime=now())\r\n\t\t| extend EventProduct = strcat(EventVendor,\"-\",EventProduct)\r\n | distinct EventProduct\r\n ),\r\n ( \r\n NetworkCustomAnalytics_sourceInfo_CL\r\n\t\t| distinct EventProduct_s\r\n\t\t| extend EventProduct=EventProduct_s\r\n )\r\n | distinct EventProduct\r\n | count\r\n | extend Product = \"Different Products\", orderNum = 2\r\n;\r\nlet sources = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTimeIp),endtime=now())\r\n\t\t| where isnotempty(SrcIpAddr)\r\n\t\t| summarize count() by SrcIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where isnotempty(SrcIpAddr_s)\r\n\t\t| summarize count() by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize count() by SrcIpAddr\r\n | count\r\n | extend Product = \"Unique Sources\", orderNum = 3\r\n;\r\nlet destinations = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTimeIp),endtime=now())\r\n\t\t| where isnotempty(DstIpAddr)\r\n\t\t| summarize count() by DstIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where isnotempty(DstIpAddr_s)\r\n\t\t| summarize count() by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize count() by DstIpAddr\r\n | count\r\n | extend Product = \"Unique Destinations\", orderNum = 4\r\n;\r\nlet blockedTraffic = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTimeIp),endtime=now(),dvcaction=dynamic([\"Deny\",\"Drop\"]))\r\n\t\t| where isnotempty(SrcIpAddr) and isnotempty(DstIpAddr)\r\n\t\t| summarize count() by SrcIpAddr, DstIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where DvcAction_s in (\"Deny\",\"Drop\")\r\n\t\t| where isnotempty(SrcIpAddr_s) and isnotempty(DstIpAddr_s)\r\n\t\t| summarize count() by SrcIpAddr=SrcIpAddr_s, DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize count() by SrcIpAddr,DstIpAddr\r\n | count\r\n | extend Product = \"Blocked Traffic\", orderNum = 5\r\n;\r\nunion totalConnection, products, sources, destinations, blockedTraffic\r\n| order by orderNum asc", "size": 4, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "Product", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Total Connections", "representation": "Available", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Different Products", "representation": "Connect", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Unique Sources", "representation": "Publish", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Unique Destinations", "representation": "Publish", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Blocked Traffic", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Bytes Received (MB)", "representation": "trenddown", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Bytes Sent (MB)", "representation": "trendup", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 }, "emptyValCustomText": "0" } }, "showBorder": true, "sortCriteriaField": "Count", "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Product", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Traffic - Connections" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(EventSeverity)\r\n | summarize Instances=toint(count()) by EventSeverity, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(EventSeverity_s)\r\n | summarize Instances=toint(sum(count__d)) by EventSeverity=EventSeverity_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by EventSeverity, bin(TimeGenerated, 6h)", "size": 1, "title": "Change in Severity of Events over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "sortBy": [] }, "customWidth": "50", "name": "Traffic - Severity", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DvcAction)\r\n | summarize Instances=toint(count()) by DvcAction, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(DvcAction_s)\r\n | summarize Instances=toint(sum(count__d)) by DvcAction=DvcAction_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by DvcAction, bin(TimeGenerated, 6h)", "size": 1, "title": "Change in Device Action over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "tileSettings": { "titleContent": { "columnMatch": "DvcAction", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 19, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "50", "name": "Traffic - Action", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(NetworkDirection)\r\n | summarize Instances=toint(count()) by NetworkDirection, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(NetworkDirection_s)\r\n | summarize Instances=toint(sum(count__d)) by NetworkDirection=NetworkDirection_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by NetworkDirection, bin(TimeGenerated, 6h)", "size": 1, "title": "Change in Network Direction over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "DvcAction", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 19, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "50", "name": "Traffic - NetworkDirection", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(EventResult)\r\n | summarize Instances=toint(count()) by EventResult, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(EventResult_s)\r\n | summarize Instances=toint(sum(count__d)) by EventResult=EventResult_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by EventResult, bin(TimeGenerated, 6h)", "size": 1, "title": "Change in Event Result over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "titleContent": { "columnMatch": "DvcAction", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 19, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "50", "name": "Traffic - EventResult", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_sourceInfo_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | extend EventProduct = strcat(EventVendor,\"-\",EventProduct)\r\n | summarize Instances=toint(count()) by EventProduct, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_sourceInfo_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(EventProduct_s)\r\n | summarize Instances=toint(sum(count__d)) by EventProduct=EventProduct_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by EventProduct, bin(TimeGenerated, 6h)", "size": 1, "title": "Events by Source Type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "Traffic - Source Type", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_sourceInfo_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DvcHostname)\r\n | summarize Instances=toint(count()) by DvcHostname, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_sourceInfo_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(DvcHostname_s)\r\n | summarize Instances=toint(sum(count__d)) by DvcHostname=DvcHostname_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by DvcHostname, bin(TimeGenerated, 6h)", "size": 1, "title": "Events by Device Hostname", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "50", "name": "Traffic - Device Hostname", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DstAppName)\r\n | summarize Instances=toint(count()) by DstAppName, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(DstAppName_s)\r\n | summarize Instances=toint(sum(count__d)) by DstAppName=DstAppName_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by DstAppName, bin(TimeGenerated, 6h)", "size": 1, "title": "Events by Destination Applications ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar" }, "customWidth": "50", "name": "Traffic - Destination Application", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(Rule)\r\n | summarize Instances=toint(count()) by Rule\r\n ),\r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | extend Rule = coalesce(Rule_s,Rule_g)\r\n\t | where isnotempty(Rule)\r\n | summarize Instances=toint(sum(count__d)) by Rule\r\n )\r\n | summarize Instances = sum(Instances) by Rule\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Rules", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Rule", "formatter": 1 }, "secondaryContent": { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false } }, "customWidth": "50", "name": "Security - Rules", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "summary" }, "name": "Group - Traffic - Summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Detailed Analysis of Traffic", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d3dd80a6-e4d6-49b3-babb-306f4a1fea5e", "cellValue": "basedOn", "linkTarget": "parameter", "linkLabel": "Based on Network Direction", "subTarget": "direction", "style": "link" }, { "id": "029e4bbb-bb1e-408b-8a33-3718a6e0aae3", "cellValue": "basedOn", "linkTarget": "parameter", "linkLabel": "Based on Device Action", "subTarget": "action", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Analysis of Events based on Network Direction", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | summarize Instances=toint(count()) by NetworkDirection, DvcAction\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize Instances=toint(sum(count__d)) by NetworkDirection=NetworkDirection_s, DvcAction=DvcAction_s\r\n )\r\n | summarize Instances = sum(Instances) by NetworkDirection, DvcAction", "size": 0, "title": "Traffic by Severity and Action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "hierarchySettings": { "treeType": 1, "groupBy": [ "NetworkDirection" ], "expandTopLevel": true }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 1 } ], "chartSettings": { "yAxis": [ "Instances" ] } }, "name": "Traffic - Detailed", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "8e0a0daa-5a7c-492a-995f-7f0e7fbf2b93", "cellValue": "TrafficSubTabVisibility", "linkTarget": "parameter", "linkLabel": "Inbound Traffic", "subTarget": "inbound", "style": "link" }, { "id": "6cd8378a-b5d4-4c0e-8a28-0c4af987206e", "cellValue": "TrafficSubTabVisibility", "linkTarget": "parameter", "linkLabel": "Outbound Traffic", "subTarget": "outbound", "style": "link" } ] }, "name": "links - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Inbound Traffic", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\" and isnotempty(EventSeverity)\r\n | summarize Instances=toint(count()) by EventSeverity\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\" and isnotempty(EventSeverity_s)\r\n | summarize Instances=toint(sum(count__d)) by EventSeverity=EventSeverity_s\r\n )\r\n | summarize Instances = sum(Instances) by EventSeverity", "size": 1, "title": "Inbound Traffic by Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Instances" ] } }, "customWidth": "33", "name": "Traffic - Inbound - Severity", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\" and isnotempty(DvcAction)\r\n | summarize Instances=toint(count()) by DvcAction\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\" and isnotempty(DvcAction_s)\r\n | summarize Instances=toint(sum(count__d)) by DvcAction=DvcAction_s\r\n )\r\n | summarize Instances = sum(Instances) by DvcAction", "size": 1, "title": "Inbound Traffic by Device Action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "DvcAction", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "DvcAction", "yAxis": [ "Instances" ], "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "Traffic - Inbound - Device Action", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\" and isnotempty(EventResult)\r\n | summarize Instances=toint(count()) by EventResult\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\" and isnotempty(EventResult_s)\r\n | summarize Instances=toint(sum(count__d)) by EventResult=EventResult_s\r\n )\r\n | summarize Instances = sum(Instances) by EventResult", "size": 1, "title": "Inbound Traffic by Event Result", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "EventResult", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "sortCriteriaField": "EventResult", "sortOrderField": 2, "size": "full" }, "chartSettings": { "xAxis": "EventResult", "yAxis": [ "Instances" ], "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "Traffic - Inbound - EventResult", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\"\r\n | summarize Instances=toint(count()) by bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\"\r\n | summarize Instances=toint(sum(count__d)) by TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by bin(TimeGenerated,1h)", "size": 1, "title": "Inbound Traffic over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 3, "formatOptions": { "min": 0, "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "EventResult", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "sortCriteriaField": "EventResult", "sortOrderField": 2, "size": "full" }, "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "Instances" ], "showMetrics": false } }, "name": "Traffic - Inbound - Trend", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\" and isnotempty(SrcGeoCountry)\r\n | summarize Instances=toint(count()) by SrcGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\" and isnotempty(SrcGeoCountry_s)\r\n | summarize Instances=toint(sum(count__d)) by SrcGeoCountry=SrcGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcGeoCountry\r\n | order by Instances\r\n | take 5", "size": 0, "title": "Traffic by Source Country", "exportFieldName": "SrcGeoCountry", "exportParameterName": "SrcGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "SrcGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "numberOfMetrics": 5, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "Traffic - 6", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\" and isnotempty(NetworkProtocol)\r\n | summarize Instances=toint(count()) by NetworkProtocol, bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\" and isnotempty(NetworkProtocol_s)\r\n | summarize Instances=toint(sum(count__d)) by NetworkProtocol=NetworkProtocol_s, TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by NetworkProtocol, bin(TimeGenerated,1h)", "size": 0, "title": "Traffic by Protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "NetworkProtocol", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "yAxis": [ "Instances" ] } }, "customWidth": "50", "showPin": false, "name": "Traffic - 7", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(Rule) and NetworkDirection == \"Inbound\"\r\n | summarize Instances=toint(count()) by Rule, bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | extend Rule = coalesce(Rule_s,Rule_g)\r\n\t | where isnotempty(Rule) and NetworkDirection_s == \"Inbound\"\r\n | summarize Instances=toint(sum(count__d)) by Rule, TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by Rule, bin(TimeGenerated, 1h)\r\n | order by Instances\r\n | take 5", "size": 0, "title": "Traffic by Firewall Rule", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ] } }, "customWidth": "50", "showPin": false, "name": "Traffic - 8", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\n union isfuzzy=true \n (\n NetworkCustomAnalytics_ip_CL\n | where EventTime_t >= {TimeRange:start}\n | summarize max_TimeGenerated=max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\n ),\n (\n print({TimeRange:start})\n | extend max_TimeGenerated = print_0\n | project max_TimeGenerated\n )\n | summarize maxTimeGenerated = max(max_TimeGenerated) \n );\nunion isfuzzy=true \n (\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\n\t | where NetworkDirection == \"Inbound\"\n\t | where isnotempty(SrcIpAddr) and isnotempty(DstIpAddr)\n\t | summarize NumberOfConnections=toint(count()) by SrcIpAddr, DstIpAddr\n ),\n (\n NetworkCustomAnalytics_ip_CL\n | where EventTime_t >= {TimeRange:start}\n\t | where NetworkDirection_s == \"Inbound\"\n\t | where isnotempty(SrcIpAddr_s) and isnotempty(DstIpAddr_s)\n\t | summarize NumberOfConnections=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, DstIpAddr=DstIpAddr_s\n )\n | summarize NumberOfConnections = sum(NumberOfConnections) by SrcIpAddr, DstIpAddr\n | order by NumberOfConnections\n | take 10", "size": 0, "title": "Top 10 Connections", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "SrcIpAddr", "parameterName": "SrcIpAddrConn", "parameterType": 1 }, { "fieldName": "DstIpAddr", "parameterName": "DstIpAddrConn", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "NumberOfConnections", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "Traffic - 5", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\"\r\n\t | where isnotempty(SrcIpAddr)\r\n\t | summarize Instances=toint(count()) by SrcIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\"\r\n\t | where isnotempty(SrcIpAddr_s)\r\n\t | summarize Instances=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcIpAddr\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Source IP", "timeContextFromParameter": "TimeRange", "exportFieldName": "SrcIpAddr", "exportParameterName": "SrcIpAddr", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SrcIpAddr", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "customWidth": "25", "name": "Traffic - 1", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(SrcPortNumber) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by toint(SrcPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcPortNumber_d) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcPortNumber=toint(SrcPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by SrcPortNumber\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Source Ports", "exportFieldName": "SrcPortNumber", "exportParameterName": "SrcPortNumber", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SrcPortNumber", "formatter": 1 }, { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SrcPortNumber", "formatter": 1 }, "secondaryContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false, "sortCriteriaField": "Instances", "sortOrderField": 2 }, "graphSettings": { "type": 2, "topContent": {}, "hivesContent": { "columnMatch": "Instances", "formatter": 1 }, "nodeIdField": "SrcPortNumber", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "groupByField": "Instances", "hivesMargin": 5 } }, "customWidth": "25", "name": "Traffic - 2", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Inbound\"\r\n\t | where isnotempty(DstIpAddr)\r\n\t | summarize Instances=toint(count()) by DstIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Inbound\"\r\n\t | where isnotempty(DstIpAddr_s)\r\n\t | summarize Instances=toint(sum(count__d)) by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by DstIpAddr\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Destination IP", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstIpAddr", "exportParameterName": "DstIpAddr", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "DstIpAddr", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "customWidth": "25", "name": "Traffic - 3", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(DstPortNumber) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by toint(DstPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstPortNumber_d) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstPortNumber=toint(DstPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by DstPortNumber\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Destination Ports", "exportFieldName": "DstPortNumber", "exportParameterName": "DstPortNumber", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DstPortNumber", "formatter": 1 }, { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "DstPortNumber", "formatter": 1 }, "secondaryContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false, "sortCriteriaField": "Instances", "sortOrderField": 2 }, "graphSettings": { "type": 2, "topContent": {}, "hivesContent": { "columnMatch": "Instances", "formatter": 1 }, "nodeIdField": "SrcPortNumber", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "groupByField": "Instances", "hivesMargin": 5 } }, "customWidth": "25", "name": "Traffic - 4", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "TrafficSubTabVisibility", "comparison": "isEqualTo", "value": "inbound" }, "name": "Group - Traffic - Inbound" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Outbound Traffic", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\" and isnotempty(EventSeverity)\r\n | summarize Instances=toint(count()) by EventSeverity\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\" and isnotempty(EventSeverity_s)\r\n | summarize Instances=toint(sum(count__d)) by EventSeverity=EventSeverity_s\r\n )\r\n | summarize Instances = sum(Instances) by EventSeverity", "size": 1, "title": "Outbound Traffic by Severity", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstGeoCountry", "exportParameterName": "DstGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Traffic - Outbound - Severity", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\" and isnotempty(DvcAction)\r\n | summarize Instances=toint(count()) by DvcAction\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\" and isnotempty(DvcAction_s)\r\n | summarize Instances=toint(sum(count__d)) by DvcAction=DvcAction_s\r\n )\r\n | summarize Instances = sum(Instances) by DvcAction", "size": 1, "title": "Outbound Traffic by Device Action", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstGeoCountry", "exportParameterName": "DstGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "33", "name": "Traffic - Outbound - DeviceAction", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\" and isnotempty(EventResult)\r\n | summarize Instances=toint(count()) by EventResult\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\" and isnotempty(EventResult_s)\r\n | summarize Instances=toint(sum(count__d)) by EventResult=EventResult_s\r\n )\r\n | summarize Instances = sum(Instances) by EventResult", "size": 1, "title": "Outbound Traffic by Event Result", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstGeoCountry", "exportParameterName": "DstGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "NetworkProtocol", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showLegend": true } }, "customWidth": "33", "name": "Traffic - Outbound - EventResult", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\"\r\n | summarize Instances=toint(count()) by bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\"\r\n | summarize Instances=toint(sum(count__d)) by TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by bin(TimeGenerated,1h)", "size": 1, "title": "Outbound Traffic over time", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstGeoCountry", "exportParameterName": "DstGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "NetworkProtocol", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showMetrics": false } }, "name": "Traffic - Outbound - Trend", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\" and isnotempty(DstGeoCountry)\r\n | summarize Instances=toint(count()) by DstGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\" and isnotempty(DstGeoCountry_s)\r\n | summarize Instances=toint(sum(count__d)) by DstGeoCountry=DstGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by DstGeoCountry\r\n | order by Instances\r\n | take 5", "size": 0, "title": "Traffic by Destination Country", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstGeoCountry", "exportParameterName": "DstGeoCountry", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "DstGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "numberOfMetrics": 5, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "Traffic - 6", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\" and isnotempty(NetworkProtocol)\r\n | summarize Instances=toint(count()) by NetworkProtocol, bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\" and isnotempty(NetworkProtocol_s)\r\n | summarize Instances=toint(sum(count__d)) by NetworkProtocol=NetworkProtocol_s, TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by NetworkProtocol, bin(TimeGenerated,1h)", "size": 0, "title": "Traffic by Protocol", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "NetworkProtocol", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "yAxis": [ "Instances" ] } }, "customWidth": "50", "showPin": false, "name": "Traffic - 7", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(Rule) and NetworkDirection == \"Outbound\"\r\n | summarize Instances=toint(count()) by Rule, bin(TimeGenerated,1h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_rule_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | extend Rule = coalesce(Rule_s,Rule_g)\r\n\t | where isnotempty(Rule) and NetworkDirection_s == \"Outbound\"\r\n | summarize Instances=toint(sum(count__d)) by Rule, TimeGenerated=bin(EventTime_t,1h)\r\n )\r\n | summarize Instances = sum(Instances) by Rule, bin(TimeGenerated, 1h)\r\n | order by Instances\r\n | take 5", "size": 0, "title": "Traffic by Firewall Rule", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ] } }, "customWidth": "50", "showPin": false, "name": "Traffic - 8", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\n union isfuzzy=true \n (\n NetworkCustomAnalytics_ip_CL\n | where EventTime_t >= {TimeRange:start}\n | summarize max_TimeGenerated=max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\n ),\n (\n print({TimeRange:start})\n | extend max_TimeGenerated = print_0\n | project max_TimeGenerated\n )\n | summarize maxTimeGenerated = max(max_TimeGenerated) \n );\nunion isfuzzy=true \n (\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\n\t | where NetworkDirection == \"Outbound\"\n\t | where isnotempty(SrcIpAddr) and isnotempty(DstIpAddr)\n\t | summarize NumberOfConnections=toint(count()) by SrcIpAddr, DstIpAddr\n ),\n (\n NetworkCustomAnalytics_ip_CL\n | where EventTime_t >= {TimeRange:start}\n\t | where NetworkDirection_s == \"Outbound\"\n\t | where isnotempty(SrcIpAddr_s) and isnotempty(DstIpAddr_s)\n\t | summarize NumberOfConnections=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, DstIpAddr=DstIpAddr_s\n )\n | summarize NumberOfConnections = sum(NumberOfConnections) by SrcIpAddr, DstIpAddr\n | order by NumberOfConnections\n | take 10", "size": 0, "title": "Top 10 Connections", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "SrcIpAddr", "parameterName": "SrcIpAddrConn", "parameterType": 1 }, { "fieldName": "DstIpAddr", "parameterName": "DstIpAddrConn", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "NumberOfConnections", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "Traffic - 5", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\"\r\n\t | where isnotempty(SrcIpAddr)\r\n\t | summarize Instances=toint(count()) by SrcIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\"\r\n\t | where isnotempty(SrcIpAddr_s)\r\n\t | summarize Instances=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcIpAddr\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Source IP", "timeContextFromParameter": "TimeRange", "exportFieldName": "SrcIpAddr", "exportParameterName": "SrcIpAddr", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [] } } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SrcIpAddr", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "customWidth": "25", "name": "Traffic - 1", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(SrcPortNumber) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by toint(SrcPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcPortNumber_d) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcPortNumber=toint(SrcPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by SrcPortNumber\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Source Ports", "timeContextFromParameter": "TimeRange", "exportFieldName": "SrcPortNumber", "exportParameterName": "SrcPortNumber", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SrcPortNumber", "formatter": 1 }, { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SrcPortNumber", "formatter": 1 }, "secondaryContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false, "sortCriteriaField": "Instances", "sortOrderField": 2 }, "graphSettings": { "type": 2, "topContent": {}, "hivesContent": { "columnMatch": "Instances", "formatter": 1 }, "nodeIdField": "SrcPortNumber", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "groupByField": "Instances", "hivesMargin": 5 } }, "customWidth": "25", "name": "Traffic - 2", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where NetworkDirection == \"Outbound\"\r\n\t | where isnotempty(DstIpAddr)\r\n\t | summarize Instances=toint(count()) by DstIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where NetworkDirection_s == \"Outbound\"\r\n\t | where isnotempty(DstIpAddr_s)\r\n\t | summarize Instances=toint(sum(count__d)) by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by DstIpAddr\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Destination IP", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstIpAddr", "exportParameterName": "DstIpAddr", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "DstIpAddr", "formatter": 1 }, "leftContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false } }, "customWidth": "25", "name": "Traffic - 3", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(DstPortNumber) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by toint(DstPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstPortNumber_d) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstPortNumber=toint(DstPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by DstPortNumber\r\n | order by Instances\r\n | take 10", "size": 0, "title": "Top 10 Destination Ports", "timeContextFromParameter": "TimeRange", "exportFieldName": "DstPortNumber", "exportParameterName": "DstPortNumber", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DstPortNumber", "formatter": 1 }, { "columnMatch": "Instances", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "DstPortNumber", "formatter": 1 }, "secondaryContent": { "columnMatch": "Instances", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "showBorder": false, "sortCriteriaField": "Instances", "sortOrderField": 2 }, "graphSettings": { "type": 2, "topContent": {}, "hivesContent": { "columnMatch": "Instances", "formatter": 1 }, "nodeIdField": "SrcPortNumber", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "groupByField": "Instances", "hivesMargin": 5 } }, "customWidth": "25", "name": "Traffic - 4", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "TrafficSubTabVisibility", "comparison": "isEqualTo", "value": "outbound" }, "name": "Group - Traffic - Outbound" } ] }, "conditionalVisibility": { "parameterName": "basedOn", "comparison": "isEqualTo", "value": "direction" }, "name": "Traffic - Network Direction" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Analysis of Events based on Device Action", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "7feab473-8ca8-48e3-a061-19b30176fe6f", "cellValue": "actionTab", "linkTarget": "parameter", "linkLabel": "Allowed Events", "subTarget": "allow", "style": "link" }, { "id": "75b65a5f-6274-4c45-a0e6-7f871ef0128b", "cellValue": "actionTab", "linkTarget": "parameter", "linkLabel": "Denied Events", "subTarget": "deny", "style": "link" }, { "id": "038dc2e0-97a2-4d18-8b1e-e9a0712afea3", "cellValue": "actionTab", "linkTarget": "parameter", "linkLabel": "Dropped Events", "subTarget": "drop", "style": "link" } ] }, "name": "links - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Traffic Analysis of Allowed Events", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(NetworkProtocol)\r\n\t | summarize Instances=toint(count()) by NetworkProtocol\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(NetworkProtocol_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by NetworkProtocol=NetworkProtocol_s\r\n )\r\n | summarize Instances = sum(Instances) by NetworkProtocol\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Protocols in Allowed Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Security - 5", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcGeoCountry)\r\n\t | summarize Instances=toint(count()) by SrcGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by SrcGeoCountry=SrcGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcGeoCountry\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Source Countries in Allowed Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "SrcGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 19", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstGeoCountry)\r\n\t | summarize Instances=toint(count()) by DstGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by DstGeoCountry=DstGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by DstGeoCountry\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Destination Countries in Allowed Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "DstGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 22", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcIpAddr) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by SrcIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcIpAddr_s) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Allowed Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "SrcIpAddr", "yAxis": [ "Instances" ] } }, "customWidth": "25", "name": "Security - 8", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcPortNumber) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by toint(SrcPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcPortNumber_d) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcPortNumber=toint(SrcPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by SrcPortNumber\r\n | extend SrcPortNumber = tostring(SrcPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Ports in Allowed Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "SrcPortNumber", "yAxis": [ "Instances" ], "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 9", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstIpAddr) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by DstIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstIpAddr_s) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by DstIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Allowed Outgoing Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "25", "name": "Security - 10", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstPortNumber) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by toint(DstPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstPortNumber_d) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstPortNumber=toint(DstPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by DstPortNumber\r\n | extend DstPortNumber = tostring(DstPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Ports in Allowed Outgoing Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "DstPortNumber", "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 11", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "actionTab", "comparison": "isEqualTo", "value": "allow" }, "name": "Traffic - Allowed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Traffic Analysis of Denied Events", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(NetworkProtocol)\r\n\t | summarize Instances=toint(count()) by NetworkProtocol\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(NetworkProtocol_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by NetworkProtocol=NetworkProtocol_s\r\n )\r\n | summarize Instances = sum(Instances) by NetworkProtocol\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Protocols in Denied Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Security - 6", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcGeoCountry)\r\n\t | summarize Instances=toint(count()) by SrcGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by SrcGeoCountry=SrcGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcGeoCountry\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Source Countries in Denied Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "SrcGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 20", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstGeoCountry)\r\n\t | summarize Instances=toint(count()) by DstGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by DstGeoCountry=DstGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by DstGeoCountry\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Destination Countries in Denied Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "DstGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 23", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcIpAddr) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by SrcIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcIpAddr_s) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Denied Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "25", "name": "Security - 12", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcPortNumber) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by toint(SrcPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcPortNumber_d) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcPortNumber=toint(SrcPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by SrcPortNumber\r\n | extend SrcPortNumber = tostring(SrcPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Ports in Denied Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "SrcPortNumber", "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 13", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstIpAddr) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by DstIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstIpAddr_s) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by DstIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Denied Outgoing Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "25", "name": "Security - 14", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstPortNumber) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by toint(DstPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstPortNumber_d) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstPortNumber=toint(DstPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by DstPortNumber\r\n | extend DstPortNumber = tostring(DstPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Ports in Denied Outgoing Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "DstPortNumber", "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 15", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "actionTab", "comparison": "isEqualTo", "value": "deny" }, "name": "Traffic - Denied" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Traffic Analysis of Dropped Events", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(NetworkProtocol)\r\n\t | summarize Instances=toint(count()) by NetworkProtocol\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(NetworkProtocol_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by NetworkProtocol=NetworkProtocol_s\r\n )\r\n | summarize Instances = sum(Instances) by NetworkProtocol\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Protocols in Dropped Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Security - 7", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcGeoCountry)\r\n\t | summarize Instances=toint(count()) by SrcGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by SrcGeoCountry=SrcGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcGeoCountry\r\n | order by Instances\r\n | take 5\r\n", "size": 1, "title": "Top 5 Source Countries in Dropped Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "SrcGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 21", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstGeoCountry)\r\n\t | summarize Instances=toint(count()) by DstGeoCountry\r\n ),\r\n (\r\n NetworkCustomAnalytics_country_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstGeoCountry_s) and DvcAction_s in (actions)\r\n\t | summarize Instances=toint(sum(count__d)) by DstGeoCountry=DstGeoCountry_s\r\n )\r\n | summarize Instances = sum(Instances) by DstGeoCountry\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Destination Countries in Dropped Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "DstGeoCountry", "sizeSettings": "Instances", "sizeAggregation": "Sum", "legendMetric": "Instances", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Instances", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "33", "name": "Security - 24", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcIpAddr) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by SrcIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcIpAddr_s) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcIpAddr=SrcIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by SrcIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Dropped Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "25", "name": "Security - 18", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(SrcPortNumber) and NetworkDirection == \"Inbound\"\r\n\t | summarize Instances=toint(count()) by toint(SrcPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_source_port_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(SrcPortNumber_d) and NetworkDirection_s == \"Inbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by SrcPortNumber=toint(SrcPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by SrcPortNumber\r\n | extend SrcPortNumber = tostring(SrcPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 Ports in Dropped Incoming Traffic", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "SrcPortNumber", "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 16", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\", \"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstIpAddr) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by DstIpAddr\r\n ),\r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstIpAddr_s) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstIpAddr=DstIpAddr_s\r\n )\r\n | summarize Instances = sum(Instances) by DstIpAddr\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Dropped Outgoing Traffic", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "25", "name": "Security - 16", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Drop\",\"Drop ICMP\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now(), dvcaction=actions)\r\n\t | where isnotempty(DstPortNumber) and NetworkDirection == \"Outbound\"\r\n\t | summarize Instances=toint(count()) by toint(DstPortNumber)\r\n ),\r\n (\r\n NetworkCustomAnalytics_protocol_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(DstPortNumber_d) and NetworkDirection_s == \"Outbound\"\r\n\t | summarize Instances=toint(sum(count__d)) by DstPortNumber=toint(DstPortNumber_d)\r\n )\r\n | summarize Instances = sum(Instances) by DstPortNumber\r\n | extend DstPortNumber = tostring(DstPortNumber)\r\n | order by Instances\r\n | take 5", "size": 1, "title": "Top 5 IPs in Dropped Outgoing Traffic", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "DstPortNumber", "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "25", "name": "Security - 17", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "actionTab", "comparison": "isEqualTo", "value": "drop" }, "name": "Traffic - Dropped" } ] }, "conditionalVisibility": { "parameterName": "basedOn", "comparison": "isEqualTo", "value": "action" }, "name": "Traffic - Device Action" } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "detailed" }, "name": "Group - Traffic - Detailed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Threat Landscape Analysis", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet distinctThreatCategory = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n\t\t| where isnotempty(ThreatCategory)\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_CL\r\n\t\t| where isnotempty(ThreatCategory_s)\r\n\t\t| extend ThreatCategory = ThreatCategory_s\r\n )\r\n | summarize Count=dcount(ThreatCategory)\r\n | extend Product = \"Distinct Threat Categories\", orderNum = 1\r\n;\r\nlet distinctThreats = \r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n\t\t| where isnotempty(Threat)\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_CL\r\n\t\t| where isnotempty(Threat_s)\r\n\t\t| extend Threat = Threat_s\r\n )\r\n | summarize Count=dcount(Threat)\r\n | extend Product = \"Distinct Threats\", orderNum = 2\r\n;\r\nunion distinctThreatCategory, distinctThreats\r\n| order by orderNum asc", "size": 4, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "sortBy": [ { "itemKey": "sum_NetworkBytes", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "sum_NetworkBytes", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "Product", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Distinct Threat Categories", "representation": "SmileySad", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Distinct Threats", "representation": "error", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 }, "emptyValCustomText": "0" } }, "showBorder": true, "sortCriteriaField": "Count", "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Product", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Threat - Summary" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | where isnotempty(ThreatCategory)\r\n\t | summarize Instances=toint(count()) by ThreatCategory, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(ThreatCategory_s)\r\n\t | summarize Instances=toint(sum(count__d)) by ThreatCategory=ThreatCategory_s, TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize Instances=sum(Instances) by ThreatCategory, bin(TimeGenerated,6h)", "size": 1, "title": "Events by Threat Category", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "33", "name": "Threat - 1", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t\t| extend Threat = coalesce(ThreatId,ThreatName)\r\n\t\t| where (isnotempty(Threat) or isnotempty(ThreatCategory)) and isnotempty(EventSeverity)\r\n\t\t| summarize Instances=toint(count()) by EventSeverity, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n\t | where isnotempty(EventSeverity_s)\r\n\t | summarize Instances=toint(sum(count__d)) by EventSeverity=EventSeverity_s, TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize Instances=sum(Instances) by EventSeverity, bin(TimeGenerated,6h)", "size": 1, "title": "Threat Events by Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "33", "name": "Threat - 2", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where (isnotempty(Threat) or isnotempty(ThreatCategory)) and isnotempty(DvcAction)\r\n | summarize Instances=toint(count()) by DvcAction, bin(TimeGenerated,6h)\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(DvcAction_s)\r\n | summarize Instances=toint(sum(count__d)) by DvcAction=DvcAction_s, TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize Instances=sum(Instances) by DvcAction, bin(TimeGenerated,6h)", "size": 1, "title": "Threat Events by Device Action", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "33", "name": "Threat - 3", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Allow\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getIps = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now(),dvcaction=actions)\r\n\t\t| extend IpAddr = case(NetworkDirection == \"Inbound\", SrcIpAddr,\r\n NetworkDirection == \"Outbound\", DstIpAddr,\r\n \"\")\r\n\t\t| where isnotempty(IpAddr)\r\n\t\t| distinct IpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where DvcAction_s in (actions)\r\n\t\t| extend IpAddr = case(NetworkDirection_s == \"Inbound\", SrcIpAddr_s,\r\n NetworkDirection_s == \"Outbound\", DstIpAddr_s,\r\n \"\")\r\n\t\t| where isnotempty(IpAddr)\r\n\t\t| distinct IpAddr\r\n )\r\n | distinct IpAddr;\r\nThreatIntelligenceIndicator\r\n| where NetworkIP in (getIps) ", "size": 0, "title": "Allowed Connection with Threat Intelligence Correlation", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "Threat - 6", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let actions = dynamic([\"Deny\", \"Drop\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getIps = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now(),dvcaction=actions)\r\n\t\t| extend IpAddr = case(NetworkDirection == \"Inbound\", SrcIpAddr,\r\n NetworkDirection == \"Outbound\", DstIpAddr,\r\n \"\")\r\n\t\t| where isnotempty(IpAddr)\r\n\t\t| distinct IpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_ip_CL\r\n\t\t| where DvcAction_s in (actions)\r\n\t\t| extend IpAddr = case(NetworkDirection_s == \"Inbound\", SrcIpAddr_s,\r\n NetworkDirection_s == \"Outbound\", DstIpAddr_s,\r\n \"\")\r\n\t\t| where isnotempty(IpAddr)\r\n\t\t| distinct IpAddr\r\n )\r\n | distinct IpAddr;\r\nThreatIntelligenceIndicator\r\n| where NetworkIP in (getIps) ", "size": 0, "title": "Blocked Connection with Threat Intelligence Correlation", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "Threat - 5", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_ioc_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getSourceIp = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where isnotempty(Threat)\r\n\t\t| where isnotempty(SrcIpAddr) and not(ipv4_is_private(SrcIpAddr))\r\n\t\t| distinct SrcIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where isnotempty(SrcIpAddr_s) and not(ipv4_is_private(SrcIpAddr_s))\r\n\t\t| distinct SrcIpAddr=SrcIpAddr_s\r\n )\r\n | distinct SrcIpAddr;\r\nlet getDestinationIp = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where isnotempty(Threat)\r\n\t\t| where isnotempty(DstIpAddr) and not(ipv4_is_private(DstIpAddr))\r\n\t\t| distinct DstIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where isnotempty(DstIpAddr_s) and not(ipv4_is_private(DstIpAddr_s))\r\n\t\t| distinct DstIpAddr=DstIpAddr_s\r\n )\r\n | distinct DstIpAddr;\r\nSecurityAlert\r\n| where Entities has_any (getSourceIp,getDestinationIp)", "size": 0, "title": "Security Alerts with Threat IP", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "Threat - 6", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_threat_ioc_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getSourceHostname = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n\t\t| where isnotempty(SrcHostname)\r\n\t\t| distinct SrcHostname\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where isnotempty(SrcHostname_s)\r\n\t\t| distinct SrcHostname=SrcHostname_s\r\n )\r\n | distinct SrcHostname;\r\nlet getDestinationHostname = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where isnotempty(Threat)\r\n\t\t| where isnotempty(DstHostname)\r\n\t\t| distinct DstHostname\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where isnotempty(DstHostname_s)\r\n\t\t| distinct DstHostname=DstHostname_s\r\n )\r\n | distinct DstHostname;\r\nSecurityAlert\r\n| where Entities has_any (getSourceHostname,getDestinationHostname)", "size": 0, "title": "Security Alerts with Threat Hostname", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "Threat - 7", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getIps = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where isnotempty(Threat)\r\n\t\t| where NetworkDirection == \"Inbound\"\r\n\t\t| where isnotempty(SrcIpAddr)\r\n\t\t| distinct SrcIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where NetworkDirection_s == \"Inbound\"\r\n\t\t| where isnotempty(SrcIpAddr_s)\r\n\t\t| distinct SrcIpAddr=SrcIpAddr_s\r\n )\r\n | distinct SrcIpAddr;\r\nThreatIntelligenceIndicator\r\n| where NetworkIP in (getIps)\r\n| order by TimeGenerated, ConfidenceScore\r\n| project TimeGenerated, NetworkIP, Action, ConfidenceScore, Description, ExternalIndicatorId, ExpirationDateTime, IndicatorId, ThreatType\r\n| take 10", "size": 0, "title": "Source IPs associated with Threats", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "Threat - 8", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n NetworkCustomAnalytics_ip_CL\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet getIps = union isfuzzy=true \r\n (\r\n _Im_NetworkSession(starttime=todatetime(maxSummarizedTime),endtime=now())\r\n | extend Threat = coalesce(ThreatId,ThreatName)\r\n | where isnotempty(Threat)\r\n\t\t| where NetworkDirection == \"Outbound\"\r\n\t\t| where isnotempty(DstIpAddr)\r\n\t\t| distinct DstIpAddr\r\n ),\r\n ( \r\n NetworkCustomAnalytics_threat_ioc_CL\r\n\t\t| where NetworkDirection_s == \"Outbound\"\r\n\t\t| where isnotempty(DstIpAddr_s)\r\n\t\t| distinct DstIpAddr=DstIpAddr_s\r\n )\r\n | distinct DstIpAddr;\r\nThreatIntelligenceIndicator\r\n| where NetworkIP in (getIps)\r\n| order by TimeGenerated, ConfidenceScore\r\n| project TimeGenerated, NetworkIP, Action, ConfidenceScore, Description, ExternalIndicatorId, ExpirationDateTime, IndicatorId, ThreatType\r\n| take 10", "size": 0, "title": "Destination IPs associated with Threats", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "Threat - 9", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "threat" }, "name": "Group - Threat" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "IP Investigation", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "01449bd8-a147-48c7-9c10-72c3b2014817", "version": "KqlParameterItem/1.0", "name": "SearchIP", "label": "Search IP", "type": 1, "description": "Enter the IP to be investigated", "isRequired": true, "value": "", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime={TimeRange:start},endtime={TimeRange:end})\r\n| where SrcIpAddr == \"{SearchIP}\" or DstIpAddr == \"{SearchIP}\"\r\n| summarize count() by EventProduct", "size": 1, "title": "Data Volume from different Sources", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "IpInvestigate - 1", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime={TimeRange:start},endtime={TimeRange:end})\r\n| where SrcIpAddr == \"{SearchIP}\" or DstIpAddr == \"{SearchIP}\"\r\n| summarize count() by NetworkProtocol", "size": 1, "title": "Data Volume from different Protocols", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "IpInvestigate - 2", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime={TimeRange:start},endtime={TimeRange:end})\r\n| where SrcIpAddr == \"{SearchIP}\" or DstIpAddr == \"{SearchIP}\"\r\n| summarize count() by NetworkDirection", "size": 1, "title": "Data Volume from different directions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "IpInvestigate - 3", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelligenceIndicator\r\n| where NetworkIP == \"{SearchIP}\" and Active\r\n| summarize arg_max(TimeGenerated,*) by NetworkIP\r\n| project TimeGenerated, NetworkIP, Action, ConfidenceScore, Description, ExternalIndicatorId, ExpirationDateTime, IndicatorId, ThreatType, TrafficLightProtocolLevel\r\n| evaluate narrow()\r\n| project-away Row", "size": 0, "title": "Information from Threat Intelligence Table", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "IP Investigation - 4", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where Entities has \"{SearchIP}\"\r\n| project TimeGenerated, DisplayName, AlertName, AlertSeverity, ProviderName, VendorName, SystemAlertId, StartTime, EndTime, todynamic(ExtendedProperties), Entities", "size": 0, "title": "Security Alerts with Searched IP", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "50", "name": "IP Investigation - 5", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime=ago(1d), endtime=now(), srcipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| summarize Instances=count() by DstIpAddr\r\n| order by Instances\r\n| take 5", "size": 1, "title": "When Searched IP is the Source IP", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "DstIpAddr", "parameterName": "DstIpAddr", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "33", "name": "IP Investigation - 7", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime=ago(1d), endtime=now(), srcipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| where DstIpAddr in (\"\" {DstIpAddr})\r\n| order by TimeGenerated\r\n| project DstIpAddr, DstPortNumber, SrcIpAddr, SrcPortNumber, DstAppName, NetworkProtocol, NetworkDirection, DvcAction, EventStartTime, EventEndTime\r\n| take 250", "size": 1, "title": "Connection Details of Selected Destination IP", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "67", "name": "IP Investigation - 8", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime=ago(1d), endtime=now(), dstipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| summarize Instances=count() by SrcIpAddr\r\n| order by Instances\r\n| take 5", "size": 1, "title": "When Searched IP is the Destination IP", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "SrcIpAddr", "parameterName": "SrcIpAddr", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "33", "name": "IP Investigation - 7 - Copy", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime=ago(1d), endtime=now(), dstipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| where SrcIpAddr in (\"\" {SrcIpAddr})\r\n| order by TimeGenerated\r\n| project DstIpAddr, DstPortNumber, SrcIpAddr, SrcPortNumber, DstAppName, NetworkProtocol, NetworkDirection, DvcAction, EventStartTime, EventEndTime\r\n| take 250", "size": 1, "title": "Connection Details of Selected Source IP", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "67", "name": "IP Investigation - 10", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime={TimeRange:start},endtime={TimeRange:end}, ipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| where isnotempty(SrcDomain)\r\n| summarize Instances=count() by SrcDomain\r\n| order by Instances\r\n| take 5", "size": 1, "title": "Top Source Domain", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "IP Investigation - 13", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession(starttime={TimeRange:start},endtime={TimeRange:end}, ipaddr_has_any_prefix=dynamic([\"{SearchIP}\"]))\r\n| where isnotempty(DstDomain)\r\n| summarize Instances=count() by DstDomain\r\n| order by Instances\r\n| take 5", "size": 1, "title": "Top Destination Domain", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "50", "name": "IP Investigation - 14", "styleSettings": { "margin": "10", "padding": "10", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "ipinvest" }, "name": "Group - IP Investigate" } ], "styleSettings": {}, "fromTemplateId": "sentinel-NetworkSessionSolution", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }