{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **ImpervaWAFCloud** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-ImpervaWAFCloud-parser)" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cd8447d9-b096-4673-92d8-2a1e8291a125", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "description": "Sets the time name for analysis", "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 900000 }, { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};", "size": 0, "title": "Events Over Time", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "graphSettings": { "type": 0 } }, "customWidth": "60", "name": "query - 12", "styleSettings": { "maxWidth": "55" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Total Http status code result\r\nImpervaWAFCloud\r\n| where isnotempty(HttpStatusCode)\r\n| extend HttpStatus = case( \r\n HttpStatusCode startswith \"2\", \"Success\", \r\n HttpStatusCode startswith \"4\", \"Client Error\",\r\n HttpStatusCode startswith \"5\", \"Server Error\",\r\n \"Unknown\")\r\n| summarize TotalHttpStatus = count() by HttpStatus", "size": 3, "title": "HTTP Status Codes", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "30", "name": "query - 0", "styleSettings": { "maxWidth": "30" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(SrcIpAddr)\r\n| summarize dcount(SrcIpAddr) ", "size": 3, "title": "Unique IP Addresses", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(DstDomainHostname) \r\n| summarize dcount(DstDomainHostname)", "size": 3, "title": "Unique Domains", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where DvcAction startswith 'REQ_BLOCKED'\r\n| count", "size": 3, "title": "Total blocked requests", "noDataMessage": "0", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 2" } ] }, "customWidth": "10", "name": "group - 9", "styleSettings": { "maxWidth": "100", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(SrcIpAddr)\r\n| summarize count() by SrcIpAddr\r\n| project-rename SourceIP=SrcIpAddr\r\n| top 10 by count_ ", "size": 3, "title": "Top 10 Sources", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "34", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where DvcAction startswith 'REQ_BLOCKED'\r\n| summarize count() by SrcIpAddr\r\n| project-rename SourceIP = SrcIpAddr\r\n| top 10 by count_ desc ", "size": 3, "title": "Top Source IP addresses with blocked requests", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "33", "name": "query - 3", "styleSettings": { "margin": "10", "padding": "10" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(Country)\r\n| summarize count() by Country\r\n| top 10 by count_ desc ", "size": 3, "title": "Top Source IP addresses with client error", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "TotalEvents", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TotalEvents", "sortOrder": 2 } ] }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(DstDomainHostname)\r\n| summarize TotalEvents = count() by DstDomainHostname\r\n| top 10 by TotalEvents desc", "size": 3, "title": "Top destination hosts", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "customWidth": "30", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| extend File = extract(@\".*\\/([a-zA-Z0-9-._]*)\", 1, tostring(QueryString))\r\n| where isnotempty(File)\r\n| sort by TimeGenerated desc \r\n| project File, strcat(iff(HttpStatusCode startswith \"4\" or HttpStatusCode startswith \"5\", '❌', '✅')), HttpStatusCode\r\n| project-rename Result = Column1, FileName=File", "size": 0, "title": "Latest files accessed", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 50, "filter": true } }, "customWidth": "35", "name": "query - 12", "styleSettings": { "maxWidth": "33" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\r\n| where isnotempty(ClientApp)\r\n| summarize count() by ClientApp", "size": 3, "title": "Client application types", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "rowLimit": 10 }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "SrcIpAddr", "formatter": 1 }, "centerContent": { "columnMatch": "LargeRequest", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "30", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ImpervaWAFCloud\n| where isnotempty(SrcIpAddr)\n| summarize by SrcIpAddr, SrcGeoLatitude, SrcGeoLongitude", "size": 3, "title": "Attack Map", "color": "redBright", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "gridSettings": { "filter": true }, "mapSettings": { "locInfo": "LatLong", "latitude": "SrcGeoLatitude", "longitude": "SrcGeoLongitude", "sizeSettings": "SrcIpAddr", "sizeAggregation": "Count", "defaultSize": 20, "labelSettings": "SrcIpAddr", "legendMetric": "SrcIpAddr", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "SrcIpAddr", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "name": "query - 11" } ], "fromTemplateId": "sentinel-ImpervaWAFCloudWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }