{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## AWS Security Hub - Compliance Workbook\n" }, "name": "text - Header" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b859a804-c5bf-4fd1-9d5d-3d6a08f0fdaf", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } }, { "id": "8ca6acc7-e441-4dbb-9d53-d9f9f86a79a3", "version": "KqlParameterItem/1.0", "name": "AwsAccount", "label": "AWS Account", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| distinct AwsAccountId\r\n| sort by AwsAccountId asc", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f9e0e42c-6d3e-45a1-8f6d-9a7b3e5c8d2f", "version": "KqlParameterItem/1.0", "name": "AwsRegion", "label": "AWS Region", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| extend Region = tostring(AwsRegion)\r\n| distinct Region\r\n| sort by Region asc", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "c3d4e5f6-a7b8-9c0d-1e2f-3a4b5c6d7e8f", "version": "KqlParameterItem/1.0", "name": "ComplianceStatus", "label": "Compliance Status", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| distinct ComplianceStatus\r\n| sort by ComplianceStatus asc", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - Global Filters" }, { "type": 1, "content": { "json": "### 📊 Executive Summary" }, "name": "text - Executive Summary Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| summarize TotalFindings = count()", "size": 4, "title": "Total Active Findings", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - Total Active Findings" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\r\n| where FindingProviderFieldsSeverityLabel in (\"CRITICAL\", \"HIGH\")\r\n| summarize CriticalHighFindings = count()", "size": 4, "title": "Critical & High Severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "titleContent": { "columnMatch": "CriticalHighFindings", "formatter": 1 }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - Critical High" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\r\n| summarize FailedFindings = count()", "size": 4, "title": "Failed Compliance Checks", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - Failed Compliance" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| summarize UniqueAccounts = dcount(AwsAccountId)", "size": 4, "title": "AWS Accounts Monitored", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - Accounts Monitored" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\r\n| extend SecurityControlId = tostring(ComplianceSecurityControlId)\r\n| where isnotempty(SecurityControlId)\r\n| summarize FailingControls = dcount(SecurityControlId)", "size": 4, "title": "Failing Security Controls", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - Failing Controls" }, { "type": 1, "content": { "json": "---\n### 🎯 Findings by Severity" }, "name": "text - Severity Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize Count = count() by SeverityLabel\r\n| sort by Count desc", "size": 0, "title": "Findings Distribution by Severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "CRITICAL", "color": "redBright" }, { "seriesName": "HIGH", "color": "orange" }, { "seriesName": "MEDIUM", "color": "yellow" }, { "seriesName": "LOW", "color": "blue" }, { "seriesName": "INFORMATIONAL", "color": "gray" } ] } }, "customWidth": "33", "name": "query - Severity Pie Chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| summarize Count = count() by ComplianceStatus\r\n| sort by Count desc", "size": 0, "title": "Compliance Status Distribution", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "FAILED", "color": "redBright" }, { "seriesName": "PASSED", "color": "green" }, { "seriesName": "WARNING", "color": "yellow" }, { "seriesName": "NOT_AVAILABLE", "color": "gray" } ] } }, "customWidth": "33", "name": "query - Compliance Status Pie" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend Region = tostring(AwsRegion)\r\n| summarize Count = count() by Region\r\n| top 10 by Count desc", "size": 0, "title": "Top 10 Regions by Finding Count", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "34", "name": "query - Regions Bar Chart" }, { "type": 1, "content": { "json": "---\n### 📈 Trend Analysis" }, "name": "text - Trend Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityLabel\r\n| sort by TimeGenerated asc", "size": 0, "title": "Findings Trend Over Time by Severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "CRITICAL", "color": "redBright" }, { "seriesName": "HIGH", "color": "orange" }, { "seriesName": "MEDIUM", "color": "yellow" }, { "seriesName": "LOW", "color": "blue" } ] } }, "customWidth": "50", "name": "query - Severity Trend" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| summarize Count = count() by bin(TimeGenerated, 1d), ComplianceStatus\r\n| sort by TimeGenerated asc", "size": 0, "title": "Compliance Status Trend Over Time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "FAILED", "color": "redBright" }, { "seriesName": "PASSED", "color": "green" }, { "seriesName": "WARNING", "color": "yellow" } ] } }, "customWidth": "50", "name": "query - Compliance Trend" }, { "type": 1, "content": { "json": "---\n### 🔍 Top Security Controls Failing" }, "name": "text - Top Controls Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\r\n| extend SecurityControlId = tostring(ComplianceSecurityControlId)\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize \r\n FindingCount = count(),\r\n Critical = countif(SeverityLabel == \"CRITICAL\"),\r\n High = countif(SeverityLabel == \"HIGH\"),\r\n Medium = countif(SeverityLabel == \"MEDIUM\"),\r\n Low = countif(SeverityLabel == \"LOW\"),\r\n AffectedAccounts = dcount(AwsAccountId),\r\n SampleTitle = any(AwsSecurityFindingTitle)\r\n by SecurityControlId\r\n| top 20 by FindingCount desc\r\n| project SecurityControlId, SampleTitle, FindingCount, Critical, High, Medium, Low, AffectedAccounts\r\n| sort by FindingCount desc", "size": 0, "title": "Top 20 Failing Security Controls", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FindingCount", "formatter": 8, "formatOptions": { "palette": "red" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AffectedAccounts", "formatter": 8, "formatOptions": { "palette": "purple" } } ] } }, "name": "query - Top Failing Controls" }, { "type": 1, "content": { "json": "---\n### 🏢 Findings by AWS Account" }, "name": "text - Account Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize \r\n TotalFindings = count(),\r\n Critical = countif(SeverityLabel == \"CRITICAL\"),\r\n High = countif(SeverityLabel == \"HIGH\"),\r\n Medium = countif(SeverityLabel == \"MEDIUM\"),\r\n Low = countif(SeverityLabel == \"LOW\"),\r\n Failed = countif(ComplianceStatus == \"FAILED\"),\r\n Passed = countif(ComplianceStatus == \"PASSED\"),\r\n UniqueRegions = dcount(AwsRegion)\r\n by AwsAccountId\r\n| extend ComplianceRate = iif(Passed + Failed == 0, real(null), round((Passed * 100.0) / (Passed + Failed), 2))\r\n| project AwsAccountId, TotalFindings, Critical, High, Medium, Low, Failed, Passed, ComplianceRate, UniqueRegions\r\n| sort by TotalFindings desc", "size": 0, "title": "AWS Account Security Posture Summary", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalFindings", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Failed", "formatter": 8, "formatOptions": { "palette": "red" } }, { "columnMatch": "Passed", "formatter": 8, "formatOptions": { "palette": "green" } }, { "columnMatch": "ComplianceRate", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ] } }, "name": "query - Account Summary" }, { "type": 1, "content": { "json": "---\n### 📋 Compliance Standards Coverage" }, "name": "text - Standards Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| mv-expand ComplianceRelatedRequirements\r\n| extend Standard = tostring(ComplianceRelatedRequirements)\r\n| where isnotempty(Standard)\r\n| extend StandardFamily = case(\r\n Standard contains \"CIS\", \"CIS AWS Foundations\",\r\n Standard contains \"NIST\", \"NIST 800-53\",\r\n Standard contains \"PCI\", \"PCI DSS\",\r\n Standard contains \"ISO\", \"ISO 27001\",\r\n Standard contains \"HIPAA\", \"HIPAA\",\r\n Standard contains \"SOC\", \"SOC 2\",\r\n \"Other\")\r\n| summarize \r\n TotalFindings = count(),\r\n Failed = countif(ComplianceStatus == \"FAILED\"),\r\n Passed = countif(ComplianceStatus == \"PASSED\")\r\n by StandardFamily\r\n| extend ComplianceRate = iif((Passed + Failed) == 0, real(null), round((Passed * 100.0) / (Passed + Failed), 2))\r\n| project StandardFamily, TotalFindings, Failed, Passed, ComplianceRate\r\n| sort by TotalFindings desc", "size": 0, "title": "Compliance by Security Standard", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalFindings", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Failed", "formatter": 8, "formatOptions": { "palette": "red" } }, { "columnMatch": "Passed", "formatter": 8, "formatOptions": { "palette": "green" } }, { "columnMatch": "ComplianceRate", "formatter": 8, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - Compliance Standards" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| mv-expand ComplianceRelatedRequirements\r\n| extend Standard = tostring(ComplianceRelatedRequirements)\r\n| where isnotempty(Standard)\r\n| extend StandardFamily = case(\r\n Standard contains \"CIS\", \"CIS AWS Foundations\",\r\n Standard contains \"NIST\", \"NIST 800-53\",\r\n Standard contains \"PCI\", \"PCI DSS\",\r\n Standard contains \"ISO\", \"ISO 27001\",\r\n Standard contains \"HIPAA\", \"HIPAA\",\r\n Standard contains \"SOC\", \"SOC 2\",\r\n \"Other\")\r\n| where ComplianceStatus == \"FAILED\"\r\n| summarize FailedCount = count() by StandardFamily\r\n| sort by FailedCount desc", "size": 0, "title": "Failed Findings by Compliance Standard", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "yAxis": [ "FailedCount" ], "seriesLabelSettings": [ { "seriesName": "FailedCount", "color": "redBright" } ] } }, "customWidth": "50", "name": "query - Failed by Standard" }, { "type": 1, "content": { "json": "---\n### 🛡️ Resource Type Analysis" }, "name": "text - Resource Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend ResourceType = tostring(Resources[0].Type)\r\n| where isnotempty(ResourceType)\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize \r\n TotalFindings = count(),\r\n Critical = countif(SeverityLabel == \"CRITICAL\"),\r\n High = countif(SeverityLabel == \"HIGH\"),\r\n Medium = countif(SeverityLabel == \"MEDIUM\"),\r\n Low = countif(SeverityLabel == \"LOW\"),\r\n Failed = countif(ComplianceStatus == \"FAILED\"),\r\n UniqueResources = dcount(tostring(Resources[0].Id))\r\n by ResourceType\r\n| top 15 by TotalFindings desc\r\n| project ResourceType, TotalFindings, Critical, High, Medium, Low, Failed, UniqueResources\r\n| sort by TotalFindings desc", "size": 0, "title": "Top 15 Resource Types with Findings", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalFindings", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Failed", "formatter": 8, "formatOptions": { "palette": "red" } } ] } }, "name": "query - Resource Types" }, { "type": 1, "content": { "json": "---\n### 🔎 Detailed Findings View" }, "name": "text - Details Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\r\n| extend \r\n SecurityControlId = tostring(ComplianceSecurityControlId),\r\n SeverityLabel = tostring(FindingProviderFieldsSeverityLabel),\r\n ResourceType = tostring(Resources[0].Type),\r\n ResourceId = tostring(Resources[0].Id)\r\n| project \r\n TimeGenerated,\r\n AwsAccountId,\r\n AwsRegion,\r\n SecurityControlId,\r\n SeverityLabel,\r\n AwsSecurityFindingTitle,\r\n ResourceType,\r\n ResourceId,\r\n ComplianceStatus,\r\n AwsSecurityFindingId\r\n| top 100 by TimeGenerated desc", "size": 0, "title": "Latest 100 Failed Findings (Detailed View)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "SeverityLabel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "CRITICAL", "representation": "4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "HIGH", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "MEDIUM", "representation": "warning", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "LOW", "representation": "info", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "ComplianceStatus", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "FAILED", "representation": "failed", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "PASSED", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "unknown", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [] }, "name": "query - Detailed Findings" }, { "type": 1, "content": { "json": "---\n### 📊 IAM-Specific Findings" }, "name": "text - IAM Header" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend SecurityControlId = tostring(ComplianceSecurityControlId)\r\n| where SecurityControlId startswith \"IAM.\"\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize \r\n Count = count(),\r\n Critical = countif(SeverityLabel == \"CRITICAL\"),\r\n High = countif(SeverityLabel == \"HIGH\"),\r\n Medium = countif(SeverityLabel == \"MEDIUM\"),\r\n Failed = countif(ComplianceStatus == \"FAILED\"),\r\n SampleTitle = any(AwsSecurityFindingTitle)\r\n by SecurityControlId\r\n| project SecurityControlId, SampleTitle, Count, Critical, High, Medium, Failed\r\n| sort by Count desc", "size": 0, "title": "IAM Security Control Findings", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "Failed", "formatter": 8, "formatOptions": { "palette": "red" } } ] } }, "customWidth": "50", "name": "query - IAM Controls" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSSecurityHubFindings\r\n| where TimeGenerated {TimeRange}\r\n| where AwsAccountId in ({AwsAccount}) or '*' in ({AwsAccount})\r\n| where AwsRegion in ({AwsRegion}) or '*' in ({AwsRegion})\r\n| where ComplianceStatus in ({ComplianceStatus}) or '*' in ({ComplianceStatus})\r\n| where RecordState == \"ACTIVE\"\r\n| extend SecurityControlId = tostring(ComplianceSecurityControlId)\r\n| where SecurityControlId startswith \"EC2.\"\r\n| extend SeverityLabel = tostring(FindingProviderFieldsSeverityLabel)\r\n| summarize \r\n Count = count(),\r\n Critical = countif(SeverityLabel == \"CRITICAL\"),\r\n High = countif(SeverityLabel == \"HIGH\"),\r\n Medium = countif(SeverityLabel == \"MEDIUM\"),\r\n Failed = countif(ComplianceStatus == \"FAILED\"),\r\n SampleTitle = any(AwsSecurityFindingTitle)\r\n by SecurityControlId\r\n| project SecurityControlId, SampleTitle, Count, Critical, High, Medium, Failed\r\n| sort by Count desc", "size": 0, "title": "EC2 Security Control Findings", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "Failed", "formatter": 8, "formatOptions": { "palette": "red" } } ] } }, "customWidth": "50", "name": "query - EC2 Controls" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-AWSSecurityHubComplianceDashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }