{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## DNS Essentials\n---\n\nThe 'DNS Essentials' solution provides real-time insights into activity and potential threats in your network. This solution is designed for network teams, security architects, analysts, and consultants to monitor DNS assets as well as identify and investigate DNS threats. This Workbook gives a summary of analysed DNS traffic and helps with threat analysis and investigating suspicious domains and IPs." }, "name": "text - 2" }, { "type": 1, "content": { "json": "The \"SummarizeDNSData\" Playbook installed along with the solution helps in summarizing the logs and improving the performance of the Workbook and data searches. This Workbook leverages the default as well as DNS summarized data tables for visualising the data. Although enabling the summarization playbook is optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. Please note that summarization would require the playbook to run on a scheduled basis to utilise this workbook's capabilities.", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "This Workbook depends on the \"**DNSEssentialsCustomParser**\" Parser, so please make sure it is installed and configured correctly before you use this Workbook.", "style": "info" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "8b093d06-178f-4c2f-9726-88b4a0be0bf8", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "a477e3d3-fb34-47ad-98d8-e25df35ac13f", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", "crossComponentResources": [ "value::selected" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "36f227e1-74b9-4d57-a49c-ab48c9d6cff3", "version": "KqlParameterItem/1.0", "name": "workspace", "label": "Workspace", "type": 5, "description": "Select required Log Analytics Workspace", "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "464786c8-5462-42a2-a134-431fbbc8cde0", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "58c1e08c-2ff8-41a4-85f0-0c399d3ef36f", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "DNS Overview", "subTarget": "overview", "style": "link" }, { "id": "5251d94a-1f9c-4cbc-8c7d-e7abfd3ae88a", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "Top Queries", "subTarget": "topQueries", "style": "link" }, { "id": "a816997b-65c1-4979-a0a5-ad01e00f70b2", "cellValue": "tabVisibility", "linkTarget": "parameter", "linkLabel": "Investigate", "subTarget": "investigate", "style": "link" } ] }, "name": "links - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n\t | extend EventProduct = strcat(EventVendor,\"-\",EventProduct)\r\n | summarize Instances=tolong(count()) by EventProduct, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | where isnotempty(EventProduct_s)\r\n | summarize Instances=tolong(sum(count__d)) by EventProduct=EventProduct_s, TimeGenerated=bin(EventTime_t, 6h)\r\n )\r\n | summarize Instances = sum(Instances) by EventProduct, bin(TimeGenerated, 6h)", "size": 1, "title": "Events by Source Type over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "timechart" }, "customWidth": "50", "name": "query - 0", "styleSettings": { "margin": "0", "padding": "0", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | summarize Instances=tolong(count()) by bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | summarize Instances=tolong(sum(count__d)) by TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize Instances = sum(Instances) by bin(TimeGenerated, 6h)", "size": 1, "title": "DNS Events over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "areachart" }, "customWidth": "50", "name": "query - 1", "styleSettings": { "margin": "0", "padding": "0", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(EventType)\r\n | summarize SubTypeCount=tolong(count()) by EventType\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(EventType_s)\r\n | summarize SubTypeCount=tolong(sum(count__d)) by EventType=EventType_s\r\n )\r\n | summarize Sum = sum(SubTypeCount) by EventType", "size": 0, "title": "Dns events by EventType", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "piechart" }, "customWidth": "25", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQueryTypeName)\r\n | summarize QueryTypeCount=tolong(count()) by DnsQueryTypeName\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQueryTypeName_s)\r\n | summarize QueryTypeCount=tolong(sum(count__d)) by DnsQueryTypeName=DnsQueryTypeName_s\r\n )\r\n | summarize Sum = sum(QueryTypeCount) by DnsQueryTypeName\r\n | extend DnsQueryTypeName = case(\r\n DnsQueryTypeName == \"A\", \"IPv4 address record\", \r\n DnsQueryTypeName == \"AAAA\", \"IPv6 address record\",\r\n DnsQueryTypeName == \"ANY\", \"All cached records\",\r\n DnsQueryTypeName == \"CNAME\", \"Canonical name record\",\r\n DnsQueryTypeName == \"MX\", \"Mail exchange record\",\r\n DnsQueryTypeName == \"NS\", \"Name server record\",\r\n DnsQueryTypeName == \"PTR\", \"Pointer record\",\r\n DnsQueryTypeName == \"SIG\", \"Signature\",\r\n DnsQueryTypeName == \"SOA\", \"Start of authority record\",\r\n DnsQueryTypeName == \"SRV\", \"Service locator\",\r\n DnsQueryTypeName == \"TXT\", \"Text record\",\r\n strcat('Other'))", "size": 0, "title": "DNS events by Query Type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "piechart" }, "customWidth": "25", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQueryTypeName)\r\n | summarize QueryTypeCount=tolong(count()) by DnsQueryTypeName, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQueryTypeName_s)\r\n | summarize QueryTypeCount=tolong(sum(count__d)) by DnsQueryTypeName=DnsQueryTypeName_s,TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize QueryTypeCount = sum(QueryTypeCount) by DnsQueryTypeName, bin(TimeGenerated, 6h)\r\n | order by TimeGenerated", "size": 0, "title": "Query Type over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "areachart" }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('minute',10,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where (EventSubType == 'request' or EventSubType == 'response')\r\n | summarize DNSEvents=tolong(count()) by EventSubType, bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_sourceInfo_CL\", \"DNS_Summarized_Logs_sourceInfoV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where (EventSubType_s == 'request' or EventSubType_s == 'response')\r\n | summarize DNSEvents=tolong(sum(count__d)) by EventSubType=EventSubType_s, TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by EventSubType, bin(TimeGenerated, 6h)", "size": 1, "title": "DNS - Requests Vs Responses", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "linechart" }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQuery)\r\n | distinct DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQuery_s)\r\n | extend DnsQuery=DnsQuery_s\r\n | distinct DnsQuery, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DistinctQueries=dcount(DnsQuery) by bin(TimeGenerated, 6h)", "size": 1, "title": "Unique domains queried over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "timechart" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where EventResultDetails == 'NXDOMAIN'\r\n | summarize NXDOMAINCount=tolong(count()) by bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where EventResultDetails_s == 'NXDOMAIN'\r\n | summarize NXDOMAINCount=tolong(sum(count__d)) by bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize NXDOMAINCount = sum(NXDOMAINCount) by bin(TimeGenerated, 6h)", "size": 0, "title": "Requests to non-existent domains over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "areachart" }, "customWidth": "50", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(EventResultDetails)\r\n | summarize ResultCount=tolong(count()) by EventResultDetails\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(EventResultDetails_s)\r\n | summarize ResultCount=tolong(sum(count__d)) by EventResultDetails=EventResultDetails_s\r\n )\r\n | summarize ResultCount = sum(ResultCount) by EventResultDetails", "size": 0, "title": "DNS Events by Result type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 9", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "overview" }, "name": "Group - DNS Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQuery)\r\n | summarize DNSEvents=tolong(count()) by DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQuery_s)\r\n | summarize DNSEvents=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by DnsQuery, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(DNSEvents) by DnsQuery\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(DNSEvents,1000000) by DnsQuery\r\n ) on DnsQuery\r\n | project DnsQuery, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 queried Domains", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(SrcIpAddr)\r\n | summarize Clients=tolong(count()) by SrcIpAddr, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(SrcIpAddr_s)\r\n | summarize Clients=tolong(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize Clients = sum(Clients) by SrcIpAddr, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(Clients) by SrcIpAddr\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(Clients,1000000) by SrcIpAddr\r\n ) on SrcIpAddr\r\n | project SrcIpAddr, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 Clients by events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "orange" } } ] } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQuery) and EventResultDetails == 'NXDOMAIN'\r\n | summarize DNSEvents=tolong(count()) by DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQuery_s) and EventResultDetails_s == 'NXDOMAIN'\r\n | summarize DNSEvents=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by DnsQuery, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(DNSEvents) by DnsQuery\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(DNSEvents,1000000) by DnsQuery\r\n ) on DnsQuery\r\n | project DnsQuery, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 DNSQueries resulting in non-existent Domains (NXDOMAIN)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "purpleDark" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "purpleDark" } } ] } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(SrcIpAddr) and EventResultDetails == 'NXDOMAIN'\r\n | summarize Clients=tolong(count()) by SrcIpAddr, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(SrcIpAddr_s) and EventResultDetails_s == 'NXDOMAIN'\r\n | summarize Clients=tolong(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize Clients = sum(Clients) by SrcIpAddr, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(Clients) by SrcIpAddr\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(Clients,1000000) by SrcIpAddr\r\n ) on SrcIpAddr\r\n | project SrcIpAddr, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 Originators for non-existent Domains (NXDOMAIN)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "turquoise" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Errors=dynamic([\"NXDOMAIN\", \"SERVFAIL\", \"REFUSED\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(DnsQuery) and EventResultDetails in (Errors)\r\n | summarize DNSEvents=tolong(count()) by DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(DnsQuery_s) and EventResultDetails_s in (Errors)\r\n | summarize DNSEvents=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by DnsQuery, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(DNSEvents) by DnsQuery\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(DNSEvents,1000000) by DnsQuery\r\n ) on DnsQuery\r\n | project DnsQuery, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 DNSQueries resulting in errors", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "brown" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "brown" } } ] } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Errors=dynamic([\"NXDOMAIN\", \"SERVFAIL\", \"REFUSED\"]);\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where isnotempty(SrcIpAddr) and EventResultDetails in (Errors)\r\n | summarize Clients=tolong(count()) by SrcIpAddr, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where isnotempty(SrcIpAddr_s) and EventResultDetails_s in (Errors)\r\n | summarize Clients=tolong(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize Clients = sum(Clients) by SrcIpAddr, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(Clients) by SrcIpAddr\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(Clients,1000000) by SrcIpAddr\r\n ) on SrcIpAddr\r\n | project SrcIpAddr, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 1, "title": "Top 25 Originators for errors", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "magenta" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "magenta" } } ] } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SearchString = \"in-addr.arpa\";\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n ); \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where DnsQuery has SearchString and EventResultDetails=='NOERROR'\r\n | summarize ReverseLookupCount=tolong(count()) by DnsQuery, EventResultDetails\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where DnsQuery_s has SearchString and EventResultDetails_s=='NOERROR'\r\n | summarize ReverseLookupCount=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, EventResultDetails=EventResultDetails_s\r\n )\r\n | summarize ReverseLookupCount = sum(ReverseLookupCount) by DnsQuery, EventResultDetails\r\n | order by ReverseLookupCount\r\n | take 25", "size": 0, "title": "Top Successful Reverse Queries by Count", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SearchDomain = \"in-addr.arpa\";\r\nlet maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n ); \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where DnsQuery has SearchDomain and EventResultDetails=='NXDOMAIN'\r\n | summarize ReverseLookupCount=count() by DnsQuery, EventResultDetails\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where DnsQuery_s has SearchDomain and EventResultDetails_s=='NXDOMAIN'\r\n | summarize ReverseLookupCount=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, EventResultDetails=EventResultDetails_s\r\n )\r\n | summarize ReverseLookupCount = sum(ReverseLookupCount) by DnsQuery, EventResultDetails\r\n | order by ReverseLookupCount\r\n | take 25", "size": 0, "title": "Top Reverse Queries by Count to Non-Existent Domains", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ] }, "customWidth": "50", "name": "query - 7", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "topQueries" }, "name": "Group - Top Queries" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cabe7893-adaf-48d4-b1b5-f212a03a2fba", "version": "KqlParameterItem/1.0", "name": "SrcIpAddr", "type": 1, "description": "Enter the IP to be investigated", "isRequired": true, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "879925a8-2711-41fa-b8b9-f722ae689c54", "version": "KqlParameterItem/1.0", "name": "DnsQuery", "type": 1, "description": "Enter DNSQuery to be investigated", "isRequired": true, "timeContext": { "durationMs": 86400000 }, "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_Dns(starttime={TimeRange:start},endtime={TimeRange:end})\r\n| where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\nand ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n| summarize count() by EventProduct", "size": 0, "title": "Data Volume from different Sources", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "piechart" }, "customWidth": "25", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | summarize Instances=tolong(count()) by bin(TimeGenerated, 6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | summarize Instances=tolong(sum(count__d)) by TimeGenerated=bin(EventTime_t,6h)\r\n )\r\n | summarize Instances = sum(Instances) by bin(TimeGenerated, 6h)", "size": 0, "title": "DNS Events over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "timechart" }, "customWidth": "25", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery)\r\n | distinct DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery_s)\r\n | extend DnsQuery=DnsQuery_s\r\n | distinct DnsQuery, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DistinctQueries=dcount(DnsQuery) by bin(TimeGenerated, 6h)", "size": 0, "title": "Unique domains queried over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "timechart" }, "customWidth": "25", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where EventResultDetails == 'NXDOMAIN'\r\n | summarize NXDOMAINCount=tolong(count()) by bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where EventResultDetails_s == 'NXDOMAIN'\r\n | summarize NXDOMAINCount=tolong(sum(count__d)) by bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize NXDOMAINCount = sum(NXDOMAINCount) by bin(TimeGenerated, 6h)", "size": 0, "title": "Requests to non-existent domains over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "timechart" }, "customWidth": "25", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(EventResultDetails)\r\n | summarize ResultCount=tolong(count()) by EventResultDetails\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(EventResultDetails_s)\r\n | summarize ResultCount=tolong(sum(count__d)) by EventResultDetails=EventResultDetails_s\r\n )\r\n | summarize ResultCount = sum(ResultCount) by EventResultDetails", "size": 0, "title": "DNS Events by Result type", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery)\r\n | summarize DNSEvents=tolong(count()) by DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery_s)\r\n | summarize DNSEvents=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by DnsQuery, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(DNSEvents) by DnsQuery\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(DNSEvents,1000000) by DnsQuery\r\n ) on DnsQuery\r\n | project DnsQuery, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 0, "title": "Top 25 queried Domains", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "pink" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "pink" } } ] } }, "customWidth": "33", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(SrcIpAddr)\r\n | summarize Clients=tolong(count()) by SrcIpAddr, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(SrcIpAddr_s)\r\n | summarize Clients=tolong(sum(count__d)) by SrcIpAddr=SrcIpAddr_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize Clients = sum(Clients) by SrcIpAddr, bin(TimeGenerated, 6h);\r\n DNSData\r\n | summarize TotalCount = sum(Clients) by SrcIpAddr\r\n | join kind=inner (DNSData\r\n | summarize Trend=make_set(Clients,1000000) by SrcIpAddr\r\n ) on SrcIpAddr\r\n | project SrcIpAddr, TotalCount, Trend\r\n | order by TotalCount desc\r\n | take 25", "size": 0, "title": "Top 25 Clients by events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalCount", "formatter": 8, "formatOptions": { "palette": "blueDark" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blueDark" } } ] } }, "customWidth": "33", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicatorsv2\r\n| where DomainName == \"{DnsQuery}\"\r\n| where Active == true\r\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n| project LatestIndicatorTime, DomainName, Action, ConfidenceScore,ThreatType, ThreatSeverity, Description, ExternalIndicatorId, ExpirationDateTime, IndicatorId, TrafficLightProtocolLevel", "size": 0, "title": "Domain Information from Threat Intelligence table", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ] }, "customWidth": "50", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelIndicatorsv2\r\n// Picking up only IOC's that contain the entities we want\r\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\r\n// Taking the first non-empty value based on potential IOC match availability\r\n| extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP,EmailSourceIpAddress,\"\")\r\n| where TI_ipEntity=='{SrcIpAddr}' and Active == true\r\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\r\n| project LatestIndicatorTime, TI_ipEntity, Action, ConfidenceScore,ThreatType, ThreatSeverity, Description, ExternalIndicatorId, ExpirationDateTime, IndicatorId, TrafficLightProtocolLevel", "size": 0, "title": "IP information from Threat Intelligence table", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ] }, "customWidth": "50", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where Entities has \"{SrcIpAddr}\" or Entities has \"{DnsQuery}\"\r\n| project TimeGenerated, DisplayName, AlertName, AlertSeverity, ProviderName, VendorName, SystemAlertId, StartTime, EndTime, todynamic(ExtendedProperties), Entities", "size": 0, "title": "Security alerts with searched IP or DNS query", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ] }, "customWidth": "50", "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery)\r\n | extend QueryLength = strlen(DnsQuery)\r\n | summarize TotalCount=tolong(count()) by QueryLength, SrcIpAddr\r\n | order by QueryLength, TotalCount desc\r\n | project SrcIpAddr, QueryLength, TotalCount\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery_s)\r\n | extend QueryLength = strlen(DnsQuery_s)\r\n | summarize TotalCount=tolong(sum(count__d)) by QueryLength, SrcIpAddr=SrcIpAddr_s\r\n | order by QueryLength, TotalCount desc\r\n | project SrcIpAddr, QueryLength, TotalCount\r\n )\r\n | summarize TotalCount = sum(TotalCount) by SrcIpAddr, QueryLength\r\n | where isnotempty(SrcIpAddr)\r\n | order by QueryLength, TotalCount desc\r\n | take 10\r\n ", "size": 0, "title": "Query length by SrcIpAddr", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "scatterchart", "chartSettings": { "showLegend": true } }, "customWidth": "50", "name": "query - 11", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let maxSummarizedTime = toscalar (\r\n union isfuzzy=true \r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where EventTime_t >= {TimeRange:start}\r\n | summarize max_TimeGenerated=max(EventTime_t)\r\n | extend max_TimeGenerated = datetime_add('hour',1,max_TimeGenerated)\r\n ),\r\n (\r\n print({TimeRange:start})\r\n | extend max_TimeGenerated = print_0\r\n | project max_TimeGenerated\r\n )\r\n | summarize maxTimeGenerated = max(max_TimeGenerated) \r\n );\r\nlet DNSData = \r\nunion isfuzzy=true \r\n (\r\n _Im_Dns(starttime=todatetime(maxSummarizedTime), endtime=now())\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery)\r\n | summarize DNSEvents=tolong(count()) by DnsQuery, bin(TimeGenerated,6h)\r\n ),\r\n (\r\n DNSEssentialsCustomParser\r\n | where Type in (\"DNS_Summarized_Logs_ip_CL\", \"DNS_Summarized_Logs_ipV1_CL\")\r\n | where TimeGenerated >= {TimeRange:start}\r\n | where ('{SrcIpAddr}' == '*' or (SrcIpAddr_s == '{SrcIpAddr}'))\r\n and ('{DnsQuery}' == '*' or (DnsQuery_s == '{DnsQuery}'))\r\n | where isnotempty(DnsQuery_s)\r\n | summarize DNSEvents=tolong(sum(count__d)) by DnsQuery=DnsQuery_s, bin(TimeGenerated=EventTime_t,6h)\r\n )\r\n | summarize DNSEvents = sum(DNSEvents) by DnsQuery, bin(TimeGenerated, 6h);\r\n DNSData\r\n //Break the domain into its parts\r\n | extend DomainParts = split(DnsQuery,'.')\r\n //Use the rightmost parts of the URL\r\n | extend Top_Level_Domain = strcat(DomainParts[toint(array_length(DomainParts)-2)],'.',DomainParts[toint(array_length(DomainParts)-1)])\r\n //If the two right most parts are too short (e.g. \"co.uk\" or \"com.tr\", add another part\r\n | extend Top_Level_Domain = iif(strlen(Top_Level_Domain)<7,strcat(DomainParts[toint(array_length(DomainParts)-3)],'.',Top_Level_Domain),Top_Level_Domain)\r\n | summarize SubDomainRequestCount = toint(sum(DNSEvents)) by Top_Level_Domain, DnsQuery\r\n | join kind=inner \r\n (\r\n DNSData\r\n //Break the domain into its parts\r\n | extend DomainParts = split(DnsQuery,'.')\r\n //Use the rightmost parts of the URL\r\n | extend Top_Level_Domain = strcat(DomainParts[toint(array_length(DomainParts)-2)],'.',DomainParts[toint(array_length(DomainParts)-1)])\r\n //If the two right most parts are too short (e.g. \"co.uk\" or \"com.tr\", add another part\r\n | extend Top_Level_Domain = iif(strlen(Top_Level_Domain)<7,strcat(DomainParts[toint(array_length(DomainParts)-3)],'.',Top_Level_Domain),Top_Level_Domain)\r\n | summarize DomainRequestCount = toint(sum(DNSEvents)) by Top_Level_Domain\r\n ) on Top_Level_Domain\r\n | extend pk = SubDomainRequestCount/todouble(DomainRequestCount)\r\n //calculate entropy according to Shannon function https://en.wiktionary.org/wiki/Shannon_entropy\r\n | extend h1= -log2(pk)*pk\r\n | summarize SubDomainEntropy = sum(h1), DomainRequestCount = any(DomainRequestCount) ,DNSQueries=make_list(DnsQuery) by TopLevelDomain=Top_Level_Domain\r\n | order by SubDomainEntropy desc\r\n | take 25", "size": 0, "title": "Domain entropy", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SubDomainEntropy", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "TotalSubDomains", "formatter": 4, "formatOptions": { "palette": "blueDark" } }, { "columnMatch": "DNSQueries", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "75%" } }, { "columnMatch": "Sub_Domain_Entropy", "formatter": 8, "formatOptions": { "palette": "coldHot" } }, { "columnMatch": "Total_Sub_Domains", "formatter": 4, "formatOptions": { "palette": "blueDark" } }, { "columnMatch": "list_DnsQuery", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "75%" } } ] } }, "name": "query - 12" } ] }, "conditionalVisibility": { "parameterName": "tabVisibility", "comparison": "isEqualTo", "value": "investigate" }, "name": "Group - IP Investigate" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-DNSDomainSolution", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }