{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "This data connector depends on parsers based on Kusto Functions to work as expected called **InfobloxInsight, InfobloxInsightEvents, InfobloxInsightAssets, InfobloxInsightIndicators, **and **InfobloxInsightComments** found [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox%20SOC%20Insights/Parsers) which are deployed with the Microsoft Sentinel Solution.", "style": "info" }, "name": "text - 15", "styleSettings": { "padding": "0 0 20px 0" } }, { "type": 1, "content": { "json": "# Infoblox SOC Insights Workbook\r\n\r\n##### Get a closer look at your Infoblox SOC Insights. \r\n\r\nThis workbook is intended to help visualize your [BloxOne SOC Insights](https://csp.infoblox.com/#/insights-console/insights/open/threats) data as part of the **Infoblox SOC Insight Solution**. Drilldown your data and visualize events, trends, and anomalous changes over time.\r\n\r\n---\r\n" }, "name": "text - 3", "styleSettings": { "margin": "0 0 20px 0" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| distinct InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\r\n| extend isConfigIssue = iff((ThreatClass has_cs (\"CONFIGURATIONISSUE\")), \"Configuration\", \"Threats\")\r\n| summarize count() by isConfigIssue", "size": 1, "title": "Insight Types", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MEDIUM", "color": "orange" }, { "seriesName": "CRITICAL", "color": "pink" }, { "seriesName": "INFO", "color": "blue" }, { "seriesName": "LOW", "color": "yellow" }, { "seriesName": "HIGH", "color": "red" } ] } }, "customWidth": "50", "name": "Insight Types" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| summarize dcount(InfobloxInsightID) by Priority", "size": 1, "title": "Priority", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MEDIUM", "color": "orange" }, { "seriesName": "CRITICAL", "color": "purple" }, { "seriesName": "INFO", "color": "blue" }, { "seriesName": "LOW", "color": "yellow" }, { "seriesName": "HIGH", "color": "red" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "50", "name": "Priority" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\r\n| summarize count() by ThreatProperty", "size": 1, "title": "Threat Families", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 15, "seriesLabelSettings": [ { "seriesName": "MEDIUM", "color": "orange" }, { "seriesName": "CRITICAL", "color": "pink" }, { "seriesName": "INFO", "color": "blue" }, { "seriesName": "LOW", "color": "yellow" }, { "seriesName": "HIGH", "color": "red" } ] } }, "customWidth": "50", "name": "Threat Families" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\r\n| summarize count() by ThreatType", "size": 1, "title": "Threat Classes", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 15 } }, "customWidth": "50", "name": "Threat Classes" } ] }, "name": "Overall" }, { "type": 1, "content": { "json": "## Using this Workbook\r\nTo make use of this workbook, you must ingest Infoblox SOC Insight data into Sentinel in one or both ways:\r\n- Deploy the **Infoblox SOC Insights Data Connector** and forward CEF syslog via the Microsoft forwarding agent.\r\n- Deploy the **Infoblox-SOC-Get-Open-Insights-API** playbook. Find instructions [here](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Infoblox%20SOC%20Insights/Playbooks).\r\n\r\nYou can use one or both at the same time, but beware of duplicate data!\r\n\r\nConfigure the **Analytic Queries** that come with this Microsoft Sentinel Solution. They will add the Insights as Incidents, so you can easily track and run playbooks on them.\r\n\r\nThen, once you have some Insights, run the **Infoblox-SOC-Get-Insight-Details** playbook to get all the gritty details. If you wish, you can then run **Infoblox-SOC-Import-Indicators-TI** to ingest each Indicator of an Insight into Sentinel as **Threat Intelligence**.\r\n\r\n## Run playbooks directly from this workbook!\r\n\r\n#### Set the **Resource Group**, [**Tenant ID**](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) and **Playbook** to run when clicking on the **Run Playbook** in the SOC Insight Incidents table below.\r\n\r\n**Infoblox-SOC-Get-Insight-Details** pulls all the details about each individual Insight. \r\n\r\n**Infoblox-SOC-Import-Indicators-TI** pushes each Indicator of the Insight into Sentinel as **Threat Intelligence**. You must run the **Infoblox-SOC-Get-Insight-Details** *before* running **Infoblox-SOC-Import-Indicators-TI**.\r\n\r\nYou will need to run the playbooks for each Insight/Incident. You can do that manually within this workbook with the **Run Playbook** button in the table below, from the **Incidents** blade, or configure them to run automatically with **Analytics**. \r\n\r\nAfter running **Infoblox-SOC-Get-Insight-Details** on an Insight, **click on it in the table below** to see the details.\r\n\r\n**You can rerun playbooks on Insights** that already contain data to get the most recent. ", "style": "upsell" }, "name": "text - 15", "styleSettings": { "padding": "0 0 5px 0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e8613f2c-08c6-49e6-a2c6-e12d185c6bd3", "version": "KqlParameterItem/1.0", "name": "ResourceTypes", "label": "Resource Types", "type": 7, "description": "This parameter must be set to Logic app.", "isRequired": true, "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [], "includeAll": true, "showDefault": false }, "value": [ "microsoft.logic/workflows" ] }, { "id": "4a15b858-69b6-4198-abfd-6af5f187d813", "version": "KqlParameterItem/1.0", "name": "SentinelResourceGroup", "label": "Incidents Resource Group", "type": 2, "isRequired": true, "isGlobal": true, "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId, resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project resourceGroup", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "7783c2b4-a6e6-4117-92ec-a9a751f01465", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "isGlobal": true, "query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| where resourceGroup =~ \"{SentinelResourceGroup}\"", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" } ], "style": "above", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "/subscriptions/be1e61b7-8dbe-4986-a9c2-d85f65524d6e" ], "parameters": [ { "id": "d1eaca1e-a58e-4eb6-be31-04b7e0ec86be", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription", "type": 1, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| distinct subscriptionId", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" }, { "id": "0a92b010-8b48-4601-872f-83e13561b088", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription}', true, false)", "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "63c75027-cc56-4958-9296-e0c986ab11e0", "version": "KqlParameterItem/1.0", "name": "PlaybookResourceGroup", "label": "Playbook Resource Group", "type": 2, "isRequired": true, "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId, resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project resourceGroup", "value": null, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "3c6d99b2-1eb1-4650-a3f0-d48dc03f87cb", "version": "KqlParameterItem/1.0", "name": "TenantID", "type": 1, "isRequired": true, "label": "Tenant ID", "value": "" }, { "id": "e1ea6f58-cd1b-4807-a7de-7da91b787bd4", "version": "KqlParameterItem/1.0", "name": "PlaybookName", "label": "Playbook", "type": 5, "description": "Set the playbook to run when clicking on the \"Run Playbook\" in the SOC Insight Incidents table below.", "isRequired": true, "query": "Resources\r\n| where type in~({ResourceTypes})\r\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\r\n| where resourceGroup =~ \"{PlaybookResourceGroup}\"// or '*' in~({PlaybookResourceGroup})\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project label = tostring(name)", "crossComponentResources": [ "/subscriptions/be1e61b7-8dbe-4986-a9c2-d85f65524d6e" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "value": "Infoblox-SOC-Get-Open-Insights-API" } ], "style": "above", "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0 - Copy" }, { "type": 1, "content": { "json": "#### Click on a **SOC Insight Incident** below to view more information.", "style": "upsell" }, "name": "text - 15", "styleSettings": { "padding": "15px 0 0 0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "103f5c4e-6007-46c3-88ed-74fdb7843acc", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 } ] }, "value": { "durationMs": 259200000 } }, { "id": "7c4c6733-a2d8-40b1-abf5-7f2d777e814c", "version": "KqlParameterItem/1.0", "name": "SelectPriority", "label": "Priority", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"N/A\"},\r\n { \"value\":\"INFO\"},\r\n { \"value\":\"LOW\"},\r\n { \"value\":\"MEDIUM\"},\r\n { \"value\":\"HIGH\"},\r\n { \"value\":\"CRITICAL\"}\r\n]", "defaultValue": "value::all", "value": [ "value::all" ] }, { "id": "3e3ee805-c983-480e-9c10-49a47be4ddc6", "version": "KqlParameterItem/1.0", "name": "Status", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityIncident\r\n| where CreatedTime {TimeRange:value}\r\n| distinct Status\r\n| sort by Status asc", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1c79577f-a4f2-4b2a-aaa7-fbcc5e27831d", "version": "KqlParameterItem/1.0", "name": "Owner", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityIncident\r\n| where CreatedTime {TimeRange:value}\r\n| where Status in ({Status})\r\n| project Owner=tostring(Owner.userPrincipalName)\r\n| sort by Owner asc\r\n| extend Owner = iff(isnotempty( Owner), Owner, \"Unassigned\")\r\n| distinct Owner", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 19 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let x =\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| extend IncidentID = IncidentName\r\n| extend IncidentNumber = toint(IncidentNumber)\r\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \"Unassigned\" in ({Owner}))\r\n| extend RunPlaybook = \"Run Playbook\"\r\n| where Title has_cs \"Infoblox SOC Insight\"\r\n| extend Labels = tostring(Labels)\r\n| extend InfobloxInsightID = extract(\"InfobloxInsightID: (.*?)\\\"\", 1, Labels)\r\n| join \r\n (InfobloxInsight\r\n | summarize arg_max(TimeGenerated, *) by InfobloxInsightID\r\n ) on InfobloxInsightID\r\n//sometimes duplicate TimeGenerated so grab LastSeen next\r\n| summarize arg_max(LastSeen, *) by IncidentNumber\r\n| project IncidentNumber, Severity, Priority, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID\r\n; \r\nlet incidents =\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\r\n| extend IncidentID = IncidentName\r\n| extend IncidentNumber = toint(IncidentNumber)\r\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \"Unassigned\" in ({Owner}))\r\n| extend RunPlaybook = \"Run Playbook\"\r\n| where Title has_cs \"Infoblox SOC Insight\"\r\n| extend Alerts = extract(\"\\\\[(.*?)\\\\]\", 1, tostring(AlertIds))\r\n| mv-expand AlertIds to typeof(string)\r\n//----------------\r\n;\r\nlet alerts =\r\n SecurityAlert\r\n | extend AlertEntities = parse_json(Entities)\r\n //| extend InfobloxInsightID = tostring(AlertEntities.ObjectGuid)\r\n;\r\nincidents | join alerts on $left.AlertIds == $right.SystemAlertId\r\n//----------------------\r\n| summarize AlertCount=dcount(AlertIds) by IncidentNumber, IncidentID, Status, Title, Alerts, IncidentUrl, Owner=tostring(Owner.userPrincipalName) , RunPlaybook\r\n// -------------\r\n| join kind=inner (incidents | join alerts on $left.AlertIds == $right.SystemAlertId) on IncidentNumber\r\n| join kind=fullouter x on IncidentNumber\r\n| summarize arg_max(TimeGenerated,*) by (IncidentNumber)\r\n| where Priority in ({SelectPriority}) or '{SelectPriority:label}' == \"All\"\r\n| where Status in ({Status}) or '{Status:label}' == \"All\"\r\n| project IncidentNumber, Severity, Priority, Title, Status, Owner, IncidentUrl, RunPlaybook, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID, IncidentID\r\n//| project-away IncidentID\r\n| order by toint(IncidentNumber) desc\r\n", "size": 0, "title": "SOC Insight Incidents", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "InfobloxInsightID", "parameterName": "InfobloxInsightID", "parameterType": 1 }, { "fieldName": "IncidentID", "parameterName": "IncidentID", "parameterType": 1 }, { "fieldName": "Title", "parameterName": "Title", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "Sev4", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": "", "representation": "unknown", "text": "{0}{1}" } ] } }, { "columnMatch": "Priority", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "INFO", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "LOW", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "MEDIUM", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "HIGH", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "CRITICAL", "representation": "purple", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "New", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Active", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": "", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Owner", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open Incident" } }, { "columnMatch": "InsightDataReady", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Data Not Found", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Ready", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "gray", "text": "{0}{1}" } ] }, "tooltipFormat": { "tooltip": "To see data for this insight, run the Infoblox-SOC-API-Get-Insight-Details playbook." } }, { "columnMatch": "RunPlaybook", "formatter": 7, "formatOptions": { "linkTarget": "ArmAction", "linkIsContextBlade": true, "armActionContext": { "path": "{Workspace}/providers/Microsoft.SecurityInsights/incidents/{IncidentID}/runPlaybook?api-version=2019-01-01-preview", "headers": [], "params": [], "body": "{\r\n \"LogicAppsResourceId\":\"{Subscription}/resourceGroups/{PlaybookResourceGroup}/providers/Microsoft.Logic/workflows/{PlaybookName}\",\r\n \"TenantId\":\"{TenantID}\"\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command." } }, "tooltipFormat": { "tooltip": "Run {PlaybookName} on this insight." } }, { "columnMatch": "EventsCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "NotBlockedCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "BlockedCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "isPopulated", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Ready", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Data Not Found", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] }, "tooltipFormat": { "tooltip": "To see data about this Insight, run the Infoblox-SOC-API-Get-Insight-Details Playbook." } }, { "columnMatch": "Alerts", "formatter": 5 }, { "columnMatch": "AlertCount", "formatter": 0, "formatOptions": { "aggregation": "Sum" } }, { "columnMatch": "Entities", "formatter": 1 }, { "columnMatch": "alertCount", "formatter": 8, "formatOptions": { "min": 0, "palette": "redBright" } }, { "columnMatch": "count_AlertCount", "formatter": 8, "formatOptions": { "palette": "greenRed" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "name": "IncidentDetailsView" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "46b4abc5-316b-4c75-89b7-5cf134d6dbb0", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Summary", "subTarget": "Summary", "style": "link" }, { "id": "81661594-3591-4fe6-a67d-b69ae55abf67", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Assets", "subTarget": "Assets", "preText": "IPs", "style": "link" }, { "id": "46ca603b-ead0-46bd-987d-1d157b2a763a", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Indicators", "subTarget": "Indicators", "style": "link" }, { "id": "f2ce2fdb-104a-447f-b42b-6d11931a09ff", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Events", "subTarget": "Events", "style": "link" }, { "id": "03782b90-e744-4654-95c3-a1056cfe78f9", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Comments", "subTarget": "Comments", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" }, "name": "links - 16", "styleSettings": { "padding": "20px 0 20px 0" } }, { "type": 1, "content": { "json": "#### Click on a **SOC Insight Incident** above to view more information.", "style": "upsell" }, "conditionalVisibility": { "parameterName": "InfobloxInsightID", "comparison": "isEqualTo" }, "name": "text - 14", "styleSettings": { "padding": "10px 0 10px 0" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## {Title}" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(LastSeen)\r\n| extend format_datetime(todatetime(FirstSeen), 'M/dd/yyyy, h:mm:ss tt')\r\n| extend FirstSeen = strcat(tostring(FirstSeen), \" UTC\")\r\n| project FirstSeen", "size": 3, "title": "First Seen", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "FirstSeen", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "First Seen" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(LastSeen)\r\n| extend format_datetime(todatetime(LastSeen), 'M/dd/yyyy, h:mm:ss tt')\r\n| extend LastSeen = strcat(tostring(LastSeen), \" UTC\")\r\n| project LastSeen", "size": 3, "title": "Last Seen ", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "LastSeen", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "Last Seen" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(SpreadingDate)\r\n| extend format_datetime(todatetime(SpreadingDate), 'M/dd/yyyy, h:mm:ss tt')\r\n| extend SpreadingDate = strcat(tostring(SpreadingDate), \" UTC\")\r\n| project SpreadingDate", "size": 3, "title": "Spreading Date", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "SpreadingDate", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "Spreading Date" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(PersistentDate)\r\n| extend format_datetime(todatetime(PersistentDate), 'M/dd/yyyy, h:mm:ss tt')\r\n| extend PersistentDate = strcat(tostring(PersistentDate), \" UTC\")\r\n| project PersistentDate", "size": 3, "title": "Persistent Date", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "PersistentDate", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "Persistent Date" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(BlockedCount)\r\n| project BlockedCount", "size": 3, "title": "Blocked Hits", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "BlockedCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "33", "name": "Blocked Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(NotBlockedCount)\r\n| project NotBlockedCount", "size": 3, "title": "Not Blocked Hits", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "NotBlockedCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "red" } }, "showBorder": false } }, "customWidth": "33", "name": "Not Blocked Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsight\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *)\r\n| where isnotempty(EventsCount)\r\n| project EventsCount\r\n", "size": 3, "title": "Total Hits", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "EventsCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "gray" } }, "showBorder": false } }, "customWidth": "33", "name": "Total Hits" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(Lookback)\r\n| where isnotempty(SourceIP)\r\n| summarize count() by SourceIP\r\n| top 1000 by count_ \r\n| project SourceIP);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(Lookback)\r\n| where SourceIP in ((Top))\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP\r\n", "size": 0, "title": "Top Impacted IPs", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "customWidth": "33", "name": "Top Impacted IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(Lookback)\r\n| where isnotempty(ThreatIndicator)\r\n| summarize count() by ThreatIndicator\r\n| top 1000 by count_ \r\n| project ThreatIndicator);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(Lookback)\r\n| where ThreatIndicator in ((Top))\r\n| distinct ThreatLevel, ThreatConfidence, Detected, ThreatIndicator, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatIndicator\r\n", "size": 0, "title": "Top Indicators", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 15, "showLegend": true } }, "customWidth": "33", "name": "Top Indicators" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxInsightEvents\r\n| where Detected >= ago(Lookback)\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(DestinationDnsDomain)\r\n| summarize count() );\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxInsightEvents\r\n| where Detected >= ago(Lookback)\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d", "size": 0, "title": "Events", "color": "amethyst", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "33", "name": "Events" } ] }, "conditionalVisibilities": [ { "parameterName": "view", "comparison": "isEqualTo", "value": "Summary" }, { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" } ], "name": "Summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Assets\r\n---\r\nSee your protected assets/devices affected by this insight. **Install the Infoblox Endpoint client for more accurate data.**" }, "name": "text - 6" }, { "type": 1, "content": { "json": "#### Click on an **Asset** below to view more information.", "style": "upsell" }, "name": "text - 7", "styleSettings": { "margin": "15px 0 15px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| join\r\n(\r\n InfobloxInsightAssets\r\n | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\r\n) on SourceIP\r\n| order by LastSeen, EventCount desc\r\n| project SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion, DeviceName, InfobloxB1Network,InfobloxB1DHCPFingerprint, Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\r\n\r\n\r\n\r\n", "size": 1, "showAnalytics": true, "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "exportFieldName": "SourceIP", "exportParameterName": "SourceIP", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "EventCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "IndicatorDistinctCount", "formatter": 3, "formatOptions": { "palette": "purpleBlue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "EventCount", "label": "Associated Events" }, { "columnId": "IndicatorDistinctCount", "label": "Associated Indicators" } ] } }, "name": "Assets", "styleSettings": { "margin": "0 0 20px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where SourceIP == '{SourceIP}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| order by Detected desc", "size": 0, "showAnalytics": true, "title": "Events for {SourceIP}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_InfobloxB1PolicyAction_11", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_InfobloxB1PolicyAction_11", "sortOrder": 2 } ] }, "customWidth": "75", "conditionalVisibility": { "parameterName": "SourceIP", "comparison": "isNotEqualTo" }, "name": "Events for {SourceIP}", "styleSettings": { "margin": "0 60px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where SourceIP == '{SourceIP}'\r\n| where isnotempty(ThreatIndicator)\r\n| where Detected >= ago(30d)\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize count() by ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ThreatIndicator, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| summarize Count = count() by ThreatIndicator\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Indicators for {SourceIP}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "customWidth": "25", "conditionalVisibility": { "parameterName": "SourceIP", "comparison": "isNotEqualTo" }, "name": " Indicators for {SourceIP}", "styleSettings": { "margin": "0 15px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\nInfobloxInsightEvents\r\n| where SourceIP == '{SourceIP}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected > ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatLevel", "size": 0, "showAnalytics": true, "title": "Threat Level Trend for {SourceIP}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true }, "sortBy": [], "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "N/A", "color": "turquoise" }, { "seriesName": "Info", "color": "lightBlue" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "red" } ] } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "SourceIP", "comparison": "isNotEqualTo" }, "name": "Threat Level Trend for {SourceIP}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\nInfobloxInsightEvents\r\n| where SourceIP == '{SourceIP}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected > ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction", "size": 0, "showAnalytics": true, "title": "Action Trend for {SourceIP}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true }, "sortBy": [], "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "N/A", "color": "turquoise" }, { "seriesName": "Block", "color": "green" }, { "seriesName": "Not Blocked", "color": "red" }, { "seriesName": "Log", "color": "blue" } ] } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "SourceIP", "comparison": "isNotEqualTo" }, "name": "Action Trend for {SourceIP}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\nInfobloxInsightEvents\r\n| where SourceIP == '{SourceIP}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected > ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| make-series Events = count() default = 0 on Detected from ago(Lookback) to now() step 1d", "size": 0, "title": "All Events for {SourceIP}", "color": "amethyst", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "33", "conditionalVisibility": { "parameterName": "SourceIP", "comparison": "isNotEqualTo" }, "name": "All Events for {SourceIP}" } ] }, "conditionalVisibilities": [ { "parameterName": "view", "comparison": "isEqualTo", "value": "Assets" }, { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" } ], "name": "Assets" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Indicators\r\n---\r\nAn **Indicator** is a domain or IP address that is seen in the resolution chain of a query from a device.\r\n\r\n" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(InfobloxB1PolicyAction)\r\n| summarize count_distinct(ThreatIndicator) by InfobloxB1PolicyAction", "size": 4, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Not Blocked", "color": "red" }, { "seriesName": "Blocked", "color": "green" } ] } }, "customWidth": "50", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(ThreatIndicator)\r\n| summarize count_distinct(ThreatIndicator) by ThreatLevel", "size": 4, "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Info", "color": "blue" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "50", "name": "query - 8 - Copy" }, { "type": 1, "content": { "json": "#### Click on an **Indicator** below to view more information.", "style": "upsell" }, "name": "text - 7", "styleSettings": { "padding": "15px 0 15px 0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5", "version": "KqlParameterItem/1.0", "name": "ThreatLevelParam", "label": "Threat Level", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "InfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct ThreatLevel", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "e36bc3c2-b85e-478c-968b-7faf79c21c49", "version": "KqlParameterItem/1.0", "name": "InfobloxB1PolicyActionParam", "label": "Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "InfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct InfobloxB1PolicyAction", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(ThreatIndicator)\r\n| where InfobloxB1PolicyAction in ({InfobloxB1PolicyActionParam}) or '{InfobloxB1PolicyActionParam:label}' == \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \"All\"\r\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\r\n| extend URL = strcat(\"https://csp.infoblox.com/#/security_research/search/auto/\", ThreatIndicator, \"/summary\")\r\n| order by ThreatLevel, LastSeen\r\n| project ThreatIndicator, InfobloxB1PolicyAction, ThreatLevel, ThreatConfidence, InfobloxB1FeedName, ThreatActor, LastSeen, FirstSeen, EventCount, URL\r\n", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "exportFieldName": "ThreatIndicator", "exportParameterName": "ThreatIndicator", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Blocked", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Not Blocked", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "SourceIPDistinctCount", "formatter": 3, "formatOptions": { "palette": "bluePurple" } }, { "columnMatch": "EventCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Open in Dossier" } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "InfobloxB1FeedName", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "EventCount", "label": "Associated Events" }, { "columnId": "URL", "label": "Open in Dossier" } ] }, "sortBy": [ { "itemKey": "InfobloxB1FeedName", "sortOrder": 2 } ] }, "name": "Indicators", "styleSettings": { "margin": "0 15px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where ThreatIndicator has_cs '{ThreatIndicator}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| join\r\n(\r\n InfobloxInsightAssets\r\n | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\r\n) on SourceIP\r\n| order by LastSeen, EventCount desc\r\n| summarize by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion, DeviceName, InfobloxB1Network, InfobloxB1DHCPFingerprint, Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Assets for {ThreatIndicator}", "noDataMessage": "Select an Indicator in the above chart to see details.", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "EventCount", "formatter": 3, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "IndicatorDistinctCount", "formatter": 3, "formatOptions": { "palette": "purpleBlue" } } ], "rowLimit": 500, "filter": true, "labelSettings": [ { "columnId": "EventCount", "label": "Associated Events" }, { "columnId": "IndicatorDistinctCount", "label": "Associated Indicators" } ] } }, "customWidth": "70", "conditionalVisibility": { "parameterName": "ThreatIndicator", "comparison": "isNotEqualTo" }, "name": "Assets for {ThreatIndicator}", "styleSettings": { "margin": "0 20px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\n// Finding Tops \r\nlet Top = materialize(InfobloxInsightEvents\r\n| where Detected >= ago(Lookback)\r\n| where ThreatIndicator has_cs '{ThreatIndicator}'\r\n| where isnotempty(DestinationDnsDomain)\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize count() by SourceIP\r\n| top 500 by count_ \r\n);\r\n// Filtering datasource to Tops and Plot Time chart\r\nInfobloxInsightEvents\r\n| where Detected >= ago(Lookback)\r\n| where ThreatIndicator has_cs '{ThreatIndicator}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where SourceIP in ((Top))\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP", "size": 0, "showAnalytics": true, "title": "Source IPs for {ThreatIndicator}", "color": "amethyst", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true }, "chartSettings": { "createOtherGroup": 15 } }, "customWidth": "30", "conditionalVisibility": { "parameterName": "ThreatIndicator", "comparison": "isNotEqualTo" }, "name": "Source IPs for {ThreatIndicator}" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where Detected >= ago(30d)\r\n| where ThreatIndicator has_cs '{ThreatIndicator}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| order by Detected desc", "size": 0, "showAnalytics": true, "title": "Events for {ThreatIndicator}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true, "sortBy": [ { "itemKey": "SourceIP", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "SourceIP", "sortOrder": 2 } ] }, "customWidth": "70", "conditionalVisibility": { "parameterName": "ThreatIndicator", "comparison": "isNotEqualTo" }, "name": "Events for {ThreatIndicator}", "styleSettings": { "margin": "0 20px 0 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Lookback = 30d;\r\nInfobloxInsightEvents\r\n| where Detected >= ago(Lookback)\r\n| where ThreatIndicator has_cs '{ThreatIndicator}'\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\r\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction", "size": 0, "showAnalytics": true, "title": "Action Trend for {ThreatIndicator}", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true }, "sortBy": [], "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "N/A", "color": "gray" }, { "seriesName": "Block", "color": "green" }, { "seriesName": "Allow - No Log", "color": "red" }, { "seriesName": "Log", "color": "lightBlue" } ] } }, "customWidth": "30", "conditionalVisibility": { "parameterName": "ThreatIndicator", "comparison": "isNotEqualTo" }, "name": "Action Trend for {ThreatIndicator}" } ] }, "conditionalVisibilities": [ { "parameterName": "view", "comparison": "isEqualTo", "value": "Indicators" }, { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" } ], "name": "Indicators" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Events\r\n---\r\nDNS security events associated with this insight.\r\n" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(ThreatLevel)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by ThreatLevel\r\n\r\n\r\n\r\n", "size": 4, "title": "Threat Level", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Info", "color": "lightBlue" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "33", "name": "Threat Level" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(ThreatClass)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by ThreatClass\r\n\r\n\r\n\r\n", "size": 4, "title": "Threat Classes", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Threat Classes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(ThreatProperty)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by ThreatProperty\r\n\r\n\r\n\r\n", "size": 4, "title": "Threat Families", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Threat Families" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by SourceUserName\r\n\r\n\r\n\r\n", "size": 4, "title": "Users", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Users" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(DeviceName)\r\n| where Detected >= ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by DeviceName\r\n\r\n\r\n\r\n", "size": 4, "title": "Device Names", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Device Names" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(SourceIP)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by SourceIP\r\n\r\n\r\n\r\n", "size": 4, "title": "Source IPs", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Source IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(InfobloxB1Network)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by InfobloxB1Network", "size": 4, "title": "Sources", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Sources" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(InfobloxB1PolicyName)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by InfobloxB1PolicyName", "size": 4, "title": "Policies", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Policies" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(InfobloxB1PolicyAction)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by InfobloxB1PolicyAction\r\n\r\n\r\n\r\n", "size": 4, "title": "Actions", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Block", "color": "green" }, { "seriesName": "Log", "color": "lightBlue" }, { "seriesName": "Allow - No Log", "color": "red" } ] } }, "customWidth": "33", "name": "Actions" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(DNSResponse)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by DNSResponse\r\n\r\n\r\n\r\n", "size": 4, "title": "DNS Responses", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "DNS Responses" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(DeviceRegion)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by DeviceRegion\r\n\r\n\r\n\r\n", "size": 4, "title": "Device Regions", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "33", "name": "Device Regions" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| where isnotempty(DeviceCountry)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| summarize Count = count() by DeviceCountry\r\n\r\n\r\n\r\n", "size": 4, "title": "Device Countries", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Info", "color": "lightBlue" }, { "seriesName": "N/A", "color": "gray" } ] } }, "customWidth": "33", "name": "Device Countries" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where Detected >= ago(30d)\r\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\r\n| order by Detected desc", "size": 0, "showAnalytics": true, "title": "Events", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ThreatLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "N/A", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, { "columnMatch": "InfobloxB1PolicyAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Allow", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Block", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } } ], "rowLimit": 500, "filter": true } }, "name": "Events" } ] }, "conditionalVisibilities": [ { "parameterName": "view", "comparison": "isEqualTo", "value": "Events" }, { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" } ], "name": "Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InfobloxInsightComments\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| distinct CommentChanger, Comment, DateChanged, Status\r\n| order by DateChanged desc", "size": 0, "title": "Comments", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Comments" } ] }, "conditionalVisibilities": [ { "parameterName": "view", "comparison": "isEqualTo", "value": "Comments" }, { "parameterName": "InfobloxInsightID", "comparison": "isNotEqualTo" } ], "name": "Comments" } ], "fallbackResourceIds": [], "styleSettings": { "spacingStyle": "none" }, "fromTemplateId": "sentinel-InfobloxSOCInsightsWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }