{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Microsoft Exchange Admin Activity\r\n\r\nThis workbook helps you visualize what is happening in your Exchange environment.\r\nResults removed :\r\n\t- All Test-* and Set-AdServerSetting Cmdlets\r\n\r\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "3792117c-d924-4ec7-a327-1e8d5e9f291a",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "value": {
              "durationMs": 14400000
            }
          },
          {
            "id": "743317e2-ebcf-4958-861d-4ff97fc7cce1",
            "version": "KqlParameterItem/1.0",
            "name": "EnvironmentList",
            "label": "Environment",
            "type": 2,
            "query": "OfficeActivity | where TimeGenerated {TimeRange}\r\n| summarize by OrganizationName",
            "isHiddenWhenLocked": true,
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": null
          },
          {
            "id": "8ac96eb3-918b-4a36-bcc4-df50d8f46175",
            "version": "KqlParameterItem/1.0",
            "name": "Help",
            "label": "Show Help",
            "type": 10,
            "isRequired": true,
            "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\",\"transformers\":null}",
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "timeContext": {
              "durationMs": 2592000000
            },
            "queryType": 8
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "TimeRange"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "34188faf-7a02-4697-9b36-2afa986afc0f",
            "cellValue": "selected",
            "linkTarget": "parameter",
            "linkLabel": "Cmdlet Analysis",
            "subTarget": "Cmdlet",
            "postText": "t",
            "style": "link",
            "icon": "3",
            "linkIsContextBlade": true
          }
        ]
      },
      "name": "links - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Cmdlet summary",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "This tab parses the events from OfficeActivity logs :\r\n\r\n- list of cmdlets\r\n- filter on a VIP and/or Sensitive objects (based on Watchlist \"Exchange VIP\" and \" Monitored Exchange Cmdlets\")\r\n- anomalies detections are based on the KQL function series_decompose_anomalies",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "CmdletGroupHelp"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "5a942eba-c991-4b84-9a94-c153bca86e12",
                  "version": "KqlParameterItem/1.0",
                  "name": "VIPOnly",
                  "label": "Show VIP Only",
                  "type": 10,
                  "isRequired": true,
                  "typeSettings": {
                    "additionalResourceOptions": [],
                    "showDefault": false
                  },
                  "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\"},\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]",
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "83befa26-eee0-49ab-9785-72653943bc6b",
                  "version": "KqlParameterItem/1.0",
                  "name": "SensitiveOnly",
                  "label": "Sensitive CmdLet Only",
                  "type": 10,
                  "isRequired": true,
                  "typeSettings": {
                    "additionalResourceOptions": [],
                    "showDefault": false
                  },
                  "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\" },\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]\r\n",
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 0"
          },
          {
            "type": 1,
            "content": {
              "json": "This section show all the Cmdlets executed in the selected time range. Possible filters are: \r\n- **VIP Only selected** Cmdlets used against VIP objects (based on the \"Exchange VIP\" watchlist)\r\n- **Sensitive Cmdlets** Cmdlets considered as Sensitive (based on the \"Monitored Exchange Cmdlets\" watchlist)\r\n\r\nThese informations can be useful to detect unexpected behaviors or to determine what are the action performed by the accounts (ie. service accounts).\r\n\r\nℹ️ It is recommended to delegated only the necessary privileges to an account.",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "CmdtListHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| sort by count_",
              "size": 2,
              "showAnalytics": true,
              "title": "List of all executed cmdlets during the last 90 days (based on Sentinel retention)",
              "exportFieldName": "Cmdlet",
              "exportParameterName": "CmdletFilter",
              "exportDefaultValue": "\"\"",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "CmdletName",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false
              },
              "graphSettings": {
                "type": 0,
                "topContent": {
                  "columnMatch": "Cmdlet",
                  "formatter": 1
                },
                "centerContent": {
                  "columnMatch": "count_",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "chartSettings": {
                "createOtherGroup": 20
              }
            },
            "customWidth": "45",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| join kind=leftouter ( MESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n    | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by CmdletName\r\n    | extend Anomalies=series_decompose_anomalies(Count)\r\n) on CmdletName\r\n| project CmdletName, Total=count_, Count, Anomalies\r\n| sort by Total",
              "size": 2,
              "showAnalytics": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Cmdlet",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "31.5ch"
                    }
                  },
                  {
                    "columnMatch": "Total",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "9.3ch"
                    }
                  },
                  {
                    "columnMatch": "Count",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "330px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "Anomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "redBright",
                      "customColumnWidthSetting": "330px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "labelSettings": [
                  {
                    "columnId": "Count",
                    "label": "Count for the last 30 days"
                  }
                ]
              }
            },
            "customWidth": "55",
            "name": "CmdletTrends"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet: string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\", ignoreFirstRecord=true)\r\n    | project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize Total = count() by Caller\r\n| join kind=leftouter ( MESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n    | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by Caller\r\n    | extend Anomalies=series_decompose_anomalies(Count)\r\n) on Caller\r\n| project Caller, Total, Count, Anomalies\r\n| sort by Total desc",
              "size": 1,
              "showAnalytics": true,
              "exportFieldName": "Caller",
              "exportParameterName": "CallerFilter",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Caller",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "70ch"
                    }
                  },
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "125px"
                    }
                  },
                  {
                    "columnMatch": "Count",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "300px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "Anomalies",
                    "formatter": 10,
                    "formatOptions": {
                      "palette": "redBright",
                      "customColumnWidthSetting": "300px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "sortBy": [
                  {
                    "itemKey": "$gen_bar_Total_1",
                    "sortOrder": 2
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "Count",
                    "label": "Count for the last 30 days"
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "$gen_bar_Total_1",
                  "sortOrder": 2
                }
              ],
              "chartSettings": {
                "createOtherGroup": 20
              }
            },
            "name": "query - 4"
          },
          {
            "type": 1,
            "content": {
              "json": "## List of Cmdlets\r\n\r\nBy default all accounts found in the log are displayed.\r\n\r\nSelect an caller, to display all Cmdlets launched by this administrator\r\n\r\n> **Legend**    \r\n>    \r\n> 👑 VIP user    \r\n> 💥 Sensitive action\r\n\r\nIf needed, select an item in the dropdownlist. Dropdownlist are independent."
            },
            "name": "text - 3"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "008273d1-a013-4d86-9e23-499e5175a85e",
                  "version": "KqlParameterItem/1.0",
                  "name": "CallerFilter",
                  "label": "Caller",
                  "type": 2,
                  "isRequired": true,
                  "multiSelect": true,
                  "quote": "'",
                  "delimiter": ",",
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| distinct Caller\r\n| extend Caller = replace_string(Caller, '\\\\', '\\\\\\\\')\r\n| sort by Caller asc",
                  "typeSettings": {
                    "additionalResourceOptions": [
                      "value::all"
                    ],
                    "showDefault": false
                  },
                  "defaultValue": "value::all",
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                },
                {
                  "id": "21bd4e45-65ca-4b9b-a19c-177d6b37d807",
                  "version": "KqlParameterItem/1.0",
                  "name": "TargetObjectFilter",
                  "label": "Target Object",
                  "type": 2,
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where Caller in ({CallerFilter})\r\n| distinct TargetObject\r\n| sort by TargetObject asc",
                  "typeSettings": {
                    "additionalResourceOptions": [],
                    "showDefault": false
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": null
                },
                {
                  "id": "9e93d5c3-0fcb-4ece-b2a0-fc3ff44a0b04",
                  "version": "KqlParameterItem/1.0",
                  "name": "CmdletFilter",
                  "label": "Cmdlet Filter",
                  "type": 2,
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where Caller in ({CallerFilter})\r\n| distinct CmdletName\r\n| sort by CmdletName asc",
                  "typeSettings": {
                    "additionalResourceOptions": [],
                    "showDefault": false
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": null
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 8"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet: string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\", ignoreFirstRecord=true)\r\n    | project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| where (Caller in ({CallerFilter}) or Caller == \"ALL\")  and TargetObject contains \"{TargetObjectFilter}\" and CmdletName contains \"{CmdletFilter}\"\r\n    and TargetObject contains \"\"\r\n    and CmdletName contains \"\"\r\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",TargetObject), TargetObject )\r\n| extend Cmdlet = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",CmdletName), CmdletName )\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",tostring(IsVIP)), tostring(IsVIP ))\r\n| project TimeGenerated, Caller, TargetObject, Cmdlet, CmdletParameters\r\n| sort by TimeGenerated desc",
              "size": 2,
              "showAnalytics": true,
              "title": "History",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "ActualCmdLet",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "120ch"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 5"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "Cmdlet"
      },
      "name": "Cmdlet Group"
    }
  ],
  "fromTemplateId": "sentinel-MicrosoftExchangeSecurityAdminActivity-Online",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}