{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "**NOTE**: This workbook depends on a parser based on Kusto Function to work as expected [**BoxEvents**](https://aka.ms/sentinel-BoxDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.", "style": "info" }, "name": "text - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "88aa96e3-fc48-4b04-836e-fc2ec8ebf37f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": " Time Range", "type": 4, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 3600000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| make-series TotalEvents = count() default = 0 on EventEndTime from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};", "size": 0, "title": "Events over time", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "customWidth": "65", "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where isnotempty(EventType)\r\n| summarize TotalEvents = count() by EventType", "size": 3, "title": "Event Types", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "EventSeverity", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": true, "rowLimit": 7, "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "EventSeverity", "formatter": 1 }, "centerContent": { "columnMatch": "TotalEvents", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "35", "name": "query - 3" } ] }, "customWidth": "80", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let user1 = BoxEvents\r\n| where isnotempty(SourceName)\r\n| summarize Users = dcount(SourceName) by SourceName\r\n| project Users, User = SourceName;\r\nlet user2 = BoxEvents\r\n| where isnotempty(SrcUserName)\r\n| summarize Users = count(SrcUserName) by SrcUserName\r\n| project Users, User = SrcUserName;\r\nlet user3 = BoxEvents\r\n| where isnotempty(AccessibleByName)\r\n| summarize Users = dcount(AccessibleByName) by AccessibleByName\r\n| project Users, User = AccessibleByName;\r\nlet users = union user1, user2, user3;\r\nusers\r\n| summarize Users = dcount(User)", "size": 3, "title": "Unique Users", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "bignumber" } }, "name": "query - 5" } ] }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where isnotempty(SrcIpAddr)\r\n| summarize dcount(SrcIpAddr)\r\n", "size": 3, "title": "Unique IPs", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "gridSettings": { "formatters": [ { "columnMatch": "TotalEvents", "formatter": 8, "formatOptions": { "palette": "blueGreen" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "turquoise" } } ], "rowLimit": 10, "labelSettings": [ { "columnId": "TotalEvents", "label": "Total Events" }, { "columnId": "Trend" } ] }, "textSettings": { "style": "bignumber" } }, "name": "query - 6" } ] }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let file1 = BoxEvents\r\n| where isnotempty(SourceFileName)\r\n| summarize d_files = dcount(SourceFileName);\r\nlet file2 = BoxEvents\r\n| where isnotempty(SourceItemName)\r\n| summarize d_files = dcount(SourceItemName);\r\nlet files = union file1, file2;\r\nfiles\r\n| summarize sum(d_files)\r\n", "size": 3, "title": "Unique files", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "blue" } }, "leftContent": { "columnMatch": "sum_d_files", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "Unique files", "columnSettings": [ { "columnName": "sum_d_files", "color": "blue" } ] } } }, "rightContent": { "columnMatch": "sum_d_files", "formatter": 12, "formatOptions": { "palette": "blue" } }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "name": "query - 0" } ] }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let files_1 = BoxEvents\r\n| where EventEndTime > ago(90d)\r\n| where isnotempty(SourceFileName)\r\n| summarize TotalItems = dcount(SourceFileName) by SourceFileName\r\n| project TotalItems, FileName = SourceFileName;\r\nlet files_2 = BoxEvents\r\n| where EventEndTime > ago(90d)\r\n| where isnotempty(SourceItemName)\r\n| summarize TotalItems = dcount(SourceItemName) by SourceItemName\r\n| project TotalItems, FileName = SourceItemName;\r\nlet known_files = (union files_1, files_2)\r\n| summarize makeset(FileName);\r\nBoxEvents\r\n| where EventEndTime between (ago(24h) .. now())\r\n| where isnotempty(SourceFileName) \r\n| project FileName = SourceFileName\r\n| union (BoxEvents\r\n | where EventEndTime between (ago(24h) .. now())\r\n | where isnotempty(SourceItemName)\r\n | project FileName = SourceItemName)\r\n| where FileName !in (known_files)\r\n| summarize dcount(FileName)\r\n\r\n", "size": 3, "title": "New files (last 24h)", "noDataMessage": "No new files during last 24h", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card" }, "name": "query - 3" } ] }, "name": "group - 4" } ] }, "customWidth": "20", "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where EventEndTime > ago(90d)\r\n| where EventType == 'ADMIN_LOGIN'\r\n| summarize Username = dcount(SourceName) by SourceName\r\n| project SourceName\r\n", "size": 3, "title": "Admin users", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "gridSettings": { "formatters": [ { "columnMatch": "TotalEvents", "formatter": 8, "formatOptions": { "palette": "turquoise" } }, { "columnMatch": "Trend", "formatter": 10, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "SrcDvcHostname", "formatter": 1 }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "textSettings": { "style": "header" } }, "customWidth": "25", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let admins = BoxEvents\r\n| where EventEndTime > ago(90d)\r\n| where EventType == 'ADMIN_LOGIN'\r\n| summarize makeset(SourceName);\r\nlet adm_type1 = BoxEvents\r\n| where SourceName in (admins)\r\n| summarize TotalActions = count() by SourceName;\r\nlet adm_type2 = BoxEvents\r\n| where SrcUserName in (admins)\r\n| summarize TotalActions = count() by SrcUserName\r\n| project TotalActions, SourceName = SrcUserName; \r\nlet adm_activity = (union adm_type1, adm_type2);\r\nadm_activity\r\n| summarize TotalActions = sum(TotalActions) by SourceName\r\n| join kind = inner (BoxEvents\r\n | where SourceName in (admins) or SrcUserName in (admins)\r\n | make-series Trend = count() default = 0 on EventEndTime from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceName)\r\n on SourceName\r\n| project SourceName, TotalActions, Trend\r\n| order by TotalActions\r\n", "size": 3, "title": "Admin users activity", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalActions", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SourceName", "formatter": 1 }, "leftContent": { "columnMatch": "TotalActions", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "40", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let admins = BoxEvents\r\n| where EventEndTime > ago(90d)\r\n| where EventType == 'ADMIN_LOGIN'\r\n| summarize makeset(SourceName);\r\nlet adm_type1 = BoxEvents\r\n| where SourceName in (admins)\r\n| summarize by EventType, SourceName\r\n| project Action = EventType, SourceName;\r\nlet adm_type2 = BoxEvents\r\n| where SrcUserName in (admins)\r\n| summarize max(EventEndTime) by EventType, SrcUserName\r\n| project Action = EventType, SourceName = SrcUserName; \r\nlet adm_activity = (union adm_type1, adm_type2);\r\nadm_activity\r\n", "size": 1, "title": "Latest admin activity", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "35", "name": "query - 2" } ] }, "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\n| where EventType == 'NEW_USER'\n| project SourceName\n", "size": 3, "title": "New users", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "tileSettings": { "titleContent": { "columnMatch": "EventCategory", "formatter": 1 }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false, "rowLimit": 10 }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "TableName", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "TableName", "sourceIdField": "TableName", "targetIdField": "count_", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } }, "textSettings": { "style": "header" } }, "customWidth": "15", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where EventType == 'DELETE_USER'\r\n| project SourceName", "size": 3, "title": "Deleted users", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "textSettings": { "style": "header" } }, "customWidth": "15", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where EventType == 'LOGIN'\r\n| summarize LastLoginTime = max(EventEndTime) by SourceName\r\n| where LastLoginTime > ago(90d)", "size": 0, "title": "Inactive users", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "35", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let user_act1 = BoxEvents\r\n| where isnotempty(SourceName)\r\n| summarize TotalActions = count() by SourceName;\r\nlet user_act2 = BoxEvents\r\n| where isnotempty(SrcUserName)\r\n| summarize TotalActions = count() by SrcUserName\r\n| project TotalActions, SourceName = SrcUserName; \r\nlet user_activity = (union user_act1, user_act2);\r\nuser_activity\r\n| join kind = inner (BoxEvents\r\n | where isnotempty(SourceName) or isnotempty(SrcUserName)\r\n | make-series Trend = count() default = 0 on EventEndTime from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceName)\r\n on SourceName\r\n| project SourceName, TotalActions, Trend\r\n| order by TotalActions", "size": 0, "title": "Users activity over time", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalActions", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "palette": "orange" } } ], "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "SourceName", "formatter": 1 }, "leftContent": { "columnMatch": "TotalActions", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "35", "name": "query - 3" } ] }, "name": "group - 20" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| summarize Downloads = countif(EventType == \"DOWNLOAD\"), Uploads = countif(EventType == \"UPLOAD\") by bin_at(EventEndTime, 1h, now())", "size": 3, "title": "Downloads/Uploads comparison", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart" }, "name": "query - 2", "styleSettings": { "margin": "0px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where EventType == 'DOWNLOAD'\r\n| where isnotempty(SourceItemName)\r\n| project FileName = SourceItemName, SrcUserName, EventEndTime\r\n| top 100 by EventEndTime desc", "size": 0, "title": "Latest downloaded items", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FileName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35ch" } }, { "columnMatch": "SrcUserName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } }, { "columnMatch": "EventEndTime", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } } ], "filter": true }, "textSettings": { "style": "bignumber" } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BoxEvents\r\n| where EventType == 'UPLOAD'\r\n| where isnotempty(SourceItemName)\r\n| project FileName = SourceItemName, SrcUserName, EventEndTime\r\n| top 100 by EventEndTime desc", "size": 0, "title": "Latest uploaded items", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "FileName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "35ch" } }, { "columnMatch": "SrcUserName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } }, { "columnMatch": "EventEndTime", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25ch" } } ], "filter": true } }, "customWidth": "50", "name": "query - 1" } ] }, "name": "group - 6" } ], "fromTemplateId": "sentinel-Box", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }