{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Azure CloudNGFW By Palo Alto Networks - Network Threat\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d0ccb5c6-8a07-4b7e-9abf-38fa4dcc0baf", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } }, { "id": "a2094f99-1479-450e-8a18-e9677a18fdaf", "version": "KqlParameterItem/1.0", "name": "SubType", "label": "Sub Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ \"THREAT\"\n| extend message = parse_json(Message)\n| where isnotempty(message.sub_type)\n| distinct tostring(message.sub_type)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "51f92c36-ed03-408d-b392-11a1ae74aff3", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s =~ \"THREAT\"\n| extend message = parse_json(Message)\n| where isnotempty(message.sub_type)\n| distinct tostring(message.severity)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All" }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let UrlThreats = fluentbit_CL\r\n | extend message = parse_json(Message)\r\n | where isnotempty(message.url_category_list)\r\n | where ident_s =~ 'THREAT'\r\n | project FirewallName_s, ident_s, message.url_category_list\r\n | summarize Count = count(), FirewallName = any(FirewallName_s) by tostring(message_url_category_list);\r\n\r\nlet Threats = fluentbit_CL\r\n| extend message = parse_json(Message)\r\n| where isnotempty(message.sub_type)\r\n| where ident_s =~ 'THREAT'\r\n| project FirewallName_s, ident_s, message.sub_type, message.threat_category\r\n| summarize Count = count(), FirewallName = any(FirewallName_s) by tostring(message_threat_category);\r\n\r\nUrlThreats \r\n| union Threats\r\n| extend Threat = strcat(message_url_category_list, \" \", message_threat_category)\r\n| project FirewallName, Threat, Count", "size": 3, "title": "Threats, by subtypes", "timeContextFromParameter": "TimeRange", "exportFieldName": "threat_content_type", "exportParameterName": "SelectedSubtype", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Threat", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "50", "name": "Threats by subtypes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = fluentbit_CL\r\n| where isnotempty(FirewallName_s)\r\n| extend message = parse_json(Message)\r\n| where ident_s == 'THREAT' and isnotempty(message.sub_type);\r\ndata\r\n| summarize Count = count() by tostring(message.severity)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by tostring(message.severity))\r\n on message_severity\r\n| project-away message_severity1, TimeGenerated\r\n| extend message_severities = message_severity\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend message_severity = 'All', messsage_severities = '*' \r\n)\r\n| project message_severity, Count, Trend\r\n| order by Count desc\r\n| take 10", "size": 3, "title": "Threats severity", "timeContextFromParameter": "TimeRange", "exportFieldName": "severity", "exportParameterName": "SelectedSeverity", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "lightBlue", "showIcon": true } } ] }, "tileSettings": { "titleContent": { "columnMatch": "message_severity", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "50", "name": "Threats severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| extend message = parse_json(Message)\n| where ident_s == 'THREAT' and isnotempty(message.sub_type)\n| where \"{SubType:label}\" == \"All\" or message.sub_type in ({SubType})\n| where \"{Severity:label}\" == \"All\" or message.severity in ({Severity})\n| summarize count() by bin(TimeGenerated, 1h), tostring(message.sub_type)\n| render timechart\n", "size": 0, "title": "Threat subtypes over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "37.5", "name": "Threat subtypes over time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where '{SubType:label}' == \"All\" or message.sub_type in ({SubType})\n| where '{Severity:label}' == \"All\" or message.severity in ({Severity})\n| summarize count() by bin(TimeGenerated, 1h), tostring(message.severity)\n| render timechart\n", "size": 0, "title": "Threat severity over time", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "37.5", "name": "Threat severity over time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\r\n| extend message = parse_json(Message)\r\n| where isnotempty(message.sub_type)\r\n| where ident_s =~ 'THREAT'\r\n| project TimeGenerated,FirewallName_s, ident_s, message.sub_type, message.threat_category, message.app\r\n| summarize Count = count() by bin(TimeGenerated, 1h), tostring(message_app)\r\n| render timechart ", "size": 0, "title": "Threats, by application", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "showIcon": true } } ] }, "tileSettings": { "titleContent": { "columnMatch": "ApplicationProtocol", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blueDark", "showIcon": true } }, "showBorder": false } }, "customWidth": "25", "name": "Threats by application" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| extend message = parse_json(Message)\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| project TimeGenerated, FirewallName=FirewallName_s, LogSeverity=message.severity, DeviceAction=message.action, ['Threat Category'] = message.threat_category, App=message.app, SourceIP=message.src_ip, SourcePort=message.sport, DestinationIP=message.dst, DestinationPort=message.dport", "size": 0, "title": "Threat events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "All Threat Events" }, { "type": 1, "content": { "json": "---" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| where message.sub_type =~ 'vulnerability' or message.sub_content_type =~ 'wildfire'\n| extend ThreatId = coalesce(\n column_ifexists(\"threat_content_name\", \"\"),\n extract(\"\\\\((.*?)\\\\)\",1,tostring(message.threat_content_name)),\n \"\"\n )\n| summarize Amount=count() by ThreatId, tostring(message.severity)\n| top 20 by Amount", "size": 0, "title": "Top vulnerability events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Amount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ], "filter": true } }, "customWidth": "100", "name": "Top vulnerability events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "fluentbit_CL\n| where isnotempty(FirewallName_s)\n| where ident_s == 'THREAT'\n| extend message = parse_json(Message)\n| extend ThreatId = coalesce(\n column_ifexists(\"threat_content_name\", \"\"),\n extract(\"\\\\((.*?)\\\\)\",1,tostring(message.threat_content_name)),\n \"\"\n )\n| extend ThreatCategory = tostring(message.threat_category)\n| summarize Amount=count() by ThreatId, ThreatCategory, tostring(message.severity)\n| top 20 by Amount", "size": 0, "title": "Top correlation events", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Amount", "formatter": 4, "formatOptions": { "palette": "coldHot", "showIcon": true } } ] } }, "name": "Top correlation events" } ], "fromTemplateId": "sentinel-PaloAltoNetworkThreat", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }