{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "a4b4e975-fa7c-46a3-b669-850aacc88134", "version": "KqlParameterItem/1.0", "name": "Help", "label": "🔎 Getting Started", "type": 10, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]", "value": "No" }, { "id": "314d02bf-4691-43fa-af59-d67073c8b8fa", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "e6ded9a1-a83c-4762-938d-5bf8ff3d3d38", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "crossComponentResources": [ "value::all" ], "typeSettings": { "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "e3225ed0-6210-40a1-b2d0-66e42ffa71d6", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\r\n| mvexpand All limit 100\r\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "15b2c181-7397-43c1-900a-28e175ae8a6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "Parameter Selectors" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/r/0diZsXih6e)" }, "name": "Survey" }, { "type": 1, "content": { "json": "## Getting Started\r\nThe Microsoft Sentinel: Maturity Model for Event Log Management (M-21-31) Solution leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align directly with the requirements outlined in the Executive Office of the President: Office of Management & Budget Memorandum (M-21-31): Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents. This solution provides the capability to design, build, monitor, and remediate event log management. The Solution includes (1) Workbook for reporting, (5) Analytics Rules for monitoring, and (1) Playbook for response/remediation. The documentation below provides getting started recommendations for centralizing log analytics data and enabling Microsoft Defender for Cloud Continuous Export. This offering includes telemetry from 25+ Microsoft and Third Party products. Common use cases include conducting M-21-31 assessments via custom reporting, time filtering, subscription filtering, workspace filtering, and guides. The report is exportable for print or PDF with the Print Workbook feature. The workbook is organized by Event Logging Tiers (1-3) which highlight maturity from basic to advanced levels. There are multiple requirements within each Event Logging Tier, each covered by a Control Card. Control Cards include requirements summary, reference documentation links, recommendations for build/design, technology mapping, telemetry over time, and product/portal pages. For more information, see 💡[Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents (M-21-31)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)
\r\n\r\n### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions)\r\n| Roles | Rights | \r\n|:--|:--|\r\n|Security Reader | View Workbooks, Analytics, Hunting, Security Recommendations |\r\n|Security Contributor| Deploy/Modify Workbooks, Analytics, Hunting Queries, Apply Security Recommendations |\r\n|Automation Contributor| Deploy/Modify Playbooks & Automation Rules |\r\n|Owner| Assign Regulatory Compliance Initiatives|\r\n\r\n### Onboarding Prerequisites \r\n1️⃣ [Design Log Management Architecture](https://docs.microsoft.com/azure/azure-monitor/logs/design-logs-deployment)
\r\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\r\n3️⃣ [Connect & Ingest Data Sources](https://docs.microsoft.com/azure/sentinel/connect-data-sources)
\r\n4️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\r\n5️⃣ [Configure 12 Months Hot Path Storage with Data Retention](https://docs.microsoft.com/azure/azure-monitor/logs/data-retention-archive)
\r\n6️⃣ [Configure 18 Months Cold Path Storage with Azure Data Explorer](https://docs.microsoft.com/azure/sentinel/store-logs-in-azure-data-explorer) & [Configure Basic Logs](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure)
\r\n7️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\r\n8️⃣ [Add the Azure Security Benchmark and NIST SP 800-53 R4 Assessments to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\r\n9️⃣ [Continuously Export Microsoft Defender for Cloud Security Recommendations to Microsoft Sentinel](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n\r\n### Print/Export Report\r\n1️⃣ Set Background Theme: Settings > Appearance > Theme: Azure > Apply
\r\n2️⃣ Print/Export Report: More Content Actions (...) > Print Content
\r\n3️⃣ Settings: Layout (Landscape), Pages (All), Print (One Sided), Scale (60), Pages Per Sheet (1), Quality (1,200 DPI), Margins (None) > Print
\r\n\r\n### Disclaimer\r\nThis Solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All requirements, validations, and controls are governed by respective organizations. This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. ", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "Help" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Maturity Model for Event Log Management (M-21-31) Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\n---\n\nThis solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to increase visibility before, during, and after a cybersecurity incident. Information from logs on information systems (for both on-premises systems and connections \nhosted by third parties, such as cloud services providers (CSPs) is invaluable in the detection, \ninvestigation, and remediation of cyber threats. \"Executive Order 14028, Improving the Nation's Cybersecurity, directs decisive action to improve the Federal Government’s investigative and remediation capabilities. This memorandum was developed in accordance with and addresses the requirements in section 8 of the Executive Order for logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise security operations center (SOC) of each agency.\" For more information, see the💡[M-21-31 Memorandum](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\n" }, "name": "Workbook Overview" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/quV_80ts__k", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MaturityModelForEventLogManagementM2131", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "79", "name": "group - 2" }, { "type": 1, "content": { "json": "![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) " }, "customWidth": "21", "name": "Microsoft Sentinel Logo" } ] }, "name": "group - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Capabilities\\\": \\\"Executive Summary\\\", \\\"tab\\\": \\\"AT\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Assessment Tracker\\\", \\\"tab\\\": \\\"AS\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Controls Crosswalk\\\", \\\"tab\\\": \\\"CC\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Data Connectors\\\", \\\"tab\\\": \\\"DC\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Log Management\\\", \\\"tab\\\": \\\"LM\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Log Retention\\\", \\\"tab\\\": \\\"RE\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a30d01d0-38f1-4a91-9cf6-cdb181d676b5", "version": "KqlParameterItem/1.0", "name": "isATVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "AT", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "351dcb3f-0554-4677-8229-45bfd2aa3659", "version": "KqlParameterItem/1.0", "name": "isASVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "AS", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isCCVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "CC", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "462fc8d4-d8cb-41a6-b1ff-d46d241e918c" }, { "version": "KqlParameterItem/1.0", "name": "isDCVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "DC", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "d6d4eecf-14c7-47d3-a13e-f800180e62a1" }, { "version": "KqlParameterItem/1.0", "name": "isLMVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "LM", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "b9206eb3-218c-4745-9cfe-9a9e49e46314" }, { "id": "5b008366-4fb9-41b2-b6e5-66785b614818", "version": "KqlParameterItem/1.0", "name": "isREVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "RE", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\t\\r\\n\\t{ \\\"Capabilities\\\": \\\"Event Logging (EL0)\\\", \\\"tab\\\": \\\"EL0\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Basic Event Logging (EL1)\\\", \\\"tab\\\": \\\"EL1\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Intermediate Event Logging (EL2)\\\", \\\"tab\\\": \\\"EL2\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Advanced Event Logging (EL3)\\\", \\\"tab\\\": \\\"EL3\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Multi-Tenant Logging\\\", \\\"tab\\\": \\\"AL\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Recommended Content\\\", \\\"tab\\\": \\\"GC\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers - Copy", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6e2cb571-bd9e-4842-8693-913e4b278de8", "version": "KqlParameterItem/1.0", "name": "isEL0Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isEL1Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "b6df1ad7-4aed-4923-89e1-f5df6c158840" }, { "id": "a8be79a8-e38f-43c5-aa71-2644fe5ca3b5", "version": "KqlParameterItem/1.0", "name": "isEL2Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "36bd239f-648c-4eed-95ce-6c9ade0f88a4", "version": "KqlParameterItem/1.0", "name": "isEL3Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isALVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "AL", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "db6caf9b-97fd-48f0-bd62-649f85293db6" }, { "id": "106b78c8-e6c0-4a92-ae89-2f221749cdc2", "version": "KqlParameterItem/1.0", "name": "isGCVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "GC", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Executive Summary](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\r\n---\r\n\r\nThis section provides a mechanism to implement M-21-31 recommendations. A selector provides capability to filter by all, specific, or groups of event logging levels. Upon selection, subordinate panels will summarize recommendations by event logging level, status over time, recommendations, and resources identified. These panels are helpful for identifying the event logging areas of interest, status over time, and which resources are most impacted by these gaps. " }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "99a47f97-1aa4-4840-91ee-119aad6d6217", "version": "KqlParameterItem/1.0", "name": "MaturityLevel", "label": "Maturity Level", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Event Logging (EL0)\", \"label\": \"Event Logging (EL0)\"},\r\n {\"value\": \"Basic Event Logging (EL1)\", \"label\": \"Basic Event Logging (EL1)\"},\r\n {\"value\": \"Intermediate Event Logging (EL2)\", \"label\": \"Intermediate Event Logging (EL2)\"},\r\n {\"value\": \"Advanced Event Logging (EL3)\", \"label\": \"Advanced Event Logging (EL3)\"}\r\n]", "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "parameters - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by MaturityLevel\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| project MaturityLevel, Total, PassedControls, Passed, Failed, Applicable, NotApplicable\r\n| sort by Total, Passed desc\r\n", "size": 0, "title": "Recommendations by Maturity Level", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by MaturityLevel\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| project MaturityLevel, Total, PassedControls, Passed, Failed, Applicable, NotApplicable\r\n| sort by Total, Passed desc\r\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Recommendations", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by AssessedResourceId\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| project AssessedResourceId, Total, PassedControls, Passed, Failed, Applicable, NotApplicable\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Recommendations by Asset", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| make-series count() default=0 on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step 1d by MaturityLevel\r\n| render timechart", "size": 0, "title": "Recommendations over Time", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "isATVisible", "comparison": "isEqualTo", "value": "true" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| where MaturityLevel in ({MaturityLevel})\r\n| extend RemediationLink = strcat(\"https://\",RecommendationLink)\r\n| summarize arg_max(TimeGenerated, *) by RecommendationDisplayName, AssessedResourceId\r\n| where RecommendationState == \"Unhealthy\"\r\n| project ResourceID=AssessedResourceId, RecommendationName=RecommendationDisplayName, MaturityLevel, Severity=RecommendationSeverity, RecommendationState, RemediationLink, DiscoveredDate=StatusChangeDate\r\n| parse RemediationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "title": "Recommendation Details", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "isATVisible", "comparison": "isEqualTo", "value": "true" }, "name": "query - 8" } ] }, "conditionalVisibility": { "parameterName": "isATVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Assessment" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Controls Crosswalk](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\r\n---\r\nControls crosswalk provides a mapping of Maturity Model for Event Log Management (M-21-31) controls across respective capabilities. This provides free-text search capabilities mapping M-21-31 Controls, Maturity Level, and Microsoft Product Overlays which is single-click exportable to a .csv file. " }, "customWidth": "40", "name": "Controls Mapping" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Crosswalk = datatable([\"Control Requirement\"]: string, [\"Maturity Level\"]: string, [\"Microsoft Offerings Overlay\"]: string, [\"Recommended Logs\"]: string) [\r\n\"Identity & Credential Management\" , \"EL0\" , \"Microsoft Sentinel, Azure Active Directory, Azure Monitor\" , \"SigninLogs, AuditLogs, IdentityInfo\",\r\n\"Privileged Identity & Credential Management\" , \"EL0\" , \"Microsoft Sentinel, Azure Active Directory\" ,\"AuditLogs, AADServicePrincipalSignInLogs, AADManagedIdentitySignInLogs, IdentityInfo\",\r\n\"IP & Domain Reputation\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Office 365\" ,\"ThreatIntelligenceIndicator, EmailEvents\",\r\n\"DHCP Lease Information\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Endpoint\" ,\"DeviceNetworkInfo\",\r\n\"DNS\" , \"EL0\" , \"Microsoft Sentinel, Azure Monitor, Azure DNS\",\"DnsEvents\",\r\n\"Passive DNS Log\" , \"EL0\" , \"Microsoft Sentinel, Azure Monitor, Azure DNS, Microsoft Defender for Endpoint\" ,\"DnsEvents, DeviceNetworkEvents\",\r\n\"DNS, DHCP, & Wi-Fi\" , \"EL0\" , \"Azure Monitor, Azure DNS\" ,\"CommonSecurityLog\",\r\n\"IDS / IPS / NTA / NDR / SIEM\" , \"EL0\" , \"Microsoft Sentinel, Azure Firewall, Azure Web Application Firewall, Azure Monitor, Azure Resource Graph, Azure Information Protection, Azure DNS\" ,\"AzureDiagnostics, Usage, Resources, InformationProtectionLogs_CL, DnsEvents\",\r\n\"Router & Switches\" , \"EL0\" , \"Virtual Network, Azure Active Directory, Azure Monitor, Azure Resource Graph\" ,\"Resources, AzureActivity, SigninLogs\",\r\n\"Proxies & Web Content Filters\" , \"EL0\" , \"Azure Firewall, Azure Web Application Firewall, Application Gateway\" ,\"AzureDiagnostics\",\r\n\"Access, Authorization, & Accounting\" , \"EL0\" , \"Azure Monitor, Microsoft Defender for Office 365\" ,\"AzureActivity, OfficeActivity\",\r\n\"User & Administrator Access to OS Components & Applications (Windows)\" , \"EL0\" , \"Microsoft Defender for Endpoint\" ,\"SecurityEvent\",\r\n\"User & Administrator Access to OS Components & Applications (Mac OS)\" , \"EL0\" , \"Microsoft Sentinel\" ,\"Syslog\",\r\n\"User & Administrator Access to OS Components & Applications (Linux)\" , \"EL0\" , \"Microsoft Sentinel\" ,\"Syslog, CommonSecurityLog\",\r\n\"Cloud Environments (General Logging)\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Cloud, Azure Monitor\" ,\"AzureActivity, AWSCloudTrail, GWorkspaceActivityReports\",\r\n\"Cloud AWS\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Cloud, Azure Monitor\" ,\"AWSCloudTrail, AWSGuardDuty, AWSVPCFlow, SecurityRecommendation, SecurityAlert\",\r\n\"Cloud Azure\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Cloud, Azure Monitor, Azure Blob Storage\" ,\"AzureActivity, OfficeActivity, AuditLogs, SigninLogs, StorageBlobLogs, StorageFileLogs\",\r\n\"Cloud GCP\" , \"EL0\" , \"Microsoft Sentinel, Microsoft Defender for Cloud, Azure Monitor\" ,\"GWorkspaceActivityReports, SecurityAlert, SecurityRecommendation\",\r\n\"Configuration\" , \"EL1\" , \"Azure Monitor, Microsoft 365 Defender, Microsoft Sentinel\" ,\"AzureActivity, Perf, OfficeActivity, SentinelHealth\",\r\n\"Endpoint Detection & Response (EDR)\" , \"EL1\" , \"Microsoft Defender for Endpoint\" ,\"SecurityAlert, DeviceEvents, DeviceNetworkEvents, DeviceLogonEvents, DeviceFileEvents, DeviceRegistryEvents, DeviceProcessEvents\",\r\n\"Configuration Changes\" , \"EL1\" , \"Microsoft Sentinel, Azure Active Directory, Microsoft Defender for Office 365, Microsoft Defender for Endpoint\" ,\"AuditLogs, SigninLogs, OfficeActivity, SecurityEvent, IdentityInfo\",\r\n\"Administrative\" , \"EL1\" , \"Microsoft Sentinel, Azure Active Directory\" ,\"AuditLogs, SigninLogs, SecurityAlert, IdentityInfo\",\r\n\"Authorization\" , \"EL1\" , \"Azure Active Directory, Azure Monitor, Microsoft Defender for Endpoint\" ,\"SigninLogs, VMProcess, DeviceProcessEvents, Syslog\",\r\n\"Content Filtering Policy Updates\" , \"EL1\" , \"Microsoft Defender for Office 365\" ,\"OfficeActivity, EmailEvents\",\r\n\"Anti-Virus & Behavior Based Malware Protection\" , \"EL1\" , \"Microsoft Sentinel, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Defender for Cloud\" ,\"SecurityAlert, SecurityEvent, EmailEvents, EmailAttachmentInfo, ThreatIntelligenceIndicator, SecurityRecommendation\",\r\n\"Indication of the Host that Connected to a Specific URL\" ,\"EL1\" , \"Azure Monitor, Microsoft Defender for Endpoint, Azure Firewall\" ,\"DeviceNetworkEvents, SecurityAlert, AzureDiagnostics, VMConnection\",\r\n\"All Devices\" , \"EL1\" , \"Automation, Microsoft Defender for Endpoint\" ,\"DeviceProcessEvents, ConfigurationData, ConfigurationChange\",\r\n\"Firewalls\" , \"EL1\" , \"Azure Firewall\" ,\"AzureDiagnostics\",\r\n\"IDS /IPS Alerts & Events\" , \"EL1\" , \"Azure Firewall\" ,\"AzureDiagnostics\",\r\n\"VPN Gateway\" , \"EL1\" , \"VPN Gateway\" ,\"GatewayDiagnosticLog, TunnelDiagnosticLog, IKEDiagnosticLog, RouteDiagnosticLog, P2SDiagnosticLog\",\r\n\"PKI Infrastructure\" , \"EL1\" , \"Key Vault, Microsoft Defender for Cloud\" ,\"AzureActivity, SecurityRecommendation, Resources\",\r\n\"Vulnerability Assessments\" , \"EL1\" , \"Microsoft Defender for Cloud, Microsoft Defender for Endpoint\" ,\"Resources, SecurityRecommendation, SecurityNestedRecommendation\",\r\n\"Database Level\" , \"EL1\" , \"Microsoft Defender for Cloud, Azure SQL Database, Azure Cosmos DB, Azure Database for MariaDB, Azure Database for PostgreSQL, Azure Database for MySQL, Azure Cache for Redis\" ,\"SecurityRecommendation, SigninLogs, AzureActivity, Event, SqlAtpStatus\",\r\n\"Web Applications\" , \"EL1\" , \"Azure Web Application Firewall\" ,\"AzureDiagnostics\",\r\n\"Web Application Crashes\" , \"EL1\" , \"Azure Monitor\" ,\"Requests\",\r\n\"Web Application & Middleware\" , \"EL1\" , \"Azure Resource Graph, App Service\" ,\"Resources\",\r\n\"Virtualization on System\" , \"EL1\" , \"Azure VMware Solution, Azure Monitor\" ,\"SigninLogs\",\r\n\"Mobile (Smart Phones & Tablets) EMM (UEM) / MTD Agent Logs\" , \"EL1\" , \"Microsoft Endpoint Manager\" ,\"IntuneAuditLogs, IntuneDevices, IntuneOperationalLogs, IntuneDeviceComplianceOrg\",\r\n\"Container Supply Chain\" , \"EL1\" , \"Azure Kubernetes Service (AKS), Azure Resource Graph, Azure Monitor\" ,\"ContainerInventory, AzureDiagnostics, ContainerInstanceLog_CL, ContainerEvent_CL, Resources\",\r\n\"System Status\" , \"EL2\" , \"Azure Monitor\" ,\"InsightsMetrics\",\r\n\"Raw & Metadata - Filtering Events\" , \"EL2\" , \"Microsoft Defender for Office 365\" ,\"EmailEvents, EmailAttachmentInfo, EmailUrlInfo, SecurityAlert\",\r\n\"Data Loss Prevention\" , \"EL2\" , \"Azure Information Protection, Microsoft Information Protection\" ,\"InformationProtectionLogs_CL\",\r\n\"Full Packet Capture Data\" , \"EL2\" , \"Network Watcher, Virtual Network, Azure Monitor\" ,\"NetworkWatcher\",\r\n\"Commercial Off the Shelf (COTS) Non-COTS, Custom Applications\" , \"EL2\", \"Azure Active Directory, Azure Monitor, Azure Web Application Firewall, Microsoft Defender for Cloud, Microsoft Defender for Cloud Apps, Microsoft 365 Defender\" ,\"SigninLogs, SecurityRecommendation, SecurityAlert, CloudAppEvents, Resources, AzureDiagnostics\",\r\n\"Container - Image, Management, Orchestration, OS\" , \"EL2\" , \"Microsoft Defender for Cloud, Azure Resource Graph, Azure Active Directory, Azure Monitor, Azure Kubernetes Service (AKS)\",\"ContainerInventory, AzureActivity, AuditLogs, Resources, SecurityRecommendation\",\r\n\"Software Updates\" , \"EL3\" , \"Azure Automation, Microsoft Defender for Cloud\" ,\"Update, SecurityRecommendation\",\r\n\"Spam Dictionary Modifications\" , \"EL3\" , \"Microsoft Defender for Office 365\" ,\"OfficeActivity, EmailEvents\",\r\n\"Mainframes\" , \"EL3\" , \"Microsoft Sentinel, Microsoft Defender for Cloud\" ,\"Syslog\",\r\n\"Container - Cluster/Pod Events\" , \"EL3\" , \"Azure Kubernetes Service (AKS), Container Instances, Azure Red Hat OpenShift\" ,\"AzureDiagnostics\",\r\n\"Logging Orchestration, Automation & Response\" , \"EL3\" , \"Microsoft Sentinel, Logic Apps\" ,\"Resources, AzureActivity\",\r\n\"User Behavior Monitoring\" , \"EL3\" , \"Microsoft Sentinel, Microsoft 365: Insider Risk Management\" ,\"BehaviorAnalytics, SecurityAlert\",\r\n\"Application Container Security, Operations, and Management\" , \"EL3\" , \"Microsoft Defender for Cloud\",\"SecurityRegulatoryCompliance\"\r\n];\r\nCrosswalk\r\n| project [\"Control Requirement\"],[\"Maturity Level\"],[\"Microsoft Offerings Overlay\"],[\"Recommended Logs\"]", "size": 0, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Control Requirement", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Persistence", "text": "{0}{1}" } ] } }, { "columnMatch": "Maturity Level", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "EL0", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL1", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL2", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL3", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "Default", "representation": "Sev4", "text": "{0}{1}" } ] } }, { "columnMatch": "Microsoft Offerings", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Recommended Logs", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Log", "text": "{0}{1}" } ] } } ], "filter": true } }, "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "isCCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Controls Mapping" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Recommended Data Connectors](https://docs.microsoft.com/azure/sentinel/connect-data-sources)\r\n---\r\n\r\nAfter onboarding Microsoft Sentinel into your workspace, connect data sources to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many connectors for Microsoft products, available out of the box and providing real-time integration. For example, service-to-service connectors include Microsoft 365 Defender connectors and Microsoft 365 sources, such as Office 365, Microsoft Entra ID, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Check out these references if you're new to Microsoft Sentinel." }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "b1cd1f8a-e807-4deb-93f4-7812e5ed014a", "linkTarget": "OpenBlade", "linkLabel": "Data Connectors >>", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorsBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "20", "name": "EL0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://docs.microsoft.com/azure/sentinel/best-practices", "linkTarget": "Url", "linkLabel": "Best Practices", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://docs.microsoft.com/learn/browse/?wt.mc_id=resilience_skilling_webpage_gdc&terms=sentinel", "linkTarget": "Url", "linkLabel": "Microsoft Sentinel Training", "style": "link" } ] }, "customWidth": "40", "name": "links - 29" } ], "exportParameters": true }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Foundational Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Activity Connector](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "909d0019-23cb-43ad-8285-9f1dca1cd1be", "version": "KqlParameterItem/1.0", "name": "AzureActivity", "label": "Status", "type": 1, "query": "AzureActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "58cc25ab-a9af-4516-99e1-fa22e0637a76", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActivity" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "33", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Entra ID Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "23ba579d-c894-43be-9fe1-d1b04bc34d7a", "version": "KqlParameterItem/1.0", "name": "SignInLogs", "label": "Status", "type": 1, "query": "SigninLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Active Directory" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "7c97e893-29f3-4d4c-a379-f220bb82518c", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActiveDirectory" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Active Directory (AAD) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Office 365 Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-365-formerly-office-365)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "68bd12c8-e473-45d1-8bbc-2dd9f326ea69", "version": "KqlParameterItem/1.0", "name": "OfficeActivity", "label": "Status", "type": 1, "query": "OfficeActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6a86eb8d-5487-4aad-ae7b-b526e68a249f", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Office365" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Office 365 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Cloud Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#tenant-based-microsoft-defender-for-cloud)\r\n\r\n" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "1673e4cf-354f-4a42-bed2-2374be47779e", "version": "KqlParameterItem/1.0", "name": "MDfC", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"Azure Security Center\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "56600b70-0e55-433a-be86-b7c561bced8b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSecurityCenter" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Defender for Cloud Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Network Security Groups (NSG) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#network-security-groups)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b17ce357-e8d5-4c7c-a4f0-765598462a1c", "version": "KqlParameterItem/1.0", "name": "NSG", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"NetworkSecurityGroupEvent\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "935bb630-1fce-4021-b7b4-c010b9e05973", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureNSG" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Network Security Groups (NSG) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Windows Security Events (AMA) Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CAMA#windows-agent-based-connections)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d9af27d9-8c90-4c85-a57f-f329257d9956", "version": "KqlParameterItem/1.0", "name": "AMA", "label": "Status", "type": 1, "query": "SecurityEvent\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d002eb41-c632-429b-8504-846b69314620", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsSecurityEvents" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Windows Security Events (AMA) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Security Events via Legacy Agent Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CLAA#windows-agent-based-connections)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b2737fbc-c0e2-4584-9fba-ee7d057d7db0", "version": "KqlParameterItem/1.0", "name": "SecurityEvent", "label": "Status", "type": 1, "query": "SecurityEvent\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "9a8b0649-e79b-4a30-be25-4a5486f302ee", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "SecurityEvents" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Security Events via Legacy Agent Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [DNS Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#dns)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "DNS", "label": "Status", "type": 1, "query": "DnsEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "2d8731f5-c225-4a39-9914-6391b2c89ecb", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DNS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "DNS Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Storage Accounts Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-storage-account)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4f291c03-8d98-47b6-ba82-1282322bb7a5", "version": "KqlParameterItem/1.0", "name": "StorageLogs", "label": "Status", "type": 1, "query": "StorageBlobLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6d9cd26b-3fcd-4556-b2eb-3dcb711c4de4", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureStorageAccount" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Storage Logs Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Common Event Format (CEF) Connector](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4fcf795c-75b8-4010-bd24-1d66511ff6e8", "version": "KqlParameterItem/1.0", "name": "CommonSecurityLog", "label": "Status", "type": 1, "query": "CommonSecurityLog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "452e02e1-b0c4-4b9b-8a54-bc9295db22b9", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Common Event Format (CEF) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Syslog Connector](https://docs.microsoft.com/azure/sentinel/connect-syslog)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "fa63a08f-dd08-4e11-bcb6-c075a6d6c15c", "version": "KqlParameterItem/1.0", "name": "Syslog", "label": "Status", "type": 1, "query": "Syslog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "021644a3-bd51-4b09-8117-017a89c71d58", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Syslog" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Syslog Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Amazon Web Services (AWS) Connector](https://docs.microsoft.com/azure/sentinel/connect-aws?tabs=s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "18ed59f0-c497-44b1-94b7-8700051cf189", "version": "KqlParameterItem/1.0", "name": "AWS", "label": "Status", "type": 1, "query": "AWSCloudTrail\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "393c465e-4398-428b-8da2-87ac07d8a987", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AWS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Amazon Web Services (AWS) S3 Connector](https://docs.microsoft.com/azure/sentinel/connect-aws?tabs=s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AWSS3", "label": "Status", "type": 1, "query": "AWSVPCFlow\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AwsS3" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) S3 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Google Cloud Platform IAM Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-cloud-platform-iam-via-codeless-connector-framework)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "GCP", "label": "Status", "type": 1, "query": "GCP_IAM_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "1f2ba663-dd7a-49b6-87ba-0b8adf6d2d34" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) S3 Connector - Copy", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 5", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Basic Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft 365 Defender Connector](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "M365Defender", "label": "Status", "type": 1, "query": "AlertEvidence\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft 365 Defender Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Endpoint Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-defender-for-endpoint)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MDE", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftDefenderAdvancedThreatProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft 365 Defender Connector - Copy", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureFirewall", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Windows Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "WindowsFirewall", "label": "Status", "type": 1, "query": "WindowsFirewall\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsFirewall" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Windows Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Web Application Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-web-application-firewall-waf)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureWAF", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceType in (\"APPLICATIONGATEWAYS\", \"FRONTDOORS\", \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"PROFILES\")\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WAF" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Web Application Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure SQL Databases Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-sql-databases)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "SQL", "label": "Status", "type": 1, "query": "AzureDiagnostics | where Category contains \"SQL\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "2d8731f5-c225-4a39-9914-6391b2c89ecb", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSql" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "SQL Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Key Vault Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-key-vault)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureKeyVault", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceProvider == \"MICROSOFT.KEYVAULT\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKeyVault" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Key Vault Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure DDoS Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-ddos-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "DDoS", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceType == \"PUBLICIPADDRESSES\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DDOS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure DDoS Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [VMware Carbon Black Cloud via AWS S3](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#vmware-carbon-black-cloud-via-aws-s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "VMwareCarbon", "label": "Status", "type": 1, "query": "CarbonBlack_Alerts_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "VMwareESXi" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "VMware ESXi Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Cloud: Continuous Export](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "SecurityRecommendation", "label": "Status", "type": 1, "query": "SecurityRecommendation\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Feature", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Continuous Export Connector", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 6", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Intermediate Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Purview Information Protection](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-purview-information-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MicrosoftPurviewInformationProtection", "type": 1, "query": "MicrosoftPurviewInformationProtection​​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Status", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureInformationProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Information Protection Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Dynamics 365 Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#dynamics365)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "Dynamics365Activity", "label": "Status", "type": 1, "query": "Dynamics365Activity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Dynamics365" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Dynamics 365 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Kubernetes Service (AKS) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-kubernetes-service-aks)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AKS", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"kube-audit\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKubernetes" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Kubernetes Service (AKS) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Qualys Vulnerability Management Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#qualys-vulnerability-management-via-codeless-connector-framework)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "Qualys", "label": "Status", "type": 1, "query": "QualysHostDetectionV3_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "QualysVulnerabilityManagement" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Qualys Vulnerability Management Connector", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Advanced Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Entity Behavior (UEBA)](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "BehaviorAnalytics", "label": "Status", "type": 1, "query": "BehaviorAnalytics​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Feature", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Entity Behavior (UEBA) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Entra ID Protection Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-entra-id-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AADIP", "label": "Status", "type": 1, "query": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\"​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActiveDirectoryIdentityProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Active Directory Identity Protection Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Threat Intelligence TAXII Connector](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence-taxii)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "TAXII", "label": "Status", "type": 1, "query": "ThreatIntelligenceIndicator | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") ​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligenceTaxii" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Threat Intelligence TAXII Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Threat Intelligence Platform Connector](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence-tip)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "ThreatIntelligence", "label": "Status", "type": 1, "query": "ThreatIntelligenceIndicator | where SourceSystem in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") ​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligence" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Threat Intelligence Platform Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for IoT Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-defender-for-iot)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MD4IOT", "label": "Status", "type": 1, "query": "SecurityAlert | where ProductName == \"Azure Security Center for IoT\"​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "IoT" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Defender for IoT Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Purview: Insider Risk Management Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-purview-information-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "IRM", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "OfficeIRM" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Purview: Insider Risk Management Connector", "styleSettings": { "showBorder": true } } ] }, "name": "group - 6" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isDCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Recommended Data Connectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Log Management](https://docs.microsoft.com/azure/sentinel/best-practices)\r\n---\r\n\r\nThis section focuses on collecting, storing, and analyzing telemetry, where the collection and storage are designed to facilitate data fusion and the security analysis aids in discovery and response to malicious activity. The Microsoft Sentinel Maturity Model for Event Log Management (M-21-31) Solution includes (4) hunting queries and (8) analytics rules for monitoring these components" }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "### Pricing\r\n[Ingestion](https://azure.microsoft.com/pricing/details/azure-sentinel/#pricing)
\r\n[Retention](https://azure.microsoft.com/pricing/details/monitor/#pricing)" }, "customWidth": "10", "name": "text - 10" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9375c625-e916-4f48-b072-352d6aeefddb", "version": "KqlParameterItem/1.0", "name": "Price", "label": "Ingestion Cost by GB", "type": 1, "description": "Enter Microsoft Sentinel Cost by GB (https://azure.microsoft.com/pricing/details/azure-sentinel/)", "isRequired": true, "value": "2.6" }, { "id": "fa35987d-0bb4-4612-9870-ea2c1da9dcbe", "version": "KqlParameterItem/1.0", "name": "RetentionPrice", "label": "Retention Cost by GB", "type": 1, "description": "Enter Log Analytics Cost by GB (https://azure.microsoft.com/pricing/details/monitor/). Note, every GB of data ingested into the workspace can be retained at no charge for the first 90 days", "isRequired": true, "value": "2.0" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "parameters - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 * \r\n| where TimeGenerated > startofday({TimeRange:start}) and TimeGenerated < startofday({TimeRange:end})\r\n| where _IsBillable == True\r\n| summarize TotalGB=round(sum(_BilledSize/(1024*1024*1024)),2)\r\n| extend IngestionCost=TotalGB*{Price}\r\n| project TotalGB, IngestionCost\r\n\r\n", "size": 4, "title": "Data Ingestion Cost", "noDataMessage": "No Results, Confirm Time Thresholds In Top of Workbook", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Data over 90 days", "formatter": 0, "numberFormat": { "unit": 36, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Retention Cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } } ] }, "tileSettings": { "leftContent": { "columnMatch": "TotalGB", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "rightContent": { "columnMatch": "IngestionCost", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency", "maximumFractionDigits": 2 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "query - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let M2131Mapping = datatable(DataTable:string, MaturityLevel:string)\r\n[\r\n\"SigninLogs\", \"Event Logging (EL0)\",\r\n\"AADManagedIdentitySignInLogs\", \"Event Logging (EL0)\",\r\n\"AADServicePrincipalSignInLogs\", \"Event Logging (EL0)\",\r\n\"StorageBlobLogs\", \"Event Logging (EL0)\",\r\n\"StorageFileLogs\", \"Event Logging (EL0)\",\r\n\"AzureMetrics\", \"Event Logging (EL0)\",\r\n\"AuditLogs\", \"Event Logging (EL0)\",\r\n\"IdentityInfo\", \"Event Logging (EL0)\",\r\n\"CommonSecurityLog\", \"Event Logging (EL0)\",\r\n\"ThreatIntelligenceIndicator\", \"Event Logging (EL0)\",\r\n\"DeviceNetworkInfo\", \"Event Logging (EL0)\",\r\n\"DnsEvents\", \"Event Logging (EL0)\",\r\n\"DeviceNetworkEvents\", \"Event Logging (EL0)\",\r\n\"AzureDiagnostics\", \"Event Logging (EL0)\",\r\n\"Usage\", \"Event Logging (EL0)\",\r\n\"SecurityIncident\", \"Event Logging (EL0)\",\r\n\"SecurityAlert\", \"Event Logging (EL0)\",\r\n\"AzureActivity\", \"Event Logging (EL0)\",\r\n\"Heartbeat\", \"Event Logging (EL0)\",\r\n\"OfficeActivity\", \"Event Logging (EL0)\",\r\n\"SecurityEvent\", \"Event Logging (EL0)\",\r\n\"Syslog\", \"Event Logging (EL0)\",\r\n\"AWSCloudTrail\", \"Event Logging (EL0)\",\r\n\"GWorkspaceActivityReports\", \"Event Logging (EL0)\",\r\n\"AWSGuardDuty\", \"Event Logging (EL0)\",\r\n\"AWSVPCFlow\", \"Event Logging (EL0)\",\r\n\"Perf\", \"Basic Event Logging (EL1)\",\r\n\"SentinelHealth\", \"Basic Event Logging (EL1)\",\r\n\"DeviceLogonEvents\", \"Basic Event Logging (EL1)\",\r\n\"DeviceEvents\", \"Basic Event Logging (EL1)\",\r\n\"DeviceNetworkEvents\", \"Basic Event Logging (EL1)\",\r\n\"DeviceFileEvents\", \"Basic Event Logging (EL1)\",\r\n\"DeviceRegistryEvents\", \"Basic Event Logging (EL1)\",\r\n\"DeviceProcessEvents\", \"Basic Event Logging (EL1)\",\r\n\"VMConnection\", \"Basic Event Logging (EL1)\",\r\n\"EmailEvents\", \"Basic Event Logging (EL1)\",\r\n\"ThreatIntelligenceIndicator\", \"Basic Event Logging (EL1)\",\r\n\"SecurityRecommendation\", \"Basic Event Logging (EL1)\",\r\n\"DeviceProcessEvents\", \"Basic Event Logging (EL1)\",\r\n\"ConfigurationData\", \"Basic Event Logging (EL1)\",\r\n\"ConfigurationChange\", \"Basic Event Logging (EL1)\",\r\n\"AzureDiagnostics\", \"Basic Event Logging (EL1)\",\r\n\"PS2DiagnosticLog\", \"Basic Event Logging (EL1)\",\r\n\"Event\", \"Basic Event Logging (EL1)\",\r\n\"SqlAtpStatus\", \"Basic Event Logging (EL1)\",\r\n\"ContainerInstanceLog_CL\", \"Basic Event Logging (EL1)\",\r\n\"ContainerEvent_CL\", \"Basic Event Logging (EL1)\",\r\n\"InsightsMetrics\", \"Intermediate Event Logging (EL2)\",\r\n\"EmailUrlInfo\", \"Intermediate Event Logging (EL2)\",\r\n\"EmailAttachmentInfo\", \"Intermediate Event Logging (EL2)\",\r\n\"InformationProtectionLogs_CL\", \"Intermediate Event Logging (EL2)\",\r\n\"CloudAppEvents\", \"Intermediate Event Logging (EL2)\",\r\n\"ContainerInventory\", \"Intermediate Event Logging (EL2)\",\r\n\"Update\", \"Advanced Event Logging (EL3)\",\r\n\"BehaviorAnalytics\", \"Advanced Event Logging (EL3)\",\r\n\"Anomalies\", \"Advanced Event Logging (EL3)\",\r\n\"SecurityRegulatoryCompliance\", \"Advanced Event Logging (EL3)\"\r\n];\r\nlet Retention = Usage\r\n| where TimeGenerated > ago(730d)\r\n| summarize arg_min(TimeGenerated, TenantId) by DataType\r\n| summarize count() by DataType, TimeGenerated\r\n| join kind=fullouter (M2131Mapping) on $left.DataType == $right.DataTable\r\n| project DataTable, MaturityLevel, TimeGenerated\r\n| summarize LogRetention_Days = datetime_diff('day', now(), min(TimeGenerated)) by DataTable, MaturityLevel;\r\nUsage\r\n| summarize Entries = count(), Size = sum(Quantity), last_log = datetime_diff(\"second\", now(), max(TimeGenerated)), estimate = sumif(_BilledSize, IsBillable==\"true\") by DataType, IsBillable\r\n| join kind=fullouter (M2131Mapping) on $left.DataType == $right.DataTable\r\n| join kind=fullouter (Retention) on DataTable\r\n| project RecommendedDataTable=DataTable, ExistingDataTable=DataType, MaturityLevel, ['Table Size'] = Size*1000000, ['Table Entries'] = Entries,\r\n ['Size per Entry'] = 1.0 * Size / Entries, IsBillable, ['Estimated Cost'] = Size*{Price}/1000, LogRetention_Days\r\n| order by ['Table Size'] desc \r\n| distinct RecommendedDataTable, ExistingDataTable, MaturityLevel, ['Table Size'], ['Table Entries'], IsBillable, ['Estimated Cost']\r\n| where RecommendedDataTable <> \"Usage\"\r\n| sort by ['Estimated Cost'] desc", "size": 0, "title": "Log Table Management", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let M2131Mapping = datatable(DataTable:string, MaturityLevel:string)\r\n[\r\n\"SigninLogs\",\"EL0\",\r\n\"AADManagedIdentitySignInLogs\",\"EL0\",\r\n\"AADServicePrincipalSignInLogs\",\"EL0\",\r\n\"StorageBlobLogs\",\"EL0\",\r\n\"StorageFileLogs\",\"EL0\",\r\n\"AzureMetrics\",\"EL0\",\r\n\"AuditLogs\",\"EL0\",\r\n\"IdentityInfo\",\"EL0\",\r\n\"CommonSecurityLog\",\"EL0\",\r\n\"ThreatIntelligenceIndicator\",\"EL0\",\r\n\"DeviceNetworkInfo\",\"EL0\",\r\n\"DnsEvents\",\"EL0\",\r\n\"DeviceNetworkEvents\",\"EL0\",\r\n\"AzureDiagnostics\",\"EL0\",\r\n\"Usage\",\"EL0\",\r\n\"SecurityIncident\",\"EL0\",\r\n\"SecurityAlert\",\"EL0\",\r\n\"AzureActivity\",\"EL0\",\r\n\"Heartbeat\",\"EL0\",\r\n\"OfficeActivity\",\"EL0\",\r\n\"SecurityEvent\",\"EL0\",\r\n\"Syslog\",\"EL0\",\r\n\"AWSCloudTrail\",\"EL0\",\r\n\"GWorkspaceActivityReports\",\"EL0\",\r\n\"AWSGuardDuty\",\"EL0\",\r\n\"AWSVPCFlow\",\"EL0\",\r\n\"Perf\",\"EL1\",\r\n\"SentinelHealth\",\"EL1\",\r\n\"DeviceLogonEvents\",\"EL1\",\r\n\"DeviceEvents\",\"EL1\",\r\n\"DeviceNetworkEvents\",\"EL1\",\r\n\"DeviceFileEvents\",\"EL1\",\r\n\"DeviceRegistryEvents\",\"EL1\",\r\n\"DeviceProcessEvents\",\"EL1\",\r\n\"VMConnection\",\"EL1\",\r\n\"EmailEvents\",\"EL1\",\r\n\"ThreatIntelligenceIndicator\",\"EL1\",\r\n\"SecurityRecommendation\",\"EL1\",\r\n\"DeviceProcessEvents\",\"EL1\",\r\n\"ConfigurationData\",\"EL1\",\r\n\"ConfigurationChange\",\"EL1\",\r\n\"PS2DiagnosticLog\",\"EL1\",\r\n\"Event\",\"EL1\",\r\n\"SqlAtpStatus\",\"EL1\",\r\n\"ContainerInstanceLog_CL\",\"EL1\",\r\n\"ContainerEvent_CL\",\"EL1\",\r\n\"InsightsMetrics\",\"EL2\",\r\n\"EmailUrlInfo\",\"EL2\",\r\n\"EmailAttachmentInfo\",\"EL2\",\r\n\"InformationProtectionLogs_CL\",\"EL2\",\r\n\"CloudAppEvents\",\"EL2\",\r\n\"ContainerInventory\",\"EL2\",\r\n\"Update\",\"EL3\",\r\n\"BehaviorAnalytics\",\"EL3\",\r\n\"Anomalies\",\"EL3\",\r\n\"SecurityRegulatoryCompliance\",\"EL3\"\r\n];\r\nunion withsource=_TableName *\r\n| where TimeGenerated > ago(90d)\r\n| where _TableName !contains \"RST\" and _TableName !contains \"SRCH\"\r\n| summarize LastLog_Time = max(TimeGenerated) by _TableName\r\n| extend Last_Log_Received = datetime_diff(\"second\", now(), LastLog_Time)\r\n| join kind=leftouter M2131Mapping on $left._TableName == $right.DataTable\r\n| project DataTable = _TableName, MaturityLevel, ['Last Log Received'] = Last_Log_Received, LastLog_Time\r\n| order by ['Last Log Received'] desc\r\n", "size": 0, "showAnalytics": true, "title": "Last Datatable Log Received", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "DataTable", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "MaturityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "EL0", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL1", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL2", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL3", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "Default", "representation": "Ellipsis", "text": "{0}{1}" } ] } }, { "columnMatch": "Last Log Received", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "maximumFractionDigits": 0 } } }, { "columnMatch": "Last Record Received", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastHeartbeatTime = Heartbeat\r\n| summarize LastHeartbeat_Time = arg_max(TimeGenerated, *) by ResourceId = tolower(ResourceId);\r\nHeartbeat\r\n| where TimeGenerated > ago(365d)\r\n| summarize LastHeartbeat = datetime_diff(\"second\",now(), max(TimeGenerated)) by ResourceId = tolower(ResourceId)\r\n| where ResourceId <> \"\"\r\n| where ResourceId <> \"None\"\r\n| join kind=inner (LastHeartbeatTime) on ResourceId\r\n| project ResourceId, LastHeartbeat, LastHeartbeat_Time\r\n| sort by LastHeartbeat desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Last Asset Log Received", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "LastHeartbeat", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 24, "options": { "style": "decimal", "maximumFractionDigits": 0 } } }, { "columnMatch": "Computer", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "OSType", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Windows", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Linux", "representation": "red", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "mac", "representation": "magenta", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "trenddown", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "maxWidth": "50" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let M2131Mapping = datatable(DataTable:string, MaturityLevel:string)\r\n[\r\n\"SigninLogs\",\"EL0\",\r\n\"AADManagedIdentitySignInLogs\",\"EL0\",\r\n\"AADServicePrincipalSignInLogs\",\"EL0\",\r\n\"StorageBlobLogs\",\"EL0\",\r\n\"StorageFileLogs\",\"EL0\",\r\n\"AzureMetrics\",\"EL0\",\r\n\"AuditLogs\",\"EL0\",\r\n\"IdentityInfo\",\"EL0\",\r\n\"CommonSecurityLog\",\"EL0\",\r\n\"ThreatIntelligenceIndicator\",\"EL0\",\r\n\"DeviceNetworkInfo\",\"EL0\",\r\n\"DnsEvents\",\"EL0\",\r\n\"DeviceNetworkEvents\",\"EL0\",\r\n\"AzureDiagnostics\",\"EL0\",\r\n\"Usage\",\"EL0\",\r\n\"SecurityIncident\",\"EL0\",\r\n\"SecurityAlert\",\"EL0\",\r\n\"AzureActivity\",\"EL0\",\r\n\"Heartbeat\",\"EL0\",\r\n\"OfficeActivity\",\"EL0\",\r\n\"SecurityEvent\",\"EL0\",\r\n\"Syslog\",\"EL0\",\r\n\"AWSCloudTrail\",\"EL0\",\r\n\"GWorkspaceActivityReports\",\"EL0\",\r\n\"AWSGuardDuty\",\"EL0\",\r\n\"AWSVPCFlow\",\"EL0\",\r\n\"Perf\",\"EL1\",\r\n\"SentinelHealth\",\"EL1\",\r\n\"DeviceLogonEvents\",\"EL1\",\r\n\"DeviceEvents\",\"EL1\",\r\n\"DeviceNetworkEvents\",\"EL1\",\r\n\"DeviceFileEvents\",\"EL1\",\r\n\"DeviceRegistryEvents\",\"EL1\",\r\n\"DeviceProcessEvents\",\"EL1\",\r\n\"VMConnection\",\"EL1\",\r\n\"EmailEvents\",\"EL1\",\r\n\"ThreatIntelligenceIndicator\",\"EL1\",\r\n\"SecurityRecommendation\",\"EL1\",\r\n\"DeviceProcessEvents\",\"EL1\",\r\n\"ConfigurationData\",\"EL1\",\r\n\"ConfigurationChange\",\"EL1\",\r\n\"PS2DiagnosticLog\",\"EL1\",\r\n\"Event\",\"EL1\",\r\n\"SqlAtpStatus\",\"EL1\",\r\n\"ContainerInstanceLog_CL\",\"EL1\",\r\n\"ContainerEvent_CL\",\"EL1\",\r\n\"InsightsMetrics\",\"EL2\",\r\n\"EmailUrlInfo\",\"EL2\",\r\n\"EmailAttachmentInfo\",\"EL2\",\r\n\"InformationProtectionLogs_CL\",\"EL2\",\r\n\"CloudAppEvents\",\"EL2\",\r\n\"ContainerInventory\",\"EL2\",\r\n\"Update\",\"EL3\",\r\n\"BehaviorAnalytics\",\"EL3\",\r\n\"Anomalies\",\"EL3\",\r\n\"SecurityRegulatoryCompliance\",\"EL3\"\r\n];\r\nunion withsource=_TableName *\r\n| summarize count_ = count(), Size = sum(_BilledSize) by bin(_TimeReceived,1m), Type, _IsBillable\r\n| extend counttemp = count_ / 60\r\n| summarize ['Current EPS Average']=avg(counttemp), ['Minimum EPS']=min(counttemp), ['Maximum EPS']=max(counttemp) by DataTable=Type\r\n| join kind=fullouter M2131Mapping on DataTable\r\n| project-away DataTable1\r\n| order by ['Current EPS Average'] desc\r\n| project DataTable, MaturityLevel, ['Minimum EPS'], ['Current EPS Average'], ['Maximum EPS']\r\n", "size": 0, "showAnalytics": true, "title": "Events Per Second (EPS) Management", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "DataTable", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "MaturityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "EL0", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL1", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL2", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "EL3", "representation": "Sev3", "text": "{0}{1}" }, { "operator": "Default", "representation": "Ellipsis", "text": "{0}{1}" } ] } }, { "columnMatch": "Minimum EPS", "formatter": 4, "formatOptions": { "palette": "blue", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Minimum EPS", "color": "blueDark" }, { "columnName": "Current EPS Average", "color": "green" }, { "columnName": "Maximum EPS", "color": "redBright" } ] } }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "Current EPS Average", "formatter": 4, "formatOptions": { "palette": "green" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } }, { "columnMatch": "Maximum EPS", "formatter": 4, "formatOptions": { "palette": "redBright" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "Table Size", "formatter": 8, "formatOptions": { "palette": "purple" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Table Entries", "formatter": 8, "formatOptions": { "palette": "turquoise" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Size per Entry", "formatter": 8, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "IsBillable", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "representation": "Important", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "DataType", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "50", "name": "query - 5" } ] }, "name": "group - 10" } ] }, "conditionalVisibility": { "parameterName": "isLMVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Log Management" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Log Retention](https://docs.microsoft.com/azure/azure-monitor/logs/data-retention-archive)\r\n---\r\n\r\nThis section provides an overview of current hot path, cold path, and retention settings. Respective resources are provided in order to establish respective log retention architectures. " }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 11" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "b1cd1f8a-e807-4deb-93f4-7812e5ed014a", "linkTarget": "OpenBlade", "linkLabel": "Adjust Data Table Retention Settings >>", "style": "secondary", "bladeOpenContext": { "bladeName": "TablesBlade", "extensionName": "Microsoft_OperationsManagementSuite_Workspace", "bladeParameters": [ { "name": "workspaceResourceId", "source": "parameter", "value": "Workspace" } ] } }, { "id": "7abca959-d385-4dd0-b27d-2b822a9b37b7", "cellValue": "https://securityinsights.hosting.portal.azure.net/securityinsights/Content/Workbooks/ArchivingBasicLogsRetention.json", "linkTarget": "WorkbookTemplate", "linkLabel": "Open Archiving, & Log Retention Workbook >>", "subTarget": "ABLR", "style": "secondary", "linkIsContextBlade": true } ] }, "customWidth": "50", "name": "EL0" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isREVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Log Retention" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Log Event Management (EL0)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n---\r\nLogging requirements of highest criticality are either not met or are only partially met. The agency or one or more of its components have not implemented the following \r\nrequirement. Ensuring that the Required Logs categorized as Criticality Level 0 are retained in acceptable formats for specified time-frames. Aligned to technical details described in Appendix C (Logging Requirements – Technical Details)." }, "customWidth": "40", "name": "EL0 Guide", "styleSettings": { "maxWidth": "40" } }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Identity & Credential Management\\\", \\\"tab\\\": \\\"EL0_1_\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Privileged Identity & Credential Management\\\", \\\"tab\\\": \\\"EL0_2\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"IP & Domain Reputation\\\", \\\"tab\\\": \\\"EL0_3\\\" },\\t\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"DHCP Lease Information\\\", \\\"tab\\\": \\\"EL0_4\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"DNS\\\", \\\"tab\\\": \\\"EL0_5\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Passive DNS Log\\\", \\\"tab\\\": \\\"EL0_6\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"DNS, DHCP, & Wi-Fi\\\", \\\"tab\\\": \\\"EL0_7\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"IDS / IPS / NTA / NDR / SIEM\\\", \\\"tab\\\": \\\"EL0_8\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Router & Switches\\\", \\\"tab\\\": \\\"EL0_9\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Load Balancer / Reverse Proxy\\\", \\\"tab\\\": \\\"EL01_20\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3e52e2ce-1cc0-4d53-8a56-387d60f4c7ac", "version": "KqlParameterItem/1.0", "name": "isEL0_1_Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_1_", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isEL0_2Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_2", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "1b383e8d-4f89-4817-9f32-7a4fb4da7a84" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_3Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_3", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "dafbf637-c990-405c-96c4-ff5de6ebfbe5" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_4Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_4", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "b5c050e2-dfd1-4c0d-a689-5c175296212f" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_5Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_5", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "5b80f462-2650-4cb6-80bd-99960a6a8673" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_6Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_6", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "65c358fb-ba71-4384-b61b-c3310c35b421" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_7Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_7", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "409343cc-d2a9-4519-bab4-c32d4e17a2ab" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_8Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_8", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "5175c695-3523-4c56-a0b1-45660a491d5e" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_9Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_9", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "7fd7d64c-08ea-4d67-96a4-84f3ed248eb9" }, { "id": "678d8c2b-4d9c-430d-87d6-48fb08d4f1c8", "version": "KqlParameterItem/1.0", "name": "isEL01_20Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL01_20", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Proxies & Web Content Filters\\\", \\\"tab\\\": \\\"EL0_11\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Access, Authorization, & Accounting\\\", \\\"tab\\\": \\\"EL0_12\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Operating System Logging (Windows)\\\", \\\"tab\\\": \\\"EL0_13\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Operating System Logging (Mac OS)\\\", \\\"tab\\\": \\\"EL0_14\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Operating System Logging (Linux)\\\", \\\"tab\\\": \\\"EL0_15\\\" },\\t\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Cloud Environments (General Logging)\\\", \\\"tab\\\": \\\"EL0_16\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Cloud AWS\\\", \\\"tab\\\": \\\"EL0_17\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Cloud Azure\\\", \\\"tab\\\": \\\"EL0_18\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Cloud GCP\\\", \\\"tab\\\": \\\"EL0_19\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers - Copy", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "isEL0_10Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_10", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "78ed01a9-e093-4a9c-8329-f6f327679bdf" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_11Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_11", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "3194b0b9-682b-4d10-9f90-0f0a4759f2a2" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_12Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_12", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "13b77e95-3ea9-438c-a6ad-271c038ce4fe" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_13Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_13", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "82af4030-3a8e-4dff-a0cd-b19d87d0031c" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_14Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_14", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "0e3afed6-6f8f-46e3-ac0a-a02c381e2b01" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_15Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_15", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "7b964828-c0e2-4442-9a61-607e5a5a6f8d" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_16Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_16", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "6af13af9-3eda-424c-b3df-03598d625aee" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_17Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_17", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "d718e183-c1d8-4a85-a9e3-687636280003" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_18Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_18", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "e714ce9e-651b-4b23-8c9a-0c7f69792515" }, { "version": "KqlParameterItem/1.0", "name": "isEL0_19Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL0_19", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "b76fc0c9-3ca9-47cf-af0b-db6d68494b15" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters" }, { "type": 1, "content": { "json": "" }, "name": "text - 25" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Identity & Credential Management](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) 🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### References\r\n\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [Audit Microsoft Sentinel queries and activities](https://docs.microsoft.com/azure/sentinel/audit-sentinel-data)
\r\n💡 [IdentityInfo table](https://docs.microsoft.com/azure/sentinel/ueba-enrichments#identityinfo-table-public-preview)
\r\n\r\n### Microsoft Portals
\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "94af2358-8b87-44b2-ad87-c84568ab2efd", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "19aa07ff-e996-47a7-99f1-b4a6e6ebe5ee", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "customWidth": "50", "name": "links - 2" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Identity & Credential Management | Identity & Credential Management • Account Creation • Manage Credential Type o (PIV or CAC) and Derived Credentials o Cert o MFA o Password • Establish/Manage Attributes o Organization o Groups/Roles • Manage/Track Changes in Attributes & Credentials • Track Usage of Credentials • Account Deletion | Log, Script | 0 | 12 Months Active Storage, 18 Months Cold Storage | 13 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_1", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_1", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_1", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_1}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserType, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| join (IdentityInfo | extend UserPrincipalName = MailAddress| summarize arg_max(TimeGenerated, *) by UserPrincipalName) on UserPrincipalName\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, Tags, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", "size": 0, "title": "Sign In Logs (Microsoft Entra ID)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Category == \"UserManagement\" or Category == \"EntitlementManagement\" or Category == \"GroupManagement\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Audit Logs > User/Group/Entitlement Management (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserType, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| join (IdentityInfo | extend UserPrincipalName = MailAddress| summarize arg_max(TimeGenerated, *) by UserPrincipalName) on UserPrincipalName\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, AssignedRoles, GroupMemberships, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", "size": 0, "title": "User Privileges (Microsoft Entra ID)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_1_Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Identity & Credential Management", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Privileged Identity & Credential Management](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) 🔷 [AADServicePrincipalSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs) 🔷 [AADManagedIdentitySignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadmanagedidentitysigninlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### References\r\n💡 [Start using Privileged Identity Management](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started)
\r\n💡 [IdentityInfo table](https://docs.microsoft.com/azure/sentinel/ueba-enrichments#identityinfo-table-public-preview)
\r\n\r\n### Microsoft Portals
\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "94af2358-8b87-44b2-ad87-c84568ab2efd", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "96478970-c293-4239-8e14-e4745c3fb391", "linkTarget": "OpenBlade", "linkLabel": "Privileged Identity Management", "style": "secondary", "bladeOpenContext": { "bladeName": "CommonMenuBlade", "extensionName": "Microsoft_Azure_PIMCommon" } } ] }, "name": "links - 2" } ] }, "customWidth": "50", "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Privileged Identity & Credential Management | Privileged Identity & Credential Management • Provisioning • Manage Credential Type o (PIV or CAC) and Derived Credentials o Cert o MFA o Password • Establish/Manage Attributes o Organization o Groups/Roles • Manage/Track Changes in Attributes & Credentials • Track Usage of Credentials • Deprovisioning • Establish and Manage Privileges (Privilege Credentials) • Isolate, Monitor, Record, Audit Privilege Sessions • Control Privileged Actions o Commands o Tasks • Track Privilege Escalation and Delegation • Monitor, Alert and Respond to Anomalous Behaviors/Activities| Log, Script | 0 | 12 Months Active Storage, 18 Months Cold Storage | 13 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_2", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_2", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_2", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_2}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "AuditLogs > Privileged Identity Management", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| where GroupMembership contains \"admin\" or GroupMembership contains \"contributor\" or AssignedRoles contains \"admin\" or AssignedRoles contains \"contributor\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "IdentityInfo > Privileged Roles/Groups (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AADServicePrincipalSignInLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Service Principal Logs (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AADManagedIdentitySignInLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Managed Identity Logs (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_2Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Privileged Identity & Credential Management", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IP & Domain Reputation](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft 365 Defender](https://www.microsoft.com/security/business/siem-and-xdr/microsoft-365-defender)
\r\n🔷 [ThreatIntelligenceIndicator](https://docs.microsoft.com/azure/azure-monitor/reference/tables/threatintelligenceindicator) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Understand threat intelligence in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "d9409a29-7a27-4540-98f5-55187993b18f", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } }, { "id": "dd5aa652-e2c6-4478-aa22-2e4b7cd754a3", "linkTarget": "OpenBlade", "linkLabel": "Threat Intelligence", "style": "secondary", "bladeOpenContext": { "bladeName": "ThreatIntelligenceBlade", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "parameter", "value": "Subscription" }, { "name": "resourceGroup", "source": "parameter", "value": "DefaultSubscription_Internal" }, { "name": "workspaceName", "source": "parameter", "value": "Workspace" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Email Filtering, Spam, & Phishing | IP & Domain Reputation (As Indicated by Mail Server Connection) | Log | 0 | 12 Months Active Storage, 18 Months Cold Storage | 14 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_3", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_3", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_3", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_3}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| sort by TimeGenerated\r\n| limit 250", "size": 0, "title": "EmailEvents (Microsoft 365 Defender)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ThreatIntelligenceIndicator \r\n| extend Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, EmailSourceIpAddress, EmailSenderAddress, DomainName)\r\n| sort by TimeGenerated\r\n| limit 250", "size": 0, "title": "ThreatIntelligenceIndicator > IP/Domain Reputation (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_3Visible", "comparison": "isEqualTo", "value": "true" }, "name": "IP & Domain Reputation", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [DHCP Lease Information](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [DeviceNetworkInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicenetworkinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Endpoint]( https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### References\r\n💡 [Microsoft Sentinel DHCP normalization schema reference](https://docs.microsoft.com/azure/sentinel/dhcp-normalization-schema)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "d9409a29-7a27-4540-98f5-55187993b18f", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (For Devices with Multiple Interfaces: Interface MAC - If Correlated to the De-NAT IP Address) | All Devices • DHCP Lease Information Including: o MAC o IP | Log | 0 | 12 Months Active Storage, 18 Months Cold Storage | 14 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_4", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_4", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_4", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_4}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceNetworkInfo \r\n| summarize FirstObserved=arg_min(TimeGenerated, IPv4Dhcp, IPAddresses, MacAddress, MachineGroup, DnsAddresses) by DeviceName\r\n| sort by FirstObserved desc\r\n| limit 250", "size": 0, "title": "DeviceNetworkInfo > DHCP: Lease, IP, MAC (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_4Visible", "comparison": "isEqualTo", "value": "true" }, "name": "DHCP Lease Information", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [DNS](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [DnsEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/dnsevents) ✳️ [Azure DNS]( https://azure.microsoft.com/services/dns/)
\r\n🔷 [_Im_Dns](https://docs.microsoft.com/azure/sentinel/dns-normalization-schema)
\r\n\r\n### References\r\n💡 [Gather insights about your DNS infrastructure with the DNS Analytics Preview solution](https://docs.microsoft.com/azure/azure-monitor/insights/dns-analytics)
\r\n💡 [Microsoft Sentinel DNS normalization schema reference](https://docs.microsoft.com/azure/sentinel/dns-normalization-schema#parsers)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "e71b1aae-f7b4-4338-b57e-c4a8d4d656fe", "linkTarget": "OpenBlade", "linkLabel": "Azure DNS", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DNS" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure | DNS - Source IP and Port, Destination IP and Port Date and Time • Content of Query, Response, and Errors – All Record Types • Zone Transfers Request and Response (Audit Log) • Zone Transfers Request and Response (Content) | Log | 0 | 12 Months Active Storage, 18 Months Cold Storage | 14 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_5", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_5", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_5", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_5}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DnsEvents\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "DnsEvents (Azure DNS)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_Dns\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed = pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)\r\n", "size": 0, "title": "_Im_Dns (DNS Logs)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_5Visible", "comparison": "isEqualTo", "value": "true" }, "name": "DNS", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Passive DNS Log](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [DnsEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/dnsevents) ✳️ [Azure DNS]( https://azure.microsoft.com/services/dns/)
\r\n🔷 [DeviceNetworkEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicenetworkevents) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Endpoint]( https://www.microsoft.com/microsoft-365/security/endpoint-defender)\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Gather insights about your DNS infrastructure with the DNS Analytics Preview solution](https://docs.microsoft.com/azure/azure-monitor/insights/dns-analytics)
\r\n💡 [Microsoft Sentinel RiskIQ Solution: Passive DNS Playbooks](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/RiskIQ/Playbooks/RiskIQ-Data-PassiveDns)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "02c1c842-2c9b-4b5a-a75b-29948c8dd7b9", "linkTarget": "OpenBlade", "linkLabel": "Azure DNS", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DNS" } ] } }, { "id": "d7d78183-4925-4935-949c-079c894356af", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure | Passive DNS Log • Tuple (Rrname, Rrtype, Rdata) • Time_First • Time_Last • Count • Bailiwick • Sensor_Id • Zone_Time_First • Zone_Time_Last • Time_First_Ms • Time_Last_Ms • Origin • Count of Questions Asked by Source IP • Count of Questions Asked Overall •Count of Responses by Source IP • Query Size in Bytes • Response Size in Bytes • TTL per Record Returned • Request Was Made Via UDP, TCP or Both • Response Was Made Via UDP, TCP or Both • Passive DNS Source (Used to Identify Which Passive DNS Source Data Came From) | Log, Database Record | 0 | 12 Months Active Storage, 18 Months Cold Storage | 15 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_6", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_6", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_6", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_6}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceNetworkEvents\r\n| where RemotePort == \"53\"\r\n| extend Computer = toupper(DeviceName)\r\n| join kind=innerunique(DnsEvents | extend Computer = toupper(Computer)) on Computer\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "DeviceNetworkEvents + DnsEvents (Passive DNS Logs)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_6Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Passive DNS Log", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [DNS, DHCP, & Wi-Fi](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [CommonSecurityLog](https://docs.microsoft.com/azure/azure-monitor/reference/tables/commonsecuritylog)\r\n✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [Get CEF-formatted logs from your device or appliance into Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "2189ca0b-d9df-4b9a-b72b-175c02183a63", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "566963a4-73c9-4aeb-9a03-7bf48d0f1978", "linkTarget": "OpenBlade", "linkLabel": "CEF Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure | DNS, DHCP, and Wi-Fi • Wi-Fi Supporting Infrastructure Logs Including Security Logs at Info Level • Device Authentication Logs with User Agent • URL Browsing Logs + HTTP Methods (e.g., Post, Get, etc.) • User Authentication Logs • DHCP Lease Information Including MAC, IP • Timestamps • Static Network Address Translation Table Mapping as Well as Port Forwards o Date and Time o Protocol o Port o Inside Local and Global IP and Port o Outside Local and Global IP and Port| Log, Database Record, Script, File, Config, SNMP | 0 | 12 Months Active Storage, 18 Months Cold Storage | 15-16 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_7", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_7", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_7", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_7}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project DeviceProduct, DeviceVendor, TenantId, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, AdditionalExtensions, DeviceAction, ApplicationProtocol, SourceTranslatedPort, SourcePort, SourceIP, SourceUserID, SourceUserName, SourceUserPrivileges, DestinationServiceName, DestinationTranslatedAddress, DestinationTranslatedPort, CommunicationDirection, DeviceDnsDomain, DeviceExternalID, DeviceInboundInterface, DeviceOutboundInterface, DestinationHostName, DestinationIP, DestinationPort, FileType, ReceivedBytes, Message, SentBytes, Protocol, RequestURL, RequestClientApplication, RequestContext, RequestMethod, ReceiptTime, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Common Event Format (CommonSecurityLog)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_7Visible", "comparison": "isEqualTo", "value": "true" }, "name": "DNS, DHCP, & Wi-Fi", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IDS / IPS / NTA / NDR / SIEM](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/)
\r\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) 🔷 [InsightsMetrics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/insightsmetrics)✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n 🔷 [_Im_NetworkSession](https://docs.microsoft.com/azure/ ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [DnsEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/dnsevents) ✳️ [Azure DNS]( https://azure.microsoft.com/services/dns/) \r\n\r\n### References\r\n💡 [Azure Firewall IDS/IPS](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n💡 [Microsoft Sentinel Authentication normalization schema reference](https://docs.microsoft.com/Azure/sentinel/authentication-normalization-schema)
\r\n💡 [Microsoft Sentinel Network Session normalization schema reference](https://docs.microsoft.com/azure/sentinel/network-normalization-schema)
\r\n💡 [Microsoft Sentinel Process Event normalization schema reference](https://docs.microsoft.com/azure/sentinel/process-events-normalization-schema)
\r\n\r\n### Microsoft Portals" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "2ddac5be-50ed-4226-b816-7efa4c9470e3", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall (IPS)", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } }, { "id": "5e85bbc6-8913-4ba0-921a-6104d48fa457", "linkTarget": "OpenBlade", "linkLabel": "Azure WAF", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WAF" } ] } }, { "id": "828cfae4-0d79-42a5-85f8-63e34ecc7b87", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } }, { "id": "8b50fc1f-701f-4dcd-9641-751557118555", "linkTarget": "OpenBlade", "linkLabel": "Azure Information Protection", "style": "secondary", "bladeOpenContext": { "bladeName": "DataClassGroupEditBlade", "extensionName": "Microsoft_Azure_InformationProtection" } }, { "id": "dcc965dc-1e06-4083-8e2c-fc12548fe742", "linkTarget": "OpenBlade", "linkLabel": "Network Security Groups", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureNSG" } ] } }, { "id": "51fb6648-f407-4035-9a2b-fb684cf20df8", "linkTarget": "OpenBlade", "linkLabel": "Network Watcher", "style": "secondary", "bladeOpenContext": { "bladeName": "NetworkWatcherMenuBlade", "extensionName": "Microsoft_Azure_Network" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure: General Logging | • IDS / IPS / NTA / NDR / SIEM Logs • API Activity Logs • Authentication Logs • Firewall Logs • Web Proxy/WAF Logs • Service Metrics • Network Flow Logs • Remote Access/VPN Logs • System/OS Logs • DLP Logs • DNS Query/Response Logs | Log, File, Packet Capture | 0 | 12 Months Active Storage, 18 Months Cold Storage | 16 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_8", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_8", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_8", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_8}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallIDSLog\"\r\n| parse msg_s with * \"TCP request from \" Source \" to \" Destination \". Action: \" ActionTaken \". Rule: \" IDPSSig \". IDS: \" IDSMessage \". Priority: \" Priority \". Classification: \" Classification\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OperationName\r\n| render areachart ", "size": 0, "title": "IDS / IPS Alerts over Time (Azure Firewall)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "XDR (NDR + EDR) Security Incidents (Microsoft Sentinel + Microsoft 365 Defender)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "0dccc31b-b795-4508-afd1-cb9a3d858a15", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE ATT&CK® Coverage >>", "style": "secondary" } ] }, "name": "links - 1" } ] }, "name": "group - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FakeData = (datatable (Message: string, ruleName_s: string, clientIp_s: string, clientIP_s: string, action_s: string, transactionId_s: string, trackingReference_s: string) [\"\", \"\", \"\", \"\", \"\", \"\", \"\"]);\r\nFakeData\r\n| union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"Application Gateway\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"Application Gateway\" contains \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"Application Gateway\" contains \"azure front door\") or (ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"Application Gateway\" contains \"cdn\")) and (\"SOC-NS-AG-WAFV2 - 1129440\" == \"All\" or Resource in ('SOC-NS-AG-WAFV2'))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '*' == Action or '*' == \"*\" \r\n| where '*' == requestUri_s or '*' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule contains \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \", 1), \"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule contains \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule, \"):\", 1)), \"\"), Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc", "size": 0, "showAnalytics": true, "title": "Web Application Firewall (Azure WAF)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Rule", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "redDark" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "_Im_NetworkSession (Flow Logs)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"network\"\r\n| project id,type,location,resourceGroup\r\n", "size": 0, "showAnalytics": true, "title": "VPNs & Network Infrastructure (Azure Resource Graph)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InformationProtectionLogs_CL\r\n| sort by TimeGenerated \r\n| limit 250", "size": 0, "title": "Data Loss Prevention Logs (Microsoft Information Protection)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DnsEvents\r\n| sort by TimeGenerated \r\n| limit 250", "size": 0, "title": "DNS Events (Azure DNS / Azure Monitor)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_8Visible", "comparison": "isEqualTo", "value": "true" }, "name": "IDS / IPS / NTA / NDR / SIEM", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Router & Switches](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### References\r\n💡 [Azure Activity log](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log)
\r\n💡 [Azure resource logs](https://docs.microsoft.com/azure/azure-monitor/essentials/resource-logs)
\r\n💡 [Hybrid Security Monitoring using Microsoft Defender for Cloud and Microsoft Sentinel](https://docs.microsoft.com/azure/architecture/hybrid/hybrid-security-monitoring)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "01b8b115-fe69-4297-959b-4de4eae9cadf", "linkTarget": "OpenBlade", "linkLabel": "Network Security Groups", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureNSG" } ] } }, { "id": "84c66316-804f-42c9-8bea-32726c2623e6", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "d968bdd0-ec6f-457a-b1aa-32a8fa6a45d9", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (For Devices with Multiple Inferfaces: Interface MAC - If Correlated to the Device NAT IP Address) | Routers and Switches • Routing Tables • Routing Changes (Logging All CLI Commands, BGP) • IP Addressing Schema and Implementation | Script, File, Config | 0 | 12 Months Active Storage, 18 Months Cold Storage | 16 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_9", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_9", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_9", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_9}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type contains \"virtualNetworks\"\r\n| extend RG = substring(id, 0, indexof(id, '/providers'))\r\n| extend VNETAddressRange = properties.addressSpace.addressPrefixes\r\n| extend subnets = properties.subnets\r\n| mvexpand bagexpansion=array subnets\r\n| extend SubnetName = tostring(subnets.name)\r\n| extend SubnetAddress = tostring(subnets.properties.addressPrefix)\r\n| extend ServiceEndpoints = subnets.properties.serviceEndpoints.[0]\r\n| extend SubnetIPConfigid = subnets.properties.ipConfigurations.[0].id\r\n| extend VNETPeerings = properties.virtualNetworkPeerings.[0]\r\n| extend VNETPeeringName = VNETPeerings.name\r\n| extend VNETPeerAddress = VNETPeerings.properties.remoteAddressSpace.addressPrefixes\r\n| extend VNETPeerRemoteVNETid = VNETPeerings.properties.remoteVirtualNetwork.id\r\n| extend VNETPeeringState = VNETPeerings.properties.peeringState\r\n| extend AllowVirtualNetworkAccess = VNETPeerings.properties.allowVirtualNetworkAccess\r\n| extend AllowForwardedTraffic = VNETPeerings.properties.allowForwardedTraffic\r\n| extend AllowGatewayTransit = VNETPeerings.properties.allowGatewayTransit\r\n| project-away kind, managedBy, sku, plan, identity, zones, extendedLocation, properties, subnets, VNETPeerings, tenantId, name, tags, resourceGroup", "size": 0, "showAnalytics": true, "title": "Virtual Networks, Subnets and Peerings", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "type", "formatter": 16, "formatOptions": { "showIcon": true } }, { "columnMatch": "location", "formatter": 17 }, { "columnMatch": "subscriptionId", "formatter": 15, "formatOptions": { "showIcon": true, "linkTarget": "Resource" } }, { "columnMatch": "DDoSProtectionEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "false", "representation": "3" }, { "operator": "==", "thresholdValue": "true", "representation": "success" }, { "operator": "Default", "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "SubnetIPConfigid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } } ], "filter": true } }, "name": "VNetDetails" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type == \"microsoft.network/routetables\"\r\n| extend RG = substring(id, 0, indexof(id, '/providers'))\r\n| extend SubnetArray = properties.subnets\r\n| mvexpand bagexpansion=array SubnetArray\r\n| extend Subnetid = SubnetArray.id\r\n| extend DisableBGPRoutePropagation = tostring(properties.disableBgpRoutePropagation)\r\n| extend RouteArray = properties.routes\r\n| mvexpand bagexpansion=array RouteArray\r\n| extend RouteName = tostring(RouteArray.name)\r\n| extend Routeid = RouteArray.id\r\n| extend RouteAddressPrefix = tostring(RouteArray.properties.addressPrefix)\r\n| extend RouteHasBGPOverride = tostring(RouteArray.properties.hasBgpOverride)\r\n| extend RouteNextHopType = tostring(RouteArray.properties.nextHopType)\r\n| project-away kind, managedBy, sku, plan, properties, identity, zones, extendedLocation, SubnetArray, RouteArray, name, tenantId, tags, resourceGroup\r\n", "size": 0, "showAnalytics": true, "title": "Route Tables & BGP", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "type", "formatter": 16, "formatOptions": { "showIcon": true } }, { "columnMatch": "location", "formatter": 17 }, { "columnMatch": "subscriptionId", "formatter": 15, "formatOptions": { "showIcon": true, "linkTarget": "Resource" } }, { "columnMatch": "Subnetid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true, "templateRunContext": { "componentIdSource": "parameter", "templateUriSource": "static", "titleSource": "static", "descriptionSource": "static", "description": "", "runLabelSource": "static" } } }, { "columnMatch": "Routeid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } } ], "filter": true, "labelSettings": [ { "columnId": "id", "label": "Name" }, { "columnId": "type", "label": "Type" }, { "columnId": "location", "label": "Region" }, { "columnId": "subscriptionId", "label": "Subscription" }, { "columnId": "RG", "label": "Resource Group" }, { "columnId": "Subnetid", "label": "Subnet Id" }, { "columnId": "RouteName", "label": "Route Name" }, { "columnId": "Routeid", "label": "Route Id" } ] } }, "name": "RouteTables" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue contains \"Network\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Administrative Changes to Network Infrastructure (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "type", "formatter": 16, "formatOptions": { "showIcon": true } }, { "columnMatch": "location", "formatter": 17 }, { "columnMatch": "subscriptionId", "formatter": 15, "formatOptions": { "showIcon": true } }, { "columnMatch": "Subnetid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true, "templateRunContext": { "componentIdSource": "parameter", "templateUriSource": "static", "titleSource": "static", "descriptionSource": "static", "description": "", "runLabelSource": "static" } } }, { "columnMatch": "Routeid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } } ], "filter": true } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let applications = dynamic([\"Azure Active Directory PowerShell\", \"Microsoft Azure PowerShell\", \"Graph Explorer\", \"ACOM Azure Website\"]);\r\nSigninLogs\r\n| where AppDisplayName in (applications)\r\n| project UserPrincipalName, ResultType, AppDisplayName, IPAddress, Location, UserAgent, TimeGenerated", "size": 0, "showAnalytics": true, "title": "Accessing Management CLI/Powershell Functions (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "type", "formatter": 16, "formatOptions": { "showIcon": true } }, { "columnMatch": "location", "formatter": 17 }, { "columnMatch": "subscriptionId", "formatter": 15, "formatOptions": { "showIcon": true } }, { "columnMatch": "Subnetid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true, "templateRunContext": { "componentIdSource": "parameter", "templateUriSource": "static", "titleSource": "static", "descriptionSource": "static", "description": "", "runLabelSource": "static" } } }, { "columnMatch": "Routeid", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } } ], "filter": true } }, "customWidth": "50", "name": "query - 6" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_9Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Router & Switches", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Load Balancer / Reverse Proxy](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Load Balancer](https://azure.microsoft.com/services/load-balancer/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [Monitoring load balancer](https://docs.microsoft.com/azure/load-balancer/monitor-load-balancer)
\r\n💡 [Monitoring load balancer data reference](https://docs.microsoft.com/azure/load-balancer/monitor-load-balancer-reference)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "5b7f10a7-0211-4863-9a67-dbe4ff9680d6", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "0f9041d2-d7d5-45c0-88d1-60b227963c72", "linkTarget": "OpenBlade", "linkLabel": "Load Balancers", "style": "secondary", "bladeOpenContext": { "bladeName": "LoadBalancingHubMenuBlade", "extensionName": "Microsoft_Azure_Network" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (For Devices with Multiple Inferfaces: Interface MAC - If Correlated to the Device NAT IP Address) | Load Balancer / Reverse Proxy Access Logs • Connection Type • Date and Time • Resource ID of the Load Balancer • Client IP Port • Target IP Port • Request Processing Time • Target Processing Time • Response Processing Time • Status Code from Load Balancer • Target Status Code • Received Bytes • Bytes Sent • Request • User Agent • SSL Cipher • SSL Protocol • SNI Domain • Matched Rule Priority • Actions Executed • Redirect URL • Error Reason • Target IP:Port List • Target Status Code List • Classification Reason Request Does Not Comply with RFC 7230 • Other Implementation Specific Fields| Log | 0 | 12 Months Active Storage, 18 Months Cold Storage | 17 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL01_20", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL01_20", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL01_20", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" } ] }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"load\" or type contains \"traffic\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", "size": 0, "showAnalytics": true, "title": "Load Balancers", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue contains \"Microsoft.Network/loadBalancers/\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Administrative Changes to Load Balancers (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "isEL01_20Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Load Balancer / Reverse Proxy", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Proxies & Web Content Filters](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/) ✳️ [Application Gateway]( https://azure.microsoft.com/services/application-gateway/)
\r\n\r\n### References\r\n💡 [Monitor Azure Firewall logs and metrics](https://docs.microsoft.com/azure/firewall/firewall-diagnostics)
\r\n💡 [Resource logs for Azure Web Application Firewall](https://docs.microsoft.com/azure/web-application-firewall/ag/web-application-firewall-logs)
\r\n💡 [Azure Application Gateway analytics](https://docs.microsoft.com/azure/azure-monitor/insights/azure-networking-analytics#azure-application-gateway-analytics)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "cba94035-0e78-47d4-b623-387225a62d2b", "linkTarget": "OpenBlade", "linkLabel": "Application Gateways", "style": "secondary", "bladeOpenContext": { "bladeName": "LoadBalancingHubMenuBlade", "extensionName": "Microsoft_Azure_Network" } }, { "id": "7e718d8f-3cf2-40f7-89d6-a766fc926b86", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (For Devices with Multiple Inferfaces: Interface MAC - If Correlated to the Device NAT IP Address) | Proxies & Web Content Filters:Provides NAT, User, and Gateway IP Address to Provide Enhanced Reporting of Malicious Domains and IP Addresses. In the Case of Web, W3c Format • Date and Time • Source o Hostname o IP Address and Port o MAC • Destination o Hostname o IP Address and Port o MAC • Web URL Methods / User Agent /Decoded Headers • URL Categories • URL • Permitted, Restricted, Denied • Policy Updates • Software Updates | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 18 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_10", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_10", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_10", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_10}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let materializedData =\r\nmaterialize(\r\nAzureDiagnostics\r\n| where Category == \"AzureFirewallApplicationRule\"\r\n| project ResourceId,ResourceGroup,SubscriptionId, msg_s, Resource, TimeGenerated);\r\nunion\r\n(\r\nmaterializedData\r\n| where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s has \". Url\" and msg_s has \". No rule matched\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s !has \". Url\" and msg_s has \". No rule matched\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s has \"Web Category:\" and msg_s !has \". Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s !has \". Url\" and msg_s !has \"Rule Collection\" and msg_s !has \" Reason: \"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s !has \". Url\" and msg_s !has \"Rule Collection\" and msg_s !has \"TLS extension was missing\"\r\n| where msg_s has \" Reason:\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s !has \". Url\" and msg_s !has \"TLS extension was missing\" and msg_s !has \"No rule matched\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Web Category:\" and msg_s !has \". Url\" and msg_s !has \"Rule Collection\" and msg_s !has \" Reason: \"\r\n| where msg_s has \"Rule Collection Group\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n)\r\n| summarize by TimeGenerated, FQDN, Protocol, Action, SourceIP, SourcePort, DestinationPort , ResourceId , ResourceGroup , RuleCollection, Rule, WebCategory, SubscriptionId\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "title": "Proxies & Web Content Filter (Azure Firewall)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_11Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Proxies & Web Content Filters", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Access, Authorization, & Accounting](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
\r\n🔷 [_Im_NetworkSession](https://docs.microsoft.com/azure/sentinel/network-normalization-schema) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/microsoft-sentinel/)
\r\n\r\n### References\r\n💡 [Azure Activity Log](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log)
\r\n💡 [Advanced Security Information Model (ASIM) Network Session normalization schema reference](https://docs.microsoft.com/azure/sentinel/network-normalization-schema)
\r\n\r\n### Microsoft Portals \r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "84cc2683-5a26-49f9-9abb-3618a1da07bc", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "d2b55d7f-ef3b-4109-aae7-dd602bbb7096", "linkTarget": "OpenBlade", "linkLabel": "Security Events Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "dataConnectorId" } ] } }, { "id": "7742c9c8-9774-4718-a021-4f35400b5818", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Endpoint", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftDefenderAdvancedThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "Access, Authorization, & Accounting (Azure)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (Access, Authorization, & Accounting) | General Information • Date and Time • Event, Status, or Error Codes • Service/Command/Application Name • User or System Account Associated with an Event • Device Used (e.g., Source and Destination IPs, Terminal Session ID, Web Browser, etc.) Operating System (OS) Events • Start-Up and Shutdown of the System • Start-Up and Shutdown of a Service • Network Connection Changes or Failures • Changes to, or Attempts to Change, System Security Settings and Controls OS Audit Records • Log-On Attempts (Success/Failure) • The Function(s) Performed after Logging On (e.g., Reading or Updating a Critical File, Software Installation) • Account Changes (e.g., Account Creation and Deletion, Account Privilege Assignment) • Successful/Failed Use of Privileged Accounts Application Account Information • Application Authentication Attempts (Success/Failure) • Application Account Changes (e.g., Account Creation and Deletion, Account Privilege Assignment) • Use of Application Privileges Application Operations • Application Startup and Shutdown • Application Failures • Major Application Configuration Changes • Application Transactions, For Example, o Email Servers Recording the Sender, Recipients, Subject Name, and Attachment Names for Each Email o Web Servers Recording Each URL Requested and the Type of Response Provided by the Server o Business Applications Recording Which Financial Records Were Accessed by Each User| Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 18-20 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_11", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_11", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_11", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_11}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_Im_NetworkSession\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Access, Authorization, & Accounting (_Im_NetworkSession)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_12Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Access, Authorization, & Accounting", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User & Administrator Access to OS Components & Applications (Windows)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityEvent](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### References\r\n💡 [Microsoft Defender for Endpoint](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-defender-for-endpoint)
\r\n💡 [Windows Security Events via AMA](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama)
\r\n💡 [Security events via Legacy Agent (Windows)](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#security-events-via-legacy-agent-windows)
\r\n💡 [Windows agent-based connections](https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CAMA#windows-agent-based-connections)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "4c0aa124-7cd6-42c6-8723-7e545f6433df", "linkTarget": "OpenBlade", "linkLabel": "Security Events (MMA)", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "SecurityEvents" } ] } }, { "id": "d4f484d8-6e77-4913-bc70-339c42d48c59", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Endpoint", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftDefenderAdvancedThreatProtection" } ] } }, { "id": "c89973fc-637d-4a4a-957f-a1bd7b81c85d", "linkTarget": "OpenBlade", "linkLabel": "Security Events (AMA)", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsSecurityEvents" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Operating Systems - Windows Infrastructure & Operating Systems | User and Administrator Access to OS Components and Applications • File and Object Access • Audit Log Access (Success/Failure) • System Access and Log Off (Success/Failure) • Privilege Access and Log Off (Success/Failure) • RDP Access and Log Off (Success/Failure) • SMB Access • Installation or Removal of Storage Volumes or Removable Media System Performance and Operational Characteristics • Resource Utilization, Process Status • System Events • Service Status Changes (Start, Stop, Fail, Restart, etc.) • Service Failures and Restarts • Process Creation and Termination System Configuration • Changes to Security Configuration (Success/Failure) • Audit Log Cleared • Changes to Accounts • User or Group Management Changes • Scheduled Task Changes File Access • Transfer of Data to External Media or Remote Hosts Communications • Listening Network Port and IP Address • Active Network Communication with Other Hosts Powershell Execution Commands WMI Events Registry Access Command-Line Interface (CLI) Basic Input Output System (BIOS), Unified Extensible Firmware Interface (UEFI), and Other Firmware • Version • Created Date • Installed Date • Manufacturer | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage Host Network | 20-21 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_12", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_12", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_12", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_12}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Operating System Logs (Windows) ", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_13Visible", "comparison": "isEqualTo", "value": "true" }, "name": "User & Administrator Access to OS Components & Applications (Windows)", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User & Administrator Access to OS Components & Applications (Mac OS)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Syslog](https://docs.microsoft.com/azure/azure-monitor/reference/tables/syslog) ✳️ [Collect Syslog Data Sources with Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-syslog)
\r\n\r\n### References\r\n💡 [Collect data using Syslog](https://docs.microsoft.com/azure/sentinel/connect-syslog)
\r\n💡 [Get CEF-formatted logs from your device or appliance into Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)
\r\n💡 [NXLog Basic Security Module (BSM) macOS](https://docs.microsoft.com/azure/sentinel/data-connectors-reference)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Syslog Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Syslog" } ] } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "CEF Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Operating Systems - MACOS (Or Other Apple Desktop and Server Operating Systems) | User and Administrator Access to OS Components and Applications • File and Object Access • Audit Log Access (Success/Failure) • System Access and Log Off (Success/Failure) • Privilege Access and Log Off (Success/Failure) • Remote Terminal or Equivalent Access and Log Off (Success/Failure) • Samba/NFS/(S)FTP or Equivalent Access • Installation or Removal of Applications • Installation or Removal of Storage Volumes or Removable Media System Performance and Operational Characteristics • Resource Utilization, Process Status • System Events • Service Status Changes (Start, Stop, Fail, Restart, etc.) • Service Failures and Restarts • Process Creation and Termination System Configuration • Changes to Security Configuration (Success/Failure) • Audit Log Cleared • Changes to Accounts • User or Group Management Changes • Scheduled Task Changes File Access • Transfer of Data to External Media or Remote Hosts Host Network Communications• Listening Network Port and IP Address • Active Network Communication with Other Hosts Command-Line Interface (CLI) • System Log Folder: /Var/Log/* • System Log: /Var/Log/System.Log • Mac Analytics Data: /Var/Log/Diagnosticmessages/* • Wi-Fi Log: /Var/Log/Wifi.Log • System Application Logs: /Library/Logs/* and /Private/Var/Log/* • System Reports: /Library/Logs/Diagnosticreports/ * • User Application Logs: /Users/Name/Library/Logs/* • User Reports: /Users/Name/Library/Logs/Diagnosticreports/* • Audit Log: /Var/Audit/* Basic Input Output System (BIOS), Unified Extensible Firmware Interface (UEFI), and Other Firmware • Version • Created Date • Installed Date • Manufacturer| Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage Host Network | 22-23 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_13", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_13", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_13", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_13}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SourceSystem contains \"mac\" or SourceSystem contains \"osx\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Mac OS (Syslog Connector)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_14Visible", "comparison": "isEqualTo", "value": "true" }, "name": "User & Administrator Access to OS Components & Applications (Mac OS)", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User & Administrator Access to OS Components & Applications (Linux)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Syslog](https://docs.microsoft.com/azure/azure-monitor/reference/tables/syslog) ✳️ [Collect Syslog Data Sources with Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-syslog)
\r\n\r\n### References\r\n💡 [Collect data using Syslog](https://docs.microsoft.com/azure/sentinel/connect-syslog)
\r\n💡 [Get CEF-formatted logs from your device or appliance into Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)
\r\n💡 [Deploy a log forwarder to ingest Syslog and CEF logs to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-log-forwarder?tabs=rsyslog)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Syslog Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Syslog" } ] } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "CEF Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Operating Systems - BSD (Linux) | User and Administrator Access to OS Components and Applications • File and Object Access • Audit Log Access (Success/Failure) • System Access and Log Off (Success/Failure) • Privilege Access and Log Off (Success/Failure) • Remote Terminal or Equivalent Access and Log Off (Success/Failure) • Samba/NFS/(S)FTP or Equivalent Access • Installation or Removal of Storage Volumes or Removable Media System Performance and Operational Characteristics • Resource Utilization, Process Status • System Events • Service Status Changes (Start, Stop, Fail, Restart, Etc.) • Service Failures and Restarts • Process Creation and Termination System Configuration • Changes to Security Configuration (Success/Failure) • Audit Log Cleared • Changes to Accounts • User or Group Management Changes • Scheduled Task Changes File Access • Transfer of Data to External Media or Remote Hosts Host Network Communications • Listening Network Port and IP Address • Active Network Communication with Other Hosts Command-Line Interface (CLI) Security Enhanced Linux (SELinux) AppArmor or Equivalent • Warning Logs • Violation Logs System • /Var/Log/Messages • /Var/Log/Dmesg • /Var/Log/Syslog • /Var/Log/Daemon.Log • /Var/Log/Cron • /Var/Log/Kern.Log • /Var/Log/Boot.Log Access And Authentication • /Var/Log/Auth.Log • /Var/Log/Secure • /Var/Log/Faillog • /Var/Log/Btmp • /Var/Log/Wtmp or /Var/Log/Utmp Applications • /Var/Log/Mail.Log or /Var/Log/Maillog • /Var/Log/Xorg.X.Log Package Install/Uninstall • /Var/Log/Dpkg.Log • /Var/Log/Yum.Log Basic Input Output System (BIOS), Unified Extensible Firmware Interface (UEFI), and Other Firmware • Version • Created Date • Installed Date • Manufacturer | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage Host Network | 24-26 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_14", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_14", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_14", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_14}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SourceSystem == \"Linux\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Linux OS (Syslog Connector)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project DeviceProduct, DeviceVendor, TenantId, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, AdditionalExtensions, DeviceAction, ApplicationProtocol, SourceTranslatedPort, SourcePort, SourceIP, SourceUserID, SourceUserName, SourceUserPrivileges, DestinationServiceName, DestinationTranslatedAddress, DestinationTranslatedPort, CommunicationDirection, DeviceDnsDomain, DeviceExternalID, DeviceInboundInterface, DeviceOutboundInterface, DestinationHostName, DestinationIP, DestinationPort, FileType, ReceivedBytes, Message, SentBytes, Protocol, RequestURL, RequestClientApplication, RequestContext, RequestMethod, ReceiptTime, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Common Event Format (CommonSecurityLog)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_15Visible", "comparison": "isEqualTo", "value": "true" }, "name": "User & Administrator Access to OS Components & Applications (Linux)", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cloud Environments (General Logging)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [AWSCloudTrail](https://docs.microsoft.com/azure/azure-monitor/reference/tables/awscloudtrail)
\r\n🔷 [GCP_IAM_CL](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-workspace-g-suite-preview)
\r\n\r\n### References\r\n💡 [Enable Azure Activity Logging](https://docs.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD)
\r\n💡 [Connect AWS CloudTrail to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-aws)
\r\n💡 [Google Workspace (G-Suite) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-workspace-g-suite-preview)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "AWS Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AWS" } ] } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "GCP Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "1f2ba663-dd7a-49b6-87ba-0b8adf6d2d34" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Cloud Environments (General Events) | Nearly all successful attacks on cloud services result from customer misconfigurations. With that in mind, the logging and monitoring focus should be on: • Any Activity on Break-glass Account(s) (which should never have to be used) • Conditional Access Policy Changes • Changes to Environment Policies (e.g., Azure Subscription, AWS Services, Google Solutions, etc.) in Management Logs • Privileged Role Changes • Virtual Network (VNet) Changes • Deletions of Delete Locks • Changes to Logging Policies • Privileged Identity Management (PIM) and Identity Protection Changes • Changes to Alert Rules (Audit the Auditor) • Key Vault/Key Management Changes • Storage File Access Logs, File, File Hashes • Baseline Deviations for Prod App Tiers • Baseline Deviations for Prod Data Tiers • IDS / IPS / NTA / NDR / SIEM Logs •API Activity Logs • Authentication Logs • Firewall Logs • Web Proxy/WAF Logs • Service Metrics • Billing Data • Flow Logs • Remote Access/VPN Logs • System/OS Logs • DLP Logs • DNS Query/Response Logs| Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 26-27 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_15", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_15", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_15", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_15}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "Azure Logs (AzureActivity)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSCloudTrail\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "AWS Logs (AWSCloudTrail)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "GCP_IAM_CL\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Google Cloud Platform IAM (GCP_IAM_CL)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "GCP_IAM_CL\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Google Cloud Platform IAM (GCP_IAM_CL)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_16Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Cloud Environments (General Logging)", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cloud AWS](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AWSCloudTrail](https://docs.microsoft.com/azure/azure-monitor/reference/tables/awscloudtrail) 🔷 [AWSGuardDuty](https://docs.microsoft.com/azure/azure-monitor/reference/tables/awsguardduty) 🔷 [AWSVPCFlow](https://docs.microsoft.com/azure/azure-monitor/reference/tables/awsvpcflow)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### References\r\n💡 [Azure security solutions for AWS](https://docs.microsoft.com/azure/architecture/reference-architectures/aws/aws-azure-security-solutions)
\r\n💡 [Connect AWS CloudTrail to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-aws)
\r\n\r\n### Microsoft Portals" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "AWS Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AWS" } ] } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "AWS S3 Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AwsS3" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Cloud AWS | • AWS Cloudtrail •Amazon Cloudwatch Logs • AWS Config • Amazon S3 Access Logs • Amazon VPC Flow Logs • AWS WAF Logs • AWS Shield • AWS Guardduty • AWS Security Hub | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 27 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_16", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_16", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_16", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_16}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| where RecommendationDisplayName contains \"AWS\" or RecommendationDisplayName contains \"Amazon\"\r\n| limit 2500\r\n", "size": 0, "title": "AWS Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| where Title contains \"AWS\" or Title contains \"S3\" or Title contains \"Amazon\"\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "AWS Security Incidents (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6a0e2e83-5e05-4133-aee4-cefd29836430", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE ATT&CK® Coverage >>", "style": "secondary" } ] }, "name": "links - 1" } ] }, "name": "group - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSCloudTrail\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "AWS Logs (AWSCloudTrail)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSGuardDuty\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "AWS Logs (AWSGuardDuty)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AWSVPCFlow\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "AWS Logs (AWSVPCFlow)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_17Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Cloud AWS", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cloud Azure](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) 🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [StorageBlobLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/storagebloblogs) 🔷 [StorageFileLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/storagefilelogs) ✳️ [Azure Blob Storage](https://azure.microsoft.com/services/storage/blobs/)
\r\n\r\n### References\r\n💡 [Connect Azure Activity Data](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Connect Azure Storage Account Data](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-storage-account)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Cloud Azure | • Microsoft Entra ID Logs • Activity Logs • Unified Audit Logs (w/Advanced Audit Features) | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 27 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_17", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_17", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_17", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_17}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "Azure Logs (AzureActivity)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Microsoft Entra ID (SigninLogs)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Audit Logs (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Unified Audit Logs (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "StorageBlobLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Storage Blob Logs (Azure Blob Storage)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "StorageFileLogs\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Storage File Logs (Azure Blob Storage)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 7 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_18Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Cloud Azure", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cloud GCP](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [GCP_IAM_CL](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-workspace-g-suite-preview)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert)✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Google Workspace (G-Suite) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-workspace-g-suite-preview)
\r\n💡 [Connect your GCP accounts to Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/quickstart-onboard-gcp)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" } ] }, "name": "group - 5" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "GCP IAM Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "1f2ba663-dd7a-49b6-87ba-0b8adf6d2d34" } ] } }, { "id": "52db81d7-53c9-4554-95d1-a5913b20d614", "linkTarget": "OpenBlade", "linkLabel": "GCP DNS Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "be845642-8f07-484c-a8be-712322833a30" } ] } }, { "id": "23ccc55e-6d04-4d87-ab12-88c359cb11cb", "linkTarget": "OpenBlade", "linkLabel": "GCP Cloud Monitoring Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "5a646e36-04e2-41d4-b271-c5e1560185ae" } ] } }, { "id": "04147454-13de-4e58-b8a8-f493806f4d38", "linkTarget": "OpenBlade", "linkLabel": "Google Workspace Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "GWorkspaceRAPI" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Cloud GCP | • Access Transparency Audit Log • Admin Audit Log • Data Studio Audit Log • Drive Audit Log • Email Audit Log • Groups Audit Log • LDAP Audit Log • Login Audit Log • Devices Audit Log • Sail Audit Log • Token Audit Log • User Accounts Audit Log • OAuth Token Audit Log • Security Reports • Usage Logs • Storage Logs • Data Access Logs For Organizational and Default Configuration Settings Enable: • Admin Read • Data Read • Data Write | Log | 0 | 12 Months Active Storage, 18 Months Cold Data Storage | 27 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_18", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_18", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_18", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL0_18}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName has \"GCP\" or RecommendationDisplayName has \"Google\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "GCP Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| where Title contains \"GCP\" or Title contains \"Google\"\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "GCP Security Incidents (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "name": "group - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "GCP_IAM_CL\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Google Cloud Logs (GCP_IAM_CL)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0_19Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Cloud GCP", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL0Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Event Logging (EL0)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Basic Log Event Management (EL1)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n---\r\nOnly logging requirements of highest criticality are met. The agency and all of its components meet the following requirements, as detailed in Table 2 EL1 Basic Requirements) within Appendix A (Implementation and Centralized Access Requirements). Requirements include: Basic Logging Categories, Minimum Logging Data, Time Standard, Event Forwarding, Protecting and Validating Log Information, Passive DNS, Cybersecurity Infrastructure Security Agency (CISA) and Federal Bureau of Investigations (FBI) Access Requirements, Logging Orchestration, Automation, and Response – Planning, User Behavior Monitoring – Planning, and Basic Centralized Access." }, "customWidth": "40", "name": "EL1 Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Configuration\\\", \\\"tab\\\": \\\"EL1_1_\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Endpoint Detection & Response (EDR)\\\", \\\"tab\\\": \\\"EL1_2_\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Configuration Changes\\\", \\\"tab\\\": \\\"EL1_3\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Administrative\\\", \\\"tab\\\": \\\"EL1_4\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Authorization\\\", \\\"tab\\\": \\\"EL1_5\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Content Filtering Policy Updates\\\", \\\"tab\\\": \\\"EL1_6\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"AV & Behavior Based Malware Protection\\\", \\\"tab\\\": \\\"EL1_7\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Host Connections to Specific URLs\\\", \\\"tab\\\": \\\"EL1_8\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"All Devices\\\", \\\"tab\\\": \\\"EL1_9\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Firewalls\\\", \\\"tab\\\": \\\"EL1_10\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"IDS/IPS Alerts & Events\\\", \\\"tab\\\": \\\"EL1_11\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a30d01d0-38f1-4a91-9cf6-cdb181d676b5", "version": "KqlParameterItem/1.0", "name": "isEL1_1_Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_1_", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "5adaf9a2-bf95-4de8-8c45-6d7a5d363516", "version": "KqlParameterItem/1.0", "name": "isEL1_2_Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_2_", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isEL1_3Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_3", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "d0671b49-6bbd-49c3-970c-ff0292fda421" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_4Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_4", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "af237977-f506-4a22-9c3c-98f16792fc11" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_5Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_5", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "3c38683f-5413-46d9-9461-4ca94c519bd5" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_6Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_6", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "01a6cc03-2ed8-4ef6-98e9-11e95c4de191" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_7Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_7", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "3c3c21c8-dbbc-4393-ad67-9f64756f2a50" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_8Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_8", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "685f5307-72af-43a7-be11-750556ac2c0c" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_9Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_9", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "a9f47ba8-5cdd-4ced-9ac3-31eeea813229" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_10Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_10", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "78ed01a9-e093-4a9c-8329-f6f327679bdf" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_11Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_11", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "3194b0b9-682b-4d10-9f90-0f0a4759f2a2" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"VPN Gateway\\\", \\\"tab\\\": \\\"EL1_12\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"PKI Infrastructure\\\", \\\"tab\\\": \\\"EL1_13\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Vulnerability Assessments\\\", \\\"tab\\\": \\\"EL1_14\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Database Level\\\", \\\"tab\\\": \\\"EL1_15\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Web Applications\\\", \\\"tab\\\": \\\"EL1_16\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Web Application Crashes\\\", \\\"tab\\\": \\\"EL1_17\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Web Application & Middleware\\\", \\\"tab\\\": \\\"EL1_18\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Virtualization on System\\\", \\\"tab\\\": \\\"EL1_19\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Mobile EMM (UEM) / MTD Agent Logs\\\", \\\"tab\\\": \\\"EL1_21\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Container Supply Chain\\\", \\\"tab\\\": \\\"EL1_22\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers - Copy", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "isEL1_12Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_12", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "dc3d5197-65cb-4bf4-9164-80efa7c22235" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_13Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_13", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "04fff311-3b95-4006-86c5-2fde3e3fa313" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_14Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_14", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "5bfb8d71-0506-46cb-85a0-b573b35ef9e1" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_15Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_15", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "8b06fc0c-7cd4-401d-9655-a033de4bbaa2" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_16Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_16", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "d462a14c-b008-4dcc-8e56-506a605667f5" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_17Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_17", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "dd5f247f-5463-4115-b516-3443a7ed0862" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_18Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_18", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "eeedbb54-caea-4ade-a853-82545e0b55f0" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_19Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_19", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "965f9d49-a307-4696-9aca-9f433e86645f" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_21Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_21", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "978cf7b2-62ab-41f1-b66e-670ac22263f1" }, { "version": "KqlParameterItem/1.0", "name": "isEL1_22Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL1_22", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "1062bc37-220b-4015-bba1-3101e7057385" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Configuration](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### References\r\n💡 [Connect Azure Activity Data](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Collect Windows and Linux performance data sources with Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-performance-counters)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| System & Configuration Performance | Configuration – Scripts or Database Changes Used to Configure Systems, Services on a System, or Applications | Database Record, Script | 1 | 12 Months Active Storage, 18 Months Cold Storage | 28 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_1", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_1", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_1", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_1}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| project OperationName, OperationNameValue, ResourceGroup, Caller, TimeGenerated, CallerIpAddress, Category\r\n\t| sort by TimeGenerated desc\r\n\t| limit 250\r\n\t| extend Packed=pack_all(true)\r\n\t| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "System & Application Configuration Changes (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserType <> \"Regular\"\r\n| project Operation, RecordType, UserId, UserType, OfficeWorkload, ResultStatus, Parameters, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "System & Application Configuration Changes (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_1_Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Configuration", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Endpoint Detection & Response (EDR)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) 🔷 [SecurityEvent](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### References\r\n💡 [Microsoft 365 Defender integration with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Endpoint", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftDefenderAdvancedThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| System & Configuration Performance | Endpoint Detection & Response (EDR) | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 28 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_2", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_2", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_2", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_2}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName == \"Microsoft Defender Advanced Threat Protection\" or ProductName == \"Microsoft Defender for Endpoint\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, ProductName, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "EDR Security Incidents (Microsoft Defender for Endpoint)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "bullets", "links": [ { "id": "077ea15e-faf8-4a16-b440-9da42f03f81e", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE ", "style": "secondary" } ] }, "name": "links - 1" } ] }, "name": "group - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityEvent\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "title": "Security Events (Microsoft Defender for Endpoint)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_2_Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Endpoint Detection & Response (EDR)", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Configuration Changes](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) 🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### References\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Connect Windows data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-dns-server-preview)
\r\n💡 [IdentityInfo table](https://docs.microsoft.com/azure/sentinel/ueba-enrichments#identityinfo-table-public-preview)
\r\n💡 [Start using Privileged Identity Management](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "aa3a196b-5a37-4b2d-9fd1-71d74a28fd00", "linkTarget": "OpenBlade", "linkLabel": "Privileged Identity Management", "style": "secondary", "bladeOpenContext": { "bladeName": "CommonMenuBlade", "extensionName": "Microsoft_Azure_PIMCommon" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| System & Configuration Performance | Configuration Changes • Management Action (Success/Failure) • Admin Login (Success/Failure) | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 28 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_3", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_3", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_3", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_3}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| extend PIM_Role = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Management Actions (Privileged Identity Management)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| where AssignedRoles contains \"Admin\" or AssignedRoles contains \"owner\" or AssignedRoles contains \"contributor\"\r\n| join (SigninLogs) on $left.AccountUPN == $right.UserPrincipalName\r\n| extend Country = tostring(LocationDetails.countryOrRegion)\r\n| where ResultType == 0\r\n| project UserPrincipalName, AssignedRoles, Department, JobTitle, Country, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Admin Sign Ins (Microsoft Entra ID)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_3Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Configuration Changes", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Administrative](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) 🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) 🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### References\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [Automatically create incidents from Microsoft security alerts](https://docs.microsoft.com/azure/sentinel/create-incidents-from-alerts)
\r\n💡 [IdentityInfo table](https://docs.microsoft.com/azure/sentinel/ueba-enrichments#identityinfo-table-public-preview)
\r\n💡 [Start using Privileged Identity Management](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "aa3a196b-5a37-4b2d-9fd1-71d74a28fd00", "linkTarget": "OpenBlade", "linkLabel": "Privileged Identity Management", "style": "secondary", "bladeOpenContext": { "bladeName": "CommonMenuBlade", "extensionName": "Microsoft_Azure_PIMCommon" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Authentication & Authorization | Administrative • Authentication Logons (Success/Failure) • Authentication Logoffs • Privilege Elevation (Success/Failure) • Security Related System Alerts and Failures • User and Group o Additions o Deletions o Modification to Permissions • Unauthorized Access Attempts to Critical Systems and File | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 29 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_4", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_4", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_4", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_4}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics))[0])\r\n| where Tactics contains \"Access\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "Unauthorized Access Incidents (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "891fe237-7887-41a2-8332-50168351aac9", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE", "style": "secondary" } ] }, "name": "links - 8" } ] }, "name": "group - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| where AssignedRoles contains \"Admin\" or AssignedRoles contains \"owner\" or AssignedRoles contains \"contributor\"\r\n| join (SigninLogs) on $left.AccountUPN == $right.UserPrincipalName\r\n| extend Country = tostring(LocationDetails.countryOrRegion)\r\n| project UserPrincipalName, ResultType, AssignedRoles, Country, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Authentication Logon/Logoffs: Success/Failure (Microsoft Entra ID)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| extend PIM_Role = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Privilege Elevation (Privileged Identity Management)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName contains \"role\" or OperationName contains \"user\" or OperationName contains \"principal\" or OperationName contains \"member\" or OperationName contains \"group\"\r\n| where OperationName !contains \"invite\" \r\n| where OperationName !contains \"external\" \r\n| where OperationName !contains \"licnense\" \r\n| project OperationName, Category, InitiatedBy, TargetResources, TimeGenerated\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "User/Group Changes (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_4Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Administrative", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Authorization](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [VMProcess](https://docs.microsoft.com/azure/azure-monitor/reference/tables/vmprocess) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [DeviceProcessEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceprocessevents) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n🔷 [Syslog](https://docs.microsoft.com/azure/azure-monitor/reference/tables/syslog) ✳️ [Collect Syslog Data Sources with Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-syslog)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Using Service Map solution in Azure](https://docs.microsoft.com/azure/azure-monitor/vm/service-map)
\r\n💡 [Connect Windows data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-dns-server-preview)
\r\n💡 [Deploy a log forwarder to ingest Syslog and CEF logs to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-log-forwarder?tabs=rsyslog)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM" } }, { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Authentication & Authorization | Authorization: All Privileged Operations Including: • “sudo” or runas • Enabling CLI Access • System Administrative Commands • Powershell Execution Commands • Powershell Script Block Logging | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 29 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_5", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_5", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_5", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_5}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where AppDisplayName == \"Azure Active Directory PowerShell\" or AppDisplayName == \"Microsoft Azure CLI\" or AppDisplayName contains \"command\" or AppDisplayName contains \"ACOM\" or AppDisplayName contains \"graph\" or AppDisplayName contains \"PowerShell\" or AppDisplayName contains \" CLI \"\r\n| project TimeGenerated, UserPrincipalName, ResultType, AppDisplayName, IPAddress, Location, UserAgent\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Usage of Privileged Management Functions (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Syslog\r\n| where SyslogMessage <> \"\"\r\n| where SyslogMessage contains \"sudo\" or SyslogMessage contains \"runas\"\r\n| summarize count() by SyslogMessage\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Sudo Activity (Syslog)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceProcessEvents\r\n| where ProcessCommandLine <> \"\"\r\n| summarize count() by ProcessCommandLine \r\n| sort by count_ desc\r\n| limit 250", "size": 0, "title": "Commands Executed (Device Process Events)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "VMProcess\r\n| where CommandLine <> \"\"\r\n| summarize count() by CommandLine\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Commands Executed (Virtual Machines)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_5Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Authorization", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Content Filtering Policy Updates](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) 🔷 [EmailEvents](https://docs.microsoft.com/microsoft-365/security/defender/advanced-hunting-emailevents-table) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Email Filtering, Spam, and Phishing | Content Filtering Policy Updates | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 29 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_6", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_6", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_6", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_6}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where Operation contains \"policy\"\r\n| where Operation !contains \"access\"\r\n| project Operation, RecordType, UserId, UserType, OfficeWorkload, ResultStatus, Parameters, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Content Filtering Policy Updates (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| summarize count() by ConfidenceLevel, DetectionMethods, DeliveryAction, EmailActionPolicy\r\n| sort by count_ desc", "size": 0, "title": "Configured Email Filtering Policies (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_6Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Content Filtering Policy Updates", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Anti-Virus & Behavior Based Malware Protection](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) 🔷 [SecurityEvent](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Understand threat intelligence in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence)
\r\n💡 [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Anti-Virus & Behavior Based Malware Protection | • Date and Time Source Hostname o IP o Port • Destination Hostname o IP o Port • Description of Malicious Code or Action and Severity • Identity or (Hash) Identifier of the File(s) • Description of the Action Taken (Clean, Quarantine, Delete) • Signature Updates| Log, Email Attachments | 1 | 12 Months Active Storage, 18 Months Cold Storage | 29-30 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_7", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_7", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_7", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_7}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName == \"Microsoft Defender Advanced Threat Protection\" or ProductName == \"Microsoft Defender for Endpoint\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, ProductName, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "Anti-Virus & Behavioral Based Malware: Security Incidents (Microsoft Defender for Endpoint)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "bullets", "links": [ { "id": "dfe735bf-006f-46a8-a247-d78433ad2fa2", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE ATT&CK® Coverage >>", "style": "secondary" } ] }, "name": "links - 1" } ] }, "name": "group - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"endpoint protection\" or RecommendationDisplayName contains \"virus\" or RecommendationDisplayName contains \"exploit\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Anti-Virus & Behavioral Based Malware: Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_7Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Anti-Virus & Behavior Based Malware Protection", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Indication of the Host that Connected to a Specific URL](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [DeviceNetworkEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicenetworkevents) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Using Service Map solution in Azure](https://docs.microsoft.com/azure/azure-monitor/vm/service-map)
\r\n💡 [Deploy and configure Azure Firewall Premium](https://docs.microsoft.com/azure/firewall/premium-deploy)
\r\n💡 [Web content filtering](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/web-content-filtering)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "4e3b71f8-692c-43a1-a130-1902d4d77118", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Anti-Virus & Behavior Based Malware Protection | Indication of the Host that Connected to a Specific URL • Date and Time • IP and Domain Reputation • URL • Categorization| Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 30 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_8", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_8", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_8", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_8}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| where Title contains \"URL\" or Title contains \"IP address\"\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "title": "Malicious IP / URL: Security Incidents (Microsoft Sentinel)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "0258da86-b652-4e63-82be-4e76c6a1358c", "linkTarget": "OpenBlade", "linkLabel": "Review Current MITRE ATT&CK® Coverage >>", "style": "secondary" } ] }, "name": "links - 1" } ] }, "name": "group - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceNetworkEvents\r\n| where RemoteUrl <> \"\"\r\n| summarize count() by DeviceName, RemoteUrl\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "title": "Host to URL Logging (Microsoft Defender for Endpoint)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let materializedData =\r\n(\r\nAzureDiagnostics\r\n| where Category == \"AzureFirewallApplicationRule\"\r\n| project ResourceId,ResourceGroup,SubscriptionId, msg_s, Resource, TimeGenerated);\r\nunion(\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n and msg_s !has \"Web Category:\" \r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \". No rule matched\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Web Category:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" \r\n and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \" Reason:\"\r\n and msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Rule Collection Group\"\r\n and msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| summarize by ResourceId = tolower(ResourceId) ,TimeGenerated, FQDN, Protocol, Action, SourceIP, SourcePort, DestinationPort , ResourceGroup , RuleCollection, Rule, WebCategory, SubscriptionId\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Web Categorization (Azure Firewall)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_8Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Indication of the Host that Connected to a Specific URL", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [All Devices](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [DeviceProcessEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceprocessevents) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n🔷 [ConfigurationData](https://docs.microsoft.com/azure/azure-monitor/reference/tables/configurationdata) ✳️ [Automation]( https://azure.microsoft.com/services/automation/)
\r\n🔷 [ConfigurationChange](https://docs.microsoft.com/azure/azure-monitor/reference/tables/configurationchange) ✳️ [Automation]( https://azure.microsoft.com/services/automation/)
\r\n\r\n### References\r\n💡 [Change Tracking and Inventory overview](https://docs.microsoft.com/azure/automation/change-tracking/overview)
\r\n💡 [Support for alerts on configuration state](https://docs.microsoft.com/azure/automation/change-tracking/overview#support-for-alerts-on-configuration-state)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "AutoManage", "style": "secondary", "bladeOpenContext": { "bladeName": "AutomanageMenuBlade", "extensionName": "Microsoft_Azure_AutoManagedVirtualMachines" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure | All Devices • Hash of the Binary / Binaries Running on the Device • Hash of Configs • Firmware o Version o Created Date o Installed Date o Manufacturer| Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 30 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_9", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_9", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_9", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_9}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ConfigurationData\r\n| where ConfigDataType == \"Registry\"\r\n| where Hive == \"HKEY_LOCAL_MACHINE\"\r\n| search \"hardware\"\r\n| project _ResourceId, RegistryKey, Hive, ValueName, ValueType, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Hardware/Firmware Configuration Data (Registry)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ConfigurationChange\r\n| where ConfigChangeType == \"Registry\"\r\n| where Hive == \"HKEY_LOCAL_MACHINE\"\r\n| search \"hardware\"\r\n| project _ResourceId, RegistryKey, Hive, ChangeCategory, ValueName, ValueType, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Hardware/Firmware Configuration Change (Registry)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceProcessEvents\r\n| where FileName <> \"\"\r\n| summarize count() by DeviceName, FileName, SHA256, SHA1\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "title": "Files, Binaries, and Hahses (DeviceProcessEvents)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_9Visible", "comparison": "isEqualTo", "value": "true" }, "name": "All Devices", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Firewalls](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### References\r\n💡 [Monitor Azure Firewall logs and metrics](https://docs.microsoft.com/azure/firewall/firewall-diagnostics)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (for Devices with Multiple Interfaces: Interface MAC - If Correlated to the Device NAT IP Address) | Firewalls: All Events from Firewall. At the very least, if access control lists (ACL) are enabled and the device is filtering traffic: • Action Permit, Teardowns, Closes, Denies, and Drops • Interface • Source o Hostname o IP Address and Port oMAC • Destination o Hostname o IP Address and Port o MAC • Protocol Type • Rule Name and Number Triggered •URL if Applicable, Associated User and User Agent • Date and Time | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 30 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_10", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_10", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_10", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_10}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let materializedData =\r\n(\r\nAzureDiagnostics\r\n| project ResourceId,ResourceGroup,SubscriptionId, msg_s, Resource, TimeGenerated);\r\nunion(\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n and msg_s !has \"Web Category:\" \r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \". No rule matched\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Web Category:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" \r\n and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \" Reason:\"\r\n and msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Rule Collection Group\"\r\n and msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| summarize by TimeGenerated, FQDN, Protocol, Action, SourceIP, SourcePort, DestinationPort , ResourceId , ResourceGroup , RuleCollection, Rule, WebCategory, SubscriptionId\r\n| where Action <> \"\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Firewall Traffic (Azure Firewall)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_10Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Firewalls", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IDS/IPS Alerts & Events](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### References\r\n💡 [Monitor Azure Firewall logs and metrics](https://docs.microsoft.com/azure/firewall/firewall-diagnostics)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (for Devices with Multiple Interfaces: Interface MAC - If Correlated to the Device NAT IP Address) | All Devices: IDs / IPs Alerts and Events • Date and Time • Source o Hostname o IP Address and Port oMAC •Destination o Hostname o IP Address and Port oMAC • Signature Triggered and Associated Details Including: o Signature o Anomaly • Rate Threshold • Device Name • Type of Event and Category • In the Case of Fortinet Network IPs, Attack Context •(Web / Device) User Agent if Available • Wi-Fi Channel • Wi-Fi Extended Service Set Identifier (ESSID) | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 31 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_11", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_11", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_11", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_11}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| where OperationName == \"AzureFirewallIDSLog\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" DestIP \":\" DestPort \". Action: \" Action \". Signature: \" SignatureID \". IDS:\" Message \". Priority:\" Priority \". Classification:\" Classification\r\n| project TimeGenerated, SignatureID, Message, Priority, Classification, Protocol, SourceIP, SourcePort, DestIP, DestPort, Action, Resource\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "title": "Intrusion Detection & Preventions (Azure Firewall)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_11Visible", "comparison": "isEqualTo", "value": "true" }, "name": "IDs /IPs Alerts & Events", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [VPN Gateway](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [GatewayDiagnosticLog](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log) 🔷 [TunnelDiagnosticLog](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log) 🔷 [IKEDiagnosticLog](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log) 🔷 [RouteDiagnosticLog](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log) 🔷 [P2SDiagnosticLog](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log) ✳️ [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/)
\r\n\r\n### References\r\n💡 [Set up alerts on resource log events from VPN Gateway](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "VPN / Private Links", "style": "secondary", "bladeOpenContext": { "bladeName": "PrivateLinkCenterBlade", "extensionName": "Microsoft_Azure_Network" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Device Infrastructure (for Devices with Multiple Interfaces: Interface MAC - If Correlated to the Device NAT IP Address) | VPN Gateway – All Events At the very least, for Accepts, Teardowns, Closes, Denies, and Drops: • Date and Time • Source o Hostname o IP Address and Port o MAC • Destination o Hostname o IP Address and Port oMAC • Source IP Address and Port, MAC (Inside Tunnel) • Destination IP Address and Port, MAC (Inside Tunnel) • Authentication Information (Success/Fail with Username and Device with User Agent) • Change in Status of Connections / Tunnel Status • VPN Certificate Status Validation | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 31-32 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_12", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_12", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_12", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_12}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n |where Category == 'GatewayDiagnosticLog'\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "VPN Gateway Configuration Logs (VPN Gateway)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n |where Category == 'TunnelDiagnosticLog'\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Tunnel State Change & Connections Logs (VPN Gateway)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n |where Category == 'RouteDiagnosticLog'\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Changes to Static Routes and BGP Events (VPN Gateway)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n |where Category == 'IKEDiagnosticLog'\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "IKE Control Messages & Events (VPN Gateway)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_12Visible", "comparison": "isEqualTo", "value": "true" }, "name": "VPN Gateway", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [PKI Infrastructure](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/AzureDiagnostics) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Azure Key Vault logging](https://docs.microsoft.com/azure/key-vault/general/logging?tabs=Vault)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure Key Vault", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKeyVault" } ] } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| PKI Infrastructure | All Events Related to: • Generation • Revocation • Access • Update • Expiry • Recover • Authentication Success • Authentication Fail • LDAP Logs | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 32 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_13", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_13", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_13", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "a92f439f-ade4-4712-9119-4e12e3baccba", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_13}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics \r\n| where ResourceProvider == \"MICROSOFT.KEYVAULT\"\r\n\t| sort by TimeGenerated desc\r\n\t| limit 250\r\n\t| extend Packed=pack_all(true)\r\n\t| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "PKI Infrastructure Events (Azure Key Vault)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"vault\" or RecommendationDisplayName contains \"encrypt\" or RecommendationDisplayName contains \"certificate\" or RecommendationDisplayName contains \"key\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "PKI Infrastructure: Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_13Visible", "comparison": "isEqualTo", "value": "true" }, "name": "PKI Infrastructure", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Vulnerability Assessments](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Threat and vulnerability management](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt)
\r\n💡 [Vulnerability assessment and management](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction#vulnerability-assessment-and-management)
\r\n💡 [Investigate weaknesses with Microsoft Defender for Endpoint's threat and vulnerability management](https://docs.microsoft.com/azure/defender-for-cloud/deploy-vulnerability-assessment-tvm)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Vulnerability Assessments | • Date and Time • Hostname, IP Address, and OS Version • Installed Applications • Version of Installed Applications • Vulnerabilities Listed in Installed Applications • Source of Vulnerability and Severity | Log: Logs are kept for ALL assessments, even if there are 0 vulnerabilities identified during the assessment | 1 | 12 Months Active Storage, 18 Months Cold Storage | 32 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_14", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_14", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_14", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_14}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n| where type == \"microsoft.security/assessments/subassessments\"\r\n| extend assessmentKey = extract(\".*assessments/(.+?)/.*\",1, id)\r\n| where assessmentKey == \"1195afff-c881-495e-9bc5-1486211ae03f\"\r\n| project Resource = tostring(properties.resourceDetails.id), subscriptionId, Severity = tostring(properties.status.severity), Status = tostring(properties.status.code), VulnId = tostring(properties.id)\r\n| where Status == 'Unhealthy'\r\n| summarize dcount(VulnId) by Resource, Severity, VulnId\r\n| summarize Total=count(Severity), High=countif(Severity=='High'), Medium=countif(Severity=='Medium'), Low=countif(Severity=='Low') by Resource\r\n| order by High desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Vulnerabilities by Asset", "noDataMessage": "No current recommendations in this area. Confirm the Azure Security Benchmark Assessment is enabled in Microsoft Defender for Cloud: Regulatory Compliance blade.", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "Resource", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" }, "tooltipFormat": { "tooltip": "[\"Total\"] fndings in total" } }, { "columnMatch": "High", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 4, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "sevH", "formatter": 4, "formatOptions": { "min": 0, "palette": "redBright", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "15ch" } }, { "columnMatch": "sevM", "formatter": 4, "formatOptions": { "min": 0, "palette": "yellow", "customColumnWidthSetting": "15ch" } }, { "columnMatch": "sevL", "formatter": 4, "formatOptions": { "min": 0, "palette": "blueDark", "customColumnWidthSetting": "15ch" } } ], "filter": true } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n| where type == \"microsoft.security/assessments/subassessments\"\r\n| project Resource = tolower(extract(\"([\\\\s\\\\S]*?)(/providers/Microsoft.Security.*)\",1,id)), ResourceGroup = trim_end(\"/\",extract(\".*resourceGroups/(.+?)/\",0,id)), ResourceType = tolower(split(id,\"/\").[6]), subscriptionId, Severity = tostring(parse_json(properties).status.severity), Status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), Description = tostring(parse_json(properties).displayName), Patchable = parse_json(properties.additionalData).patchable, CVE = properties.additionalData.cve, Category = tostring(properties.category), TimeGenerated = tostring(properties.timeGenerated), Remediation = tostring(properties.remediation), Impact = tostring(properties.impact), Threat = tostring(properties.additionalData.threat)\r\n| where Status == 'Unhealthy'\r\n| project Severity, VulnId, Description, tostring(Patchable), Category, Resource, ResourceGroup, CVE, TimeGenerated, Remediation, Impact, Threat\r\n| mvexpand CVE\r\n| extend CVEs = parse_json(CVE['title'])\r\n| summarize CVEs = tostring(make_list(CVEs)) by Description, Severity, Resource, ResourceGroup, TimeGenerated\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Vulnerability Details", "noDataMessage": "No current recommendations in this area. Confirm the Azure Security Benchmark Assessment is enabled in Microsoft Defender for Cloud: Regulatory Compliance blade.", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Resource", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" }, "tooltipFormat": { "tooltip": "[\"Total\"] fndings in total" } }, { "columnMatch": "High", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 4, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "sevH", "formatter": 4, "formatOptions": { "min": 0, "palette": "redBright", "compositeBarSettings": { "labelText": "" }, "customColumnWidthSetting": "15ch" } }, { "columnMatch": "sevM", "formatter": 4, "formatOptions": { "min": 0, "palette": "yellow", "customColumnWidthSetting": "15ch" } }, { "columnMatch": "sevL", "formatter": 4, "formatOptions": { "min": 0, "palette": "blueDark", "customColumnWidthSetting": "15ch" } } ], "filter": true } }, "customWidth": "50", "name": "query - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"vuln\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Vulnerabilities (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_14Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Vulnerability Assessments", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Database Level](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure SQL Database](https://azure.microsoft.com/products/azure-sql/database/) ✳️ [Azure Cosmos DB](https://azure.microsoft.com/services/cosmos-db/) ✳️ [Azure Database for MariaDB](https://azure.microsoft.com/services/mariadb/)✳️ [Azure Database for PostgreSQL](https://azure.microsoft.com/services/postgresql/) ✳️ [Azure Database for MySQL](https://azure.microsoft.com/services/mysql/) ✳️ [Azure Cache for Redis](https://azure.microsoft.com/services/cache/) ✳️ [Azure Managed Instance for Apache Cassandra](https://azure.microsoft.com/services/managed-instance-apache-cassandra/)
\r\n\r\n\r\n### References\r\n💡 [Types of Databases on Azure](https://azure.microsoft.com/product-categories/databases/)
\r\n💡 [SQL Advanced Threat Protection](https://docs.microsoft.com/azure/azure-sql/database/threat-detection-overview)
\r\n💡 [Monitoring SQL Server with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/monitoring-sql-server-with-azure-sentinel/ba-p/1502960)
\r\n💡 [Auditing for Azure SQL Database and Azure Synapse Analytics](https://docs.microsoft.com/azure/azure-sql/database/auditing-overview)
\r\n\r\n### Microsoft Portals" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure SQL Databases", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSql" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Database Level | • Addition of New Users, Especially Privileged Users • Query Being Executed • Query, Status (Response), and Traceback o Method o Comments or Variables o Multiple Embedded Queries o Database Alerts or Failures o Time to Execute Query • Attempts to Elevate Privileges (Success/Failure) • Changes to the Database Structure • Changes to User Roles or Database Permissions • Database Administrator Actions • Database Logons (Success/Failure) • Failed Logons • Use of Executable Commands • CLI Commands against the Data Base • Database Configuration and Version • Access to Sensitive Information within the Databases such as Keys, Passwords, Privacy Related Data | Log, Database Query | 1 | 12 Months Active Storage, 18 Months Cold Storage | 33 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_15", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_15", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_15", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_15}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics | where ResourceType == \"SERVERS/DATABASES\"\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "Database Logging (Azure SQL, SQL, MSSQL, DBs)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"database\" or RecommendationDisplayName contains \"sql\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Database Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_15Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Database Level", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Web Applications](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/)
\r\n\r\n### References\r\n💡 [Azure Web Application Firewall monitoring and logging](https://docs.microsoft.com/azure/web-application-firewall/afds/waf-front-door-monitor)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure WAF", "style": "secondary", "bladeOpenContext": { "bladeName": "LoadBalancingHubMenuBlade", "extensionName": "Microsoft_Azure_Network" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Application Level | Web Applications • URL • Headers • HTTP Methods - Request with Body of Data • HTTP Response with Body of DataWeb Application • Database Queries • Response Codes | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 33-34 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_16", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_16", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_16", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_16}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FakeData = (datatable (Message:string,ruleName_s:string,clientIp_s:string,clientIP_s:string,action_s:string,transactionId_s:string,site_s:string,details_message_sRole:string,details_file_sRole:string,hostname_sRole:string,Role:string,trackingReference_s:string,requestUri_s:string,ruleSetType_s:string,details_message_s:string,details_data_s:string,details_file_s:string,hostname_s:string,instanceId_s:string) [ \"\", \"\", \"\", \"\", \"\", \"\", \"\",\"\", \"\", \"\", \"\", \"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\" ]);\r\nFakeData | union AzureDiagnostics\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| extend Role = extract(\"ApplicationGateway([a-zA-Z_a-zA-Z_0-9]*)\",1,instanceId_s) \r\n| extend RequestUri = requestUri_s, RuleSetType = ruleSetType_s, Message_Details = details_message_s, Data_Details = details_data_s, File_Details = details_file_s, Hostname = hostname_s, Site = site_s\r\n| project Rule, TimeGenerated, SourceSystem, Hostname, ResourceId, ResourceGroup, ResourceProvider, Category, Role, Action, Site, Message_Details, File_Details, ClientIP, RequestUri\r\n| sort by TimeGenerated\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Application Logging (Azure Web Application Firewall)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_16Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Web Applications", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Web Application Crashes](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Requests](https://docs.microsoft.com/azure/azure-monitor/reference/tables/apprequests) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [Enable diagnostics logging for apps in Azure App Service](https://docs.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs)
\r\n💡 [App Service Integration with Azure Monitor](https://azure.github.io/AppService/2019/11/01/App-Service-Integration-with-Azure-Monitor.html)
\r\n💡 [Log Types for Azure Monitor Integration](https://azure.github.io/AppService/2020/06/25/New-Logs-Available-for-Azure-Monitor-Integration.html)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Application Level | Web Application Crashes • Processes • Applications | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 34 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_17", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_17", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_17", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_16}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", "version": "KqlParameterItem/1.0", "name": "Apps", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "where type =~ 'microsoft.insights/components'\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": [ "value::all" ], "typeSettings": { "resourceTypeFilter": { "microsoft.insights/components": true }, "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let apps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nrequests\r\n| summarize FailedRequests = countif(success == false), Count = count() by appName\r\n| join kind = inner (\r\n requests\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by appName\r\n) on appName\r\n| project-away appName1, timestamp\r\n| join kind = fullouter (apps) on appName\r\n| extend appName = appName1, FailedRequests = iff(appName == '', 0, FailedRequests), Count = iff(appName == '', 0, Count), Trend = iff(appName == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend)\r\n| extend MetricKind = 'Failures'\r\n| order by FailedRequests desc\r\n", "size": 3, "showAnalytics": true, "title": "Application Failures", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "appName", "formatter": 1, "formatOptions": { "showIcon": true } }, "subtitleContent": { "columnMatch": "MetricKind", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "FailedRequests", "formatter": 12, "formatOptions": { "min": 0, "palette": "red", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "red", "showIcon": true } }, "showBorder": false } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let appCount = 5;\r\nlet requestCount = 5;\r\nlet selectedApps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nlet topItems = requests\r\n| top-nested appCount of appName by AppMetric = countif(success == false) desc, top-nested requestCount of name by RequestMetric = countif(success == false) desc;\r\nlet topApps = topItems | summarize by appName;\r\nlet topRequests = topItems | summarize by strcat(appName, '::', name);\r\nlet rawData = requests\r\n| extend name = iff(strcat(appName, '::', name) in (topRequests), name, 'Other Requests'), appName = iff(appName in (topApps), appName, 'Other Apps');\r\nlet apps = rawData\r\n| summarize FailedRequests = countif(success == false), AllRequests = count(), Users = dcount(user_Id) by appName\r\n| project Id = appName, ParentId = '', Name = strcat('☁️ ', appName), Kind = 'Application', FailedRequests, AllRequests, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = appName\r\n) on Id\r\n| project-away Id1, timestamp\r\n| join kind = fullouter (selectedApps) on $left.Id == $right.appName\r\n| extend Id = appName, Name = strcat('☁️ ', appName), Kind = 'Application', FailedRequests = iff(Id == '', 0, FailedRequests), AllRequests = iff(Id == '', 0, AllRequests), Users = iff(Id == '', 0, Users), Trend = iff(Id == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend);\r\nlet requests = rawData\r\n| summarize FailedRequests = countif(success == false), AllRequests = count(), Users = dcount(user_Id) by appName, name\r\n| project Id = strcat(appName, '::', name), ParentId = appName, Name = strcat('🌐 ', name), Kind = 'Request', FailedRequests, AllRequests, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = strcat(appName, '::', name)\r\n) on Id\r\n| project-away Id1, timestamp;\r\nrequests\r\n| union (apps)\r\n| extend Rank = iff(Name contains 'Other Apps' or Name contains 'Other Requests', 2, 1)\r\n| order by Rank asc, FailedRequests desc\r\n| project Id, ParentId, Name, Kind, ['Failed Requests'] = FailedRequests, ['Failed Request Trend'] = Trend, ['All Requests'] = AllRequests, ['Success Rate'] = 1.0 * (AllRequests - FailedRequests) / AllRequests, Users", "size": 0, "showAnalytics": true, "title": "Application Request Failures", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "exportParameterName": "Row", "exportDefaultValue": "{}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "gridSettings": { "formatters": [ { "columnMatch": "Id", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "ParentId", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "Failed Requests", "formatter": 8, "formatOptions": { "min": 0, "palette": "red", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Failed Request Trend", "formatter": 9, "formatOptions": { "min": 0, "max": 1, "palette": "greenRed", "showIcon": true } }, { "columnMatch": "All Requests", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Success Rate", "formatter": 8, "formatOptions": { "min": 0, "max": 1, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "percent", "maximumFractionDigits": 2 } } }, { "columnMatch": "Users", "formatter": 0, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true, "hierarchySettings": { "idColumn": "Id", "parentColumn": "ParentId", "treeType": 0, "expanderColumn": "Name", "expandTopLevel": true } }, "tileSettings": { "titleContent": { "columnMatch": "appName", "formatter": 1, "formatOptions": { "showIcon": true } }, "subtitleContent": { "columnMatch": "MetricKind", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "FailedRequests", "formatter": 12, "formatOptions": { "min": 0, "palette": "red", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "red", "showIcon": true } }, "showBorder": false } }, "customWidth": "50", "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_17Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Web Application Crashes", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Web Application & Middleware](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n\r\n### References\r\n💡 [Web application monitoring on Azure](https://docs.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/app-monitoring)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Application Level | Web Applications & Middleware • Configuration • Version | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 34 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_18", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_18", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_18", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_17}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"application\"\r\n", "size": 0, "showAnalytics": true, "title": "Web Applications & Middleware (Select Asset for Configurations)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_18Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Web Application & Middleware", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Virtualization on System](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [VMwareESXi](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#vmware-esxi-preview) \r\n\r\n### References\r\n💡 [What is Azure VMware Solution?](https://docs.microsoft.com/azure/azure-vmware/introduction)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure VMware Solution", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "VMwareESXi" } ] } }, { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Virtualization on System | • User Authentication o Logon (Success and Failure) o Attempts to Obtain Privileged Access (Success and Failure) • User and Administrator/Root Access and Actions of Components and Applications o File and Object Access o Audit Log Access (Success and Failure) o System Access (Failure) • System Performance and Operational Characteristics o Resource Utilization, Process Status o System Events o Service Status Changes (e.g., Started, Stopped) • System Configuration o Changes to Security Configuration (Success/Failure) o Changes to Hypervisor o Changes to VMS o Changes Made within VMS o Audit Log Cleared • Creation and Deployment of VMS • Migration of VMS (e.g., Source and Target Systems, Time, Authorization) • Creation and Deletion of System-Level Objects | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 35 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_19", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_19", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_19", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_18}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 1, "content": { "json": "![Image Name](https://docs.microsoft.com/azure/azure-vmware/media/adjacency-overview-drawing-final.png) \r\n💡 [What is Azure VMware Solution?](https://docs.microsoft.com/azure/azure-vmware/introduction)
" }, "customWidth": "50", "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let VMwareData = union isfuzzy=true\r\n(\r\n VMwareESXi\r\n),\r\n(\r\n datatable(Dummy:string) \r\n [\r\n \"TableNotFound\"\r\n ]\r\n)\r\n| extend TableExists = iif(Dummy == \"TableNotFound\", 0, 1);\r\nVMwareData\r\n| extend InfoMessage = iif(TableExists == 0, \r\n \"⚠️ VMware ESXi Data Connector and/or Parser not installed. Please install both.\", \r\n \"✅ VMware ESXi Data Connector and Parser are installed.\")\r\n| where TableExists == 1 or TableExists == 0\r\n| limit 10\r\n|project-away TableExists\r\n", "size": 0, "title": "VMware ESXi Logs", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_19Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Virtualization on System", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Mobile (Smart Phones & Tablets) EMM (UEM) / MTD Agent Logs](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [IntuneAuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/intuneauditlogs) 🔷 [IntuneDevices](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/intunedevices?utm_source) 🔷 [IntuneOperationalLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/intuneoperationallogs) ✳️ [Microsoft Endpoint Manager](https://www.microsoft.com/security/business/microsoft-endpoint-manager)
\r\n\r\n### References\r\n💡 [Use audit logs to track and monitor events in Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/monitor-audit-logs)
\r\n💡 [Send log data to storage, event hubs, or log analytics in Intune](https://docs.microsoft.com/mem/intune/fundamentals/review-logs-using-azure-monitor)
\r\n💡 [Intune reports](https://docs.microsoft.com/mem/intune/fundamentals/reports)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Endpoint Manager / Intune", "style": "secondary", "bladeOpenContext": { "bladeName": "DmacHomePageBlade", "extensionName": "Microsoft_Intune_DeviceSettings" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Mobile (Smart-phones and Tablets) EMM (UEM) / MTD Server Logs | EMM (UEM)/MTD Alerts • Date and Time • Alert Type • Failure of Cryptographic Protocols • Failure of Device Cryptographic Capabilities (e.g., Trusted Boot Process)• Certificate Validation Failure (Defined in MDM Server Protection Profile) • Alerts from Agent to Server Defined MDM Agent Protection Profile. General: • Date and Time Device Data • Device Name • Device Manufacturer and Model • Serial # • Phone # • IMEI, IMSI, OS Version, OS Build • Firmware Version • Device IP Address, Device Root/Jailbreak Status and Reasons • Developer Mode Enabled • Battery/Power Information • Hardware Info (Processor, Memory, Storage) •Last Time Device Synched with Enterprise Application Data • Application Manifest (Installed Apps, App Version, Version History and Installation Timestamps), Installation and Data Storage Location • Application Permissions • Application Hash (e.g., SHA\u0002256) • Running Apps and Processes Device Policy Settings • Enrollment Policies • Policies Successfully/Unsuccessfully Applied •Authentication Policies (Password/Pin/Biometric, etc.) Device Configuration • Certificates end Related Information (Validity Period, Revocation, etc.) • Device Encryption Configuration • Android Enterprise Settings • System Integrity Status Network Configuration • Allowed/Disallowed Networks • Currently Connected Network • Proxy/Tunnel and Per-App VPN Info • Telephony Info (Some of This Is Covered by Carrier Data) • Captive Portals • Wi-Fi SSID • Network MAC Address • Bluetooth Event / Audit / Crash Logs • Event Type and ID • Event Date/Timestamp • Success/Failure of Various Services • User Authentication (Success/Failure) • Event Actor and ID (e.g., Admin, System, Device) • Event Change Type (CRUD) MTD Agent Info • Agent Activation Status • Threat Detection of Variety of Vulns • Phishing Protection Status • Tampering of Agent, App, or System • Privilege Escalation • MITM Activities • Remediation Actions Taken • Last Time Device Synched with Enterprise | Log | 1 | 12 Months Active Storage, 18 Months Cold Storage | 36-38 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_20", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_20", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_20", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_20}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IntuneDevices\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "EMM/MTD Devices (Intune/Microsoft Endpoint Manager)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ] } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IntuneAuditLogs \r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "EMM/MTD Audit Logs (Intune/Microsoft Endpoint Manager)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ] } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IntuneOperationalLogs \r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "EMM/MTD Operational Logs (Intune/Microsoft Endpoint Manager)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ] } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_21Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Mobile (Smart Phones & Tablets) EMM (UEM) / MTD Agent Logs", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Container Supply Chain](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [ContainerInventory](https://docs.microsoft.com/azure/azure-monitor/reference/tables/containerinventory) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Kubernetes Service (AKS)](https://azure.microsoft.com/services/kubernetes-service/)
\r\n🔷 [ContainerInstanceLog_CL](https://docs.microsoft.com/azure/container-instances/container-instances-log-analytics#containerinstancelog_cl) 🔷 [ContainerEvent_CL](https://docs.microsoft.com/azure/container-instances/container-instances-log-analytics#containerevent_cl) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n\r\n### References\r\n💡 [Retrieve container logs and events in Azure Container Instances](https://docs.microsoft.com/azure/container-instances/container-instances-get-logs)
\r\n💡 [Monitor container resources in Azure Container Instances](https://docs.microsoft.com/azure/container-instances/container-instances-monitor)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure Kubernetes Service", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKubernetes" } ] } }, { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Container Supply Chain | • Log Container Image Sources • Log Changes / Deltas Between Image Source Versions • Log Vulnerability Scan of Container Images, even if No Vulnerabilities Are Discovered • Log Where Containers Are Deployed and Which System They Support | Script, Manual Log Entry | 1 | 12 Months Active Storage, 18 Months Cold Storage | 38 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_22", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_22", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_22", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL1_22}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"container\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", "size": 0, "showAnalytics": true, "title": "Container Assets (Azure Resource Graph)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"container\" or RecommendationDisplayName contains \"kube\" or RecommendationDisplayName contains \"pod\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "title": "Container Security Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n| where Category == \"kube-audit\"\r\n\t| sort by TimeGenerated desc\r\n\t| limit 250\r\n\t| extend Packed=pack_all(true)\r\n\t| project Packed\r\n| evaluate bag_unpack(Packed)", "size": 0, "showAnalytics": true, "title": "Container Logging (Azure Diagnostics)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 7" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1_22Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Container Supply Chain", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL1Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Basic Event Logging (EL1)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Intermediate Log Event Management (EL2)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n---\r\nLogging requirements of highest and intermediate criticality are met. The agency and all of its components meet the following requirements, as detailed in Table 3 (EL2 Intermediate Requirements) within Appendix A (Implementation and Centralized Access Requirements). Requirements include: Meeting EL1 maturity level, Intermediate Logging Categories, Publication of Standardized Log Structure, Inspection of Encrypted Data, and Intermediate Centralized Access. " }, "customWidth": "40", "name": "EL2 Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"System Configuration & Performance\\\", \\\"tab\\\": \\\"EL2_1\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Email Filtering, Spam, & Phishing\\\", \\\"tab\\\": \\\"EL2_2\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"EL2_3\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Full Packet Capture Data\\\", \\\"tab\\\": \\\"EL2_4\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"COTS, Non-COTS, & Custom Applications\\\", \\\"tab\\\": \\\"EL2_5\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Container - Image, Mgmt, Orchestration, OS\\\", \\\"tab\\\": \\\"EL2_7\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a30d01d0-38f1-4a91-9cf6-cdb181d676b5", "version": "KqlParameterItem/1.0", "name": "isEL2_1Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_1", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isEL2_2Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_2", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "bda0d4ae-745f-4f78-8188-712e9b6dd932" }, { "version": "KqlParameterItem/1.0", "name": "isEL2_3Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_3", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "80aed847-ac84-45b5-b278-a4f0bbf08bc5" }, { "version": "KqlParameterItem/1.0", "name": "isEL2_4Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_4", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "c46bd38b-aaae-4eaf-b04f-19e14d17ee5a" }, { "version": "KqlParameterItem/1.0", "name": "isEL2_5Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_5", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "20c550f4-d9aa-49d0-b6ed-6b5d9b86522e" }, { "version": "KqlParameterItem/1.0", "name": "isEL2_7Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL2_7", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "fe680c5e-18a3-455c-8c23-cbcc31c78bb3" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [System Configuration & Performance](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [InsightsMetrics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/insightsmetrics) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [Tutorial: Enable monitoring for Azure virtual machine](https://docs.microsoft.com/azure/azure-monitor/vm/tutorial-monitor-vm-enable)
\r\n💡 [Azure Monitor Network Insights](https://docs.microsoft.com/azure/azure-monitor/insights/network-insights-overview)
\r\n💡 [Application Insights standard metrics](https://docs.microsoft.com/azure/azure-monitor/app/standard-metrics)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| System & Configuration Performance | System Status – Resource Utilization, Performance | Log, Database Record, Script | 2 | 12 Months Active Storage, 18 Months Cold Storage | 38-39 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_1", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_1", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_1", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_1}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated > ago(7d) \r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer P95th = round(percentile(Val, 95), 2) by Computer, Name\r\n | top 10 by P95th desc);\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer: string, NodeId: string, NodeProps: dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = VMComputer\r\n | extend ResourceId=strcat('machines/', Machine)\r\n | extend Bitness=columnifexists('Bitness', '')\r\n | where TimeGenerated > ago(7d)\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend\r\n AzureCloudServiceNodeIdentity = iif(isnotempty(AzureCloudServiceName), strcat(AzureCloudServiceInstanceId, '|', AzureCloudServiceDeployment), ''),\r\n AzureScaleSetNodeIdentity = iif(isnotempty(AzureVmScaleSetName), strcat(AzureVmScaleSetInstanceId, '|', AzureVmScaleSetDeployment), ''),\r\n ComputerProps = pack('type', 'StandAloneNode', 'name', Computer, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId, 'resourceGroup', AzureResourceGroup, 'azureResourceId', columnifexists('_ResourceId', '')),\r\n AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', AzureCloudServiceInstanceId, 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName', ''), 'cloudServiceDeploymentId', AzureCloudServiceDeployment, 'cloudServiceName', AzureCloudServiceName, 'mappingResourceId', ResourceId),\r\n AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('Computer', ''), 'vmScaleSetDeploymentId', AzureVmScaleSetDeployment, 'vmScaleSetName', AzureVmScaleSetName, 'serviceFabricClusterName', AzureServiceFabricClusterName, 'vmScaleSetResourceId', AzureVmScaleSetResourceId, 'resourceGroupName', columnifexists('AzureResourceGroup', ''), 'subscriptionId', columnifexists('AzureSubscriptionId', ''), 'mappingResourceId', ResourceId)\r\n | project\r\n Computer,\r\n NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer),\r\n NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps),\r\n Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true\r\n EmptyNodeIdentityAndProps,\r\n OmsNodeIdentityAndProps,\r\n ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n| where TimeGenerated > ago(7d)\r\n| where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n| where Computer in (computerList)\r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n| summarize P95th = round(percentile(Val, 95), 2) by bin(TimeGenerated, (now() - ago(7d)) / 100), ResourceName", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "CPU Utilization % (Last Week)", "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Computer", "formatter": 1 }, "leftContent": { "columnMatch": "value", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "ySettings": { "unit": 1, "min": 0, "max": 100 } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let memorySummary=totable(InsightsMetrics\r\n| where TimeGenerated > ago(7d) \r\n| where Namespace == 'Memory' and Name == 'AvailableMB'\r\n| summarize hint.shufflekey=Computer P5th = round(percentile(Val, 5), 2) by Computer, Name\r\n| top 10 by P5th asc);\r\nlet computerList=(memorySummary \r\n| project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n| extend NodeId = Computer\r\n| extend Priority = 1\r\n| extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = VMComputer | extend ResourceId=strcat('machines/', Machine) | extend Bitness=columnifexists('Bitness', '')\r\n| where TimeGenerated > ago(7d)\r\n| where Computer in (computerList)\r\n| summarize arg_max(TimeGenerated, *) by Computer\r\n| extend AzureCloudServiceNodeIdentity = iif(isnotempty(AzureCloudServiceName), strcat(AzureCloudServiceInstanceId, '|', AzureCloudServiceDeployment), ''), AzureScaleSetNodeIdentity = iif(isnotempty(AzureVmScaleSetName), strcat(AzureVmScaleSetInstanceId, '|', AzureVmScaleSetDeployment), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', Computer, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId, 'resourceGroup', AzureResourceGroup, 'azureResourceId', columnifexists('_ResourceId', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', AzureCloudServiceInstanceId, 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName', ''), 'cloudServiceDeploymentId', AzureCloudServiceDeployment, 'cloudServiceName', AzureCloudServiceName, 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('Computer', ''), 'vmScaleSetDeploymentId', AzureVmScaleSetDeployment, 'vmScaleSetName', AzureVmScaleSetName, 'serviceFabricClusterName', AzureServiceFabricClusterName, 'vmScaleSetResourceId', AzureVmScaleSetResourceId, 'resourceGroupName', columnifexists('AzureResourceGroup', ''), 'subscriptionId', columnifexists('AzureSubscriptionId', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n| summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n| extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n| project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n| where TimeGenerated > ago(7d)\r\n| where Namespace == 'Memory' and Name == 'AvailableMB'\r\n| where Computer in (computerList)\r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n| summarize P5th = round(percentile(Val, 5), 2) by bin(TimeGenerated, (now() - ago(7d))/100), ResourceName", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Available Memory (Last Week)", "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 4, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated > ago(7d) \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer P95th = round(percentile(Val, 95), 2) by Computer, Name\r\n | top 10 by P95th desc);\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer: string, NodeId: string, NodeProps: dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = VMComputer\r\n | extend ResourceId=strcat('machines/', Machine)\r\n | extend Bitness=columnifexists('Bitness', '')\r\n | where TimeGenerated > ago(7d)\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend\r\n AzureCloudServiceNodeIdentity = iif(isnotempty(AzureCloudServiceName), strcat(AzureCloudServiceInstanceId, '|', AzureCloudServiceDeployment), ''),\r\n AzureScaleSetNodeIdentity = iif(isnotempty(AzureVmScaleSetName), strcat(AzureVmScaleSetInstanceId, '|', AzureVmScaleSetDeployment), ''),\r\n ComputerProps = pack('type', 'StandAloneNode', 'name', Computer, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId, 'resourceGroup', AzureResourceGroup, 'azureResourceId', columnifexists('_ResourceId', '')),\r\n AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', AzureCloudServiceInstanceId, 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName', ''), 'cloudServiceDeploymentId', AzureCloudServiceDeployment, 'cloudServiceName', AzureCloudServiceName, 'mappingResourceId', ResourceId),\r\n AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('Computer', ''), 'vmScaleSetDeploymentId', AzureVmScaleSetDeployment, 'vmScaleSetName', AzureVmScaleSetName, 'serviceFabricClusterName', AzureServiceFabricClusterName, 'vmScaleSetResourceId', AzureVmScaleSetResourceId, 'resourceGroupName', columnifexists('AzureResourceGroup', ''), 'subscriptionId', columnifexists('AzureSubscriptionId', ''), 'mappingResourceId', ResourceId)\r\n | project\r\n Computer,\r\n NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer),\r\n NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps),\r\n Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true\r\n EmptyNodeIdentityAndProps,\r\n OmsNodeIdentityAndProps,\r\n ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n| where TimeGenerated > ago(7d)\r\n| where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n| where Computer in (computerList)\r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n| summarize P95th = round(percentile(Val, 95), 2) by bin(TimeGenerated, (now() - ago(7d)) / 100), ResourceName", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Bytes Sent Rate (Last Week)", "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated > ago(7d) \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer P95th = round(percentile(Val, 95), 2) by Computer, Name\r\n | top 10 by P95th desc);\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer: string, NodeId: string, NodeProps: dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = VMComputer\r\n | extend ResourceId=strcat('machines/', Machine)\r\n | extend Bitness=columnifexists('Bitness', '')\r\n | where TimeGenerated > ago(7d)\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend\r\n AzureCloudServiceNodeIdentity = iif(isnotempty(AzureCloudServiceName), strcat(AzureCloudServiceInstanceId, '|', AzureCloudServiceDeployment), ''),\r\n AzureScaleSetNodeIdentity = iif(isnotempty(AzureVmScaleSetName), strcat(AzureVmScaleSetInstanceId, '|', AzureVmScaleSetDeployment), ''),\r\n ComputerProps = pack('type', 'StandAloneNode', 'name', Computer, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId, 'resourceGroup', AzureResourceGroup, 'azureResourceId', columnifexists('_ResourceId', '')),\r\n AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', AzureCloudServiceInstanceId, 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName', ''), 'cloudServiceDeploymentId', AzureCloudServiceDeployment, 'cloudServiceName', AzureCloudServiceName, 'mappingResourceId', ResourceId),\r\n AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('Computer', ''), 'vmScaleSetDeploymentId', AzureVmScaleSetDeployment, 'vmScaleSetName', AzureVmScaleSetName, 'serviceFabricClusterName', AzureServiceFabricClusterName, 'vmScaleSetResourceId', AzureVmScaleSetResourceId, 'resourceGroupName', columnifexists('AzureResourceGroup', ''), 'subscriptionId', columnifexists('AzureSubscriptionId', ''), 'mappingResourceId', ResourceId)\r\n | project\r\n Computer,\r\n NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer),\r\n NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps),\r\n Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true\r\n EmptyNodeIdentityAndProps,\r\n OmsNodeIdentityAndProps,\r\n ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n| where TimeGenerated > ago(7d)\r\n| where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n| where Computer in (computerList)\r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n| summarize P95th = round(percentile(Val, 95), 2) by bin(TimeGenerated, (now() - ago(7d)) / 100), ResourceName", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Bytes Recieved Rate (Last Week)", "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "query - 6" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_1Visible", "comparison": "isEqualTo", "value": "true" }, "name": "System Status", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Raw & Metadata - Filtering Events](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [EmailAttachmentInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailattachmentinfo) 🔷 [EmailUrlInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailurlinfo) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Email Filtering, Spam, and Phishing | Raw and Metadata - Filtering Events • Date and Time • Sent from Sender, from Sender • Recipient • Subject • Email Headers • Rule Triggered – Log of Policies along with Actual Values Including but Not Limited to: o DNS Records o Phish Campaign Identifier o Domain URL | Log, Email Attachments | 2 | 12 Months Active Storage, 18 Months Cold Storage | 39 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_2", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_2", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_2", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_2}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| join kind=leftanti(EmailAttachmentInfo) on NetworkMessageId\r\n| join kind=leftanti(EmailUrlInfo) on NetworkMessageId\r\n| project TimeGenerated, SenderMailFromAddress, RecipientEmailAddress, EmailDirection, Subject, NetworkMessageId, DeliveryAction, EmailActionPolicy, OrgLevelPolicy, ConfidenceLevel, ThreatTypes\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n\r\n", "size": 0, "title": "Email: Raw & Metadata Filtering Events (Microsoft Defender for Office365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where OfficeWorkload == \"Exchange\"\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n| extend Packed=pack_all(true)\r\n| project Packed\r\n| evaluate bag_unpack(Packed)\r\n\r\n", "size": 0, "title": "Exchange Logs (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_2Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Raw & Metadata - Filtering Events", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Data Loss Prevention](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### References\r\n💡 [Logging and analyzing the protection usage from Azure Information Protection](https://docs.microsoft.com/azure/information-protection/log-analyze-usage)
\r\n💡 [Analytics and central reporting for Azure Information Protection](https://docs.microsoft.com/azure/information-protection/reports-aip#how-to-modify-the-reports-and-create-custom-queries)
\r\n💡 [Azure Information Protection Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-information-protection)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Information Protection", "style": "secondary", "bladeOpenContext": { "bladeName": "DataClassGroupEditBlade", "extensionName": "Microsoft_Azure_InformationProtection" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Data Loss Prevention | • Date and Time • Source Hostname o IP o Port • Destination Hostname o IPo Port • Description of Malicious Code or Action and Severity • Identity or Identifier of the File(s) • Description of the Action Taken (Clean, Quarantine, Delete) • Signature Updates | Log, Email Attachments | 2 | 12 Months Active Storage, 18 Months Cold Storage | 39 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_3", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_3", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_3", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_3}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InformationProtectionLogs_CL\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Data Loss Prevention Logs (Azure Information Protection)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_3Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Data Loss Prevention", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Full Packet Capture Data](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### References\r\n💡 [Virtual network TAP](https://docs.microsoft.com/azure/virtual-network/virtual-network-tap-overview)
\r\n💡 [Virtual network TAP partner solutions](https://docs.microsoft.com/azure/virtual-network/virtual-network-tap-overview#virtual-network-tap-partner-solutions)
\r\n💡 [Manage packet captures with Azure Network Watcher using the portal](https://docs.microsoft.com/azure/network-watcher/network-watcher-packet-capture-manage-portal)
\r\n💡 [Use packet capture for proactive network monitoring with alerts and Azure Functions](https://docs.microsoft.com/azure/network-watcher/network-watcher-alert-triggered-packet-capture)
\r\n💡 [Traffic Analytics](https://docs.microsoft.com/azure/networking/network-monitoring-overview#traffic-analytics)
\r\n\r\n### Microsoft Portals" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Network Watcher", "style": "secondary", "bladeOpenContext": { "bladeName": "NetworkWatcherMenuBlade", "extensionName": "Microsoft_Azure_Network" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Network Traffic | Full Packet Capture Data • Decrypted Plaintext • Cleartext | Log, Email Attachments | 2 | 72 Hours Packet Capture | 39 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_4", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_4", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_4", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_4}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 1, "content": { "json": "![Image Name](https://docs.microsoft.com/azure/virtual-network/media/virtual-network-tap/architecture.png) " }, "customWidth": "50", "name": "text - 2" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_4Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Full Packet Capture Data", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Commerical Off the Shelf (COTS), Non-COTS, & Custom Applications](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [resources](https://docs.microsoft.com/azure/azure-monitor/app/app-insights-overview) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [What is Application Insights?](https://docs.microsoft.com/azure/azure-monitor/app/app-insights-overview)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Application Level | • Commercial Off the Shelf (COTS) and Custom Applications • User Authentication (Success/Failure) • User and Administrator Application Use: o File and Object Access o Audit Log Access (Success/Failure) o System Access (Failure) o Application Transactions (Web Page Hits, Email Sent/Received, File Transfers Completed) • Transaction Logs • System Performance and Operational Characteristics o Resource Utilization o Process Status o Errors (Input Validation, DisAllowed Operations) o System Events o Service Status Changes (e.g., Started, Stopped) • Application Configuration and Version | Log, Application Monitoring Dashboards | 2 | 12 Months Active Storage, 18 Months Cold Data Storage | 40-41 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_5", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_5", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_5", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_5}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", "version": "KqlParameterItem/1.0", "name": "Apps", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "where type =~ 'microsoft.insights/components'\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": [ "value::5" ], "typeSettings": { "resourceTypeFilter": { "microsoft.insights/components": true }, "limitSelectTo": 5, "additionalResourceOptions": [ "value::5" ], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "9fb8e529-2818-4000-bdf0-48808de48eb7", "version": "KqlParameterItem/1.0", "name": "Metric", "type": 2, "isRequired": true, "value": "percentile(duration, 99)", "jsonData": "[\r\n { \"value\":\"avg(duration)\", \"label\":\"Mean\", \"selected\":true},\r\n { \"value\":\"percentile(duration, 50)\", \"label\":\"Median\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 80)\", \"label\":\"p80\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 95)\", \"label\":\"p95\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 99)\", \"label\":\"p99\", \"selected\":false}\r\n]" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| project AppDisplayName, UserPrincipalName, Category, ResultType, ResultDescription, TimeGenerated\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Application Authentications (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CloudAppEvents \r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Application Events (Microsoft 365 Defender)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let apps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nrequests\r\n| summarize Metric = {Metric}, Count = count() by appName\r\n| join kind = inner (\r\n requests\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by appName\r\n) on appName\r\n| project-away appName1, timestamp\r\n| join kind = fullouter (apps) on appName\r\n| extend appName = appName1, Metric = iff(appName == '', 0.0, Metric), Count = iff(appName == '', 0, Count), Trend = iff(appName == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend)\r\n| extend MetricKind = '{Metric:label}', Relevance = Metric * Count\r\n| order by Relevance desc\r\n", "size": 3, "title": "Application Performance (Azure Monitor: Application Insights)", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "appName", "formatter": 1, "formatOptions": { "showIcon": true } }, "subtitleContent": { "columnMatch": "MetricKind", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Metric", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 23, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "showIcon": true } }, "showBorder": false } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let appCount = 5;\r\nlet requestCount = 5;\r\nlet selectedApps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nlet topItems = requests\r\n| top-nested appCount of appName by AppMetric = {Metric} * count() desc, top-nested requestCount of name by RequestMetric = {Metric} * count() desc;\r\nlet topApps = topItems | summarize by appName;\r\nlet topRequests = topItems | summarize by strcat(appName, '::', name);\r\nlet rawData = requests\r\n| extend name = iff(strcat(appName, '::', name) in (topRequests), name, 'Other Requests'), appName = iff(appName in (topApps), appName, 'Other Apps');\r\nlet apps = rawData\r\n| summarize Metric = {Metric}, Count = count(), Users = dcount(user_Id) by appName\r\n| project Id = appName, ParentId = '', Name = strcat('☁️ ', appName), Kind = 'Application', Metric, Count, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = appName\r\n) on Id\r\n| project-away Id1, timestamp\r\n| join kind = fullouter (selectedApps) on $left.Id == $right.appName\r\n| extend Id = appName, Name = strcat('☁️ ', appName), Kind = 'Application', Metric = iff(Id == '', 0.0, Metric), Count = iff(Id == '', 0, Count), Users = iff(Id == '', 0, Users), Trend = iff(Id == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend);\r\nlet requests = rawData\r\n| summarize Metric = {Metric}, Count = count(), Users = dcount(user_Id) by appName, name\r\n| project Id = strcat(appName, '::', name), ParentId = appName, Name = strcat('🌐 ', name), Kind = 'Request', Metric, Count, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = strcat(appName, '::', name)\r\n) on Id\r\n| project-away Id1, timestamp;\r\nrequests\r\n| union (apps)\r\n| extend Rank = iff(Name contains 'Other Apps' or Name contains 'Other Requests', 2, 1), \r\n Relevance = Metric * Count\r\n| order by Rank asc, Relevance desc\r\n| project Id, ParentId, Name, Kind, {Metric:label} = Metric, ['Trend'] = Trend, Count, Users", "size": 0, "title": "Application Usage (Azure Monitor: Application Insights)", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "exportParameterName": "Row", "exportDefaultValue": "{}", "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "gridSettings": { "formatters": [ { "columnMatch": "Id", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "ParentId", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "Mean|Median|p80|p95|p99", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 23, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true } }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "min": 0, "palette": "green", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Users", "formatter": 8, "formatOptions": { "min": 0, "palette": "yellow", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true, "hierarchySettings": { "idColumn": "Id", "parentColumn": "ParentId", "treeType": 0, "expanderColumn": "Name", "expandTopLevel": true } }, "tileSettings": { "titleContent": { "columnMatch": "appName", "formatter": 1, "formatOptions": { "showIcon": true } }, "subtitleContent": { "columnMatch": "MetricKind", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Metric", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 23, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "showIcon": true } }, "showBorder": false } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(real) limit 1000\r\n| project timestamp, {Metric:label} = Metric", "size": 0, "showAnalytics": true, "title": "Applicaton Request Duration (Azure Monitor: Application Insights)", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "visualization": "areachart" }, "customWidth": "50", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = count() default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(real) limit 1000\r\n| project timestamp, ['Request Counts'] = Metric", "size": 0, "showAnalytics": true, "title": "Application Request Count (Azure Monitor: Application Insights)", "color": "green", "noDataMessage": "The Application Insights resource you selected has no data.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.insights/components", "crossComponentResources": [ "{Apps}" ], "visualization": "areachart" }, "customWidth": "50", "name": "query - 9" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_5Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Commerical Off the Shelf (COTS) & Custom Applications", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Container - Image](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [ContainerInventory](https://docs.microsoft.com/azure/azure-monitor/reference/tables/containerinventory) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Kubernetes Service (AKS)](https://azure.microsoft.com/services/kubernetes-service/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Retrieve container logs and events in Azure Container Instances](https://docs.microsoft.com/azure/container-instances/container-instances-get-logs)
\r\n💡 [Monitor container resources in Azure Container Instances](https://docs.microsoft.com/azure/container-instances/container-instances-monitor)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "86fe2486-bd04-4a36-af37-f51978094adc", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Azure Kubernetes Service", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKubernetes" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Container - Image | • Vulnerability Scan Log • Hash of the Binary • Hash of the Executables • Container-Aware Network Monitoring • Container-Aware Process Monitoring • Container-Aware Malware Detection • Filesystem Changes Log • Data Monitoring • Read and/or Writes to Well\u0002Known Directories (e.g., /ETC, /USR/BIN, USR/SBIN, etc.) • Creating Symlink • Changes in File/Resource Ownership or Mode Changes (CHMOD) • Access Control Log • Runtime Vulnerability Scan Log Scan for Malware Log • Digital Signature Verification • Unexpected Network Connections or Socket Mutations • Spawned Processes Using Things Like 'Execve' • Executing Shell and/or SSH Binaries | Log, File, Script | 2 | 12 Months Active Storage, 18 Months Cold Data Storage | 41 |\r\n| Container - Management / Orchestration | • Audit Log • Account Access Log • Account Permission Changes • Configuration Log • Resource Allocation and Consumption • Registration Changes | Log, Application Monitoring Dashboards | 2 | 12 Months Active Storage, 18 Months Cold Data Storage | 42 |\r\n| Container - OS| • User and Administrator Access to OS Components and Applications o File and Object Access o Audit Log Access (Success/Failure) o System Access and Log Off (Success/Failure) o Privilege Access and Log Off (Success/Failure) o RDP Access and Log Off (Success/Failure) o SMB Access • System Performance and Operational Characteristics o Resource Utilization, Process Status o System Events o Service Status Changes (Start, Stop, Fail, Restart, etc.) o Service Failures and Restarts o Process Creation and Termination • System Configuration o Changes to Security Configuration (Success/Failure) o Audit Log Cleared o Changes to Accounts User or Group Management Changes o Scheduled Task Changes • File Access o Transfer of Data to External Media • Powershell Execution Commands • WMI Events • Registry Access • Command-Line Interface (CLI) | Log | 2 | 12 Months Active Storage, 18 Months Cold Data Storage | 42-43 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_6", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_6", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_6", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL2_6}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| extend RemediationLink = strcat(\"https://\",RecommendationLink)\r\n| summarize arg_max(TimeGenerated, *) by RecommendationDisplayName, AssessedResourceId\r\n| where RecommendationState == \"Unhealthy\"\r\n| project ResourceID=AssessedResourceId, RecommendationName=RecommendationDisplayName, MaturityLevel, Severity=RecommendationSeverity, RecommendationState, RemediationLink, DiscoveredDate=StatusChangeDate\r\n| parse RemediationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| where RecommendationName contains \"container\" or RecommendationName contains \"kube\" or RecommendationName contains \"pod\"\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "title": "Container Recommendations (Microsoft Defener for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Run query to see results.\r\nresources\r\n| where type in~ (\"microsoft.kubernetes/connectedclusters\", \"microsoft.containerservice/managedclusters\")\r\n| extend kubernetesVersion = properties.kubernetesVersion\r\n| project id, name, type, location, resourceGroup, tags, kind, kubernetesVersion\r\n| extend typeDisplayName=case(type =~ 'microsoft.containerservice/managedclusters','Kubernetes service',type =~ 'microsoft.kubernetes/connectedclusters','Kubernetes - Azure Arc',type)\r\n| extend locationDisplayName=case(location =~ 'eastus','East US',location =~ 'eastus2','East US 2',location =~ 'southcentralus','South Central US',location =~ 'westus2','West US 2',location =~ 'westus3','West US 3',location =~ 'australiaeast','Australia East',location =~ 'southeastasia','Southeast Asia',location =~ 'northeurope','North Europe',location =~ 'swedencentral','Sweden Central',location =~ 'uksouth','UK South',location =~ 'westeurope','West Europe',location =~ 'centralus','Central US',location =~ 'northcentralus','North Central US',location =~ 'westus','West US',location =~ 'southafricanorth','South Africa North',location =~ 'centralindia','Central India',location =~ 'eastasia','East Asia',location =~ 'japaneast','Japan East',location =~ 'jioindiawest','Jio India West',location =~ 'koreacentral','Korea Central',location =~ 'canadacentral','Canada Central',location =~ 'francecentral','France Central',location =~ 'germanywestcentral','Germany West Central',location =~ 'norwayeast','Norway East',location =~ 'switzerlandnorth','Switzerland North',location =~ 'uaenorth','UAE North',location =~ 'brazilsouth','Brazil South',location =~ 'centralusstage','Central US (Stage)',location =~ 'eastusstage','East US (Stage)',location =~ 'eastus2stage','East US 2 (Stage)',location =~ 'northcentralusstage','North Central US (Stage)',location =~ 'southcentralusstage','South Central US (Stage)',location =~ 'westusstage','West US (Stage)',location =~ 'westus2stage','West US 2 (Stage)',location =~ 'asia','Asia',location =~ 'asiapacific','Asia Pacific',location =~ 'australia','Australia',location =~ 'brazil','Brazil',location =~ 'canada','Canada',location =~ 'europe','Europe',location =~ 'france','France',location =~ 'germany','Germany',location =~ 'global','Global',location =~ 'india','India',location =~ 'japan','Japan',location =~ 'korea','Korea',location =~ 'norway','Norway',location =~ 'southafrica','South Africa',location =~ 'switzerland','Switzerland',location =~ 'uae','United Arab Emirates',location =~ 'uk','United Kingdom',location =~ 'unitedstates','United States',location =~ 'eastasiastage','East Asia (Stage)',location =~ 'southeastasiastage','Southeast Asia (Stage)',location =~ 'westcentralus','West Central US',location =~ 'southafricawest','South Africa West',location =~ 'australiacentral','Australia Central',location =~ 'australiacentral2','Australia Central 2',location =~ 'australiasoutheast','Australia Southeast',location =~ 'japanwest','Japan West',location =~ 'jioindiacentral','Jio India Central',location =~ 'koreasouth','Korea South',location =~ 'southindia','South India',location =~ 'westindia','West India',location =~ 'canadaeast','Canada East',location =~ 'francesouth','France South',location =~ 'germanynorth','Germany North',location =~ 'norwaywest','Norway West',location =~ 'switzerlandwest','Switzerland West',location =~ 'ukwest','UK West',location =~ 'uaecentral','UAE Central',location =~ 'brazilsoutheast','Brazil Southeast',location)\r\n| where (type !~ ('dynatrace.observability/monitors'))\r\n| where (type !~ ('nginx.nginxplus/nginxdeployments'))\r\n| where (type !~ ('microsoft.agfoodplatform/farmbeats'))\r\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints'))\r\n| where (type !~ ('microsoft.cdn/profiles/customdomains'))\r\n| where (type !~ ('microsoft.cdn/profiles/origingroups'))\r\n| where (type !~ ('microsoft.cdn/profiles/rulesets'))\r\n| where (type !~ ('microsoft.cdn/profiles/secrets'))\r\n| where (type !~ ('microsoft.cdn/profiles/securitypolicies'))\r\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints/routes'))\r\n| where (type !~ ('microsoft.cdn/profiles/origingroups/origins'))\r\n| where (type !~ ('microsoft.cdn/profiles/rulesets/rules'))\r\n| where (type !~ ('microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\r\n| where (type !~ ('microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\r\n| where (type !~ ('microsoft.portal/extensions/deployments'))\r\n| where (type !~ ('microsoft.portal/extensions'))\r\n| where (type !~ ('microsoft.portal/extensions/slots'))\r\n| where (type !~ ('microsoft.portal/extensions/versions'))\r\n| where (type !~ ('microsoft.datacollaboration/workspaces'))\r\n| where (type !~ ('microsoft.azurestack/registrations'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters/sessionclusters'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools'))\r\n| where (type !~ ('microsoft.hpcworkbench/instances'))\r\n| where (type !~ ('microsoft.connectedvmwarevsphere/vcenters'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/assets'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/tests'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/executionplans'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/testplans'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins'))\r\n| where not((type =~ ('microsoft.network/serviceendpointpolicies')) and ((kind =~ ('internal'))))\r\n| where (type !~ ('microsoft.openlogisticsplatform/workspaces'))\r\n| where (type !~ ('microsoft.scom/managedinstances'))\r\n| where (type !~ ('microsoft.orbital/spacecrafts/contacts'))\r\n| where (type !~ ('microsoft.orbital/contactprofiles'))\r\n| where (type !~ ('microsoft.orbital/edgesites'))\r\n| where (type !~ ('microsoft.orbital/groundstations'))\r\n| where (type !~ ('microsoft.orbital/l2connections'))\r\n| where (type !~ ('microsoft.orbital/spacecrafts'))\r\n| where (type !~ ('microsoft.azurepercept/accounts'))\r\n| where (type !~ ('microsoft.playfab/playeraccountpools'))\r\n| where (type !~ ('microsoft.playfab/playfabresources'))\r\n| where (type !~ ('microsoft.playfab/titles'))\r\n| where (type !~ ('microsoft.recommendationsservice/accounts/modeling'))\r\n| where (type !~ ('microsoft.recommendationsservice/accounts/serviceendpoints'))\r\n| where (type !~ ('microsoft.recoveryservicesbvtd2/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesbvtd/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesintd/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesintd2/vaults'))\r\n| where (type !~ ('providers.test/statefulibizaengines'))\r\n| where (type !~ ('microsoft.datareplication/replicationvaults'))\r\n| where (type !~ ('microsoft.storagecache/amlfilesystems'))\r\n| where not((type =~ ('microsoft.synapse/workspaces/sqlpools')) and ((kind =~ ('v3'))))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks'))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/sites'))\r\n| where (type !~ ('microsoft.mobilenetwork/packetcorecontrolplanes'))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/services'))\r\n| where (type !~ ('microsoft.mobilenetwork/sims'))\r\n| where not((type =~ ('microsoft.sql/servers/databases')) and ((kind in~ ('system','v2.0,system','v12.0,system','v12.0,user,datawarehouse,gen2,analytics'))))\r\n| where not((type =~ ('microsoft.sql/servers')) and ((kind =~ ('v12.0,analytics'))))\r\n| where (type in~ ('Microsoft.ContainerService/managedClusters','Microsoft.Kubernetes/connectedClusters'))\r\n| project name,typeDisplayName,resourceGroup,kubernetesVersion,locationDisplayName,id,type,kind,location,tags\r\n| sort by (tolower(tostring(name))) asc", "size": 0, "showAnalytics": true, "title": "Container Image Details (Azure Resource Graph)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where ResourceProviderValue == \"MICROSOFT.CONTAINERSERVICE\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Container Activity Logs (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n| where ResourceProvider == \"MICROSOFT.CONTAINERSERVICE\"\r\n| project TenantId, TimeGenerated, ResourceId, Category, ResourceGroup, SubscriptionId, ResourceProvider, Resource, ResourceType, OperationName\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Container Diagnostics (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| extend ResourceName = tostring(TargetResources[0].displayName)\r\n| where ResourceName <> \"\"\r\n| join kind=leftouter (AzureActivity| where ResourceProviderValue == \"MICROSOFT.CONTAINERSERVICE\" | extend ResourceName = tostring(parse_json(Properties).resource) | where ResourceName <> \"\") on ResourceName\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Container Asset Audit Logs (Azure Monitor)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 7" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2_7Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Container - Image", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL2Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Intermediate Event Logging (EL2)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Advanced Log Event Management (EL3)](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n---\r\nLogging requiremetns at all criticality levels are met. The agency and all its components meet the following requirements, as detailed in in Table 4 (EL3 Advanced Requirements) within Appendix A (Implementation and Centralized Access Requirements). Requirements Include: Meeting EL2 maturity level, Advanced Logging Categories, Logging Orchestration, Automation, and Response – Finalizing Implementation, User Behavior Monitoring – Finalizing Implementation, Application Container Security, Operations, and Management, and Advanced Centralized Access." }, "customWidth": "40", "name": "EL3 Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"\\t[\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Software Updates\\\", \\\"tab\\\": \\\"EL3_1\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Spam Dictionary Modifications\\\", \\\"tab\\\": \\\"EL3_2\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Mainframes\\\", \\\"tab\\\": \\\"EL3_3\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Container - Cluster/Pod Events\\\", \\\"tab\\\": \\\"EL3_4\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Logging Orchestration, Automation & Response\\\", \\\"tab\\\": \\\"EL3_5\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"User Behavior Monitoring\\\", \\\"tab\\\": \\\"EL3_6\\\" },\\r\\n\\t\\t{ \\\"Requirements\\\": \\\"Application Container Security\\\", \\\"tab\\\": \\\"EL3_7\\\" }\\r\\n\\t]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Section", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Event Logging Tiers", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a30d01d0-38f1-4a91-9cf6-cdb181d676b5", "version": "KqlParameterItem/1.0", "name": "isEL3_1Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_1", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isEL3_2Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_2", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "2609fc0f-e8de-4955-9c65-6a901ba74088" }, { "version": "KqlParameterItem/1.0", "name": "isEL3_3Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_3", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "c4e803dc-56c8-4732-b207-5cddcb6d0a08" }, { "version": "KqlParameterItem/1.0", "name": "isEL3_4Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_4", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "7b362e8d-6cb2-4a82-ae58-b345af2e8a39" }, { "version": "KqlParameterItem/1.0", "name": "isEL3_5Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_5", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "ca37f85e-79c5-44bf-9f80-b58a6ac6a491" }, { "version": "KqlParameterItem/1.0", "name": "isEL3_6Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_6", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "44294a7c-42db-4769-8f21-7fd81459781b" }, { "version": "KqlParameterItem/1.0", "name": "isEL3_7Visible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "EL3_7", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "e1bb5e69-df08-4117-a276-4535973d4230" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Software Updates](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [Update](https://docs.microsoft.com/azure/azure-monitor/reference/tables/update) ✳️ [Automation](https://azure.microsoft.com/services/automation/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Azure Automation update management](https://docs.microsoft.com/azure/architecture/hybrid/azure-update-mgmt)
\r\n💡 [Use asset inventory to manage your resources' security posture](https://docs.microsoft.com/azure/defender-for-cloud/asset-inventory#access-a-software-inventory)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "AutoManage", "style": "secondary", "bladeOpenContext": { "bladeName": "AutomanageMenuBlade", "extensionName": "Microsoft_Azure_AutoManagedVirtualMachines" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| System & Configuration Performance | Software Updates • User Agent | Log, Database Record, Script | 3 | 12 Months Active Storage, 18 Months Cold Storage | 43 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_1", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_1", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_1", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_1}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Update\r\n| project _ResourceId, Classification, Title, PublishedDate, KBID, RevisionNumber, Optional, RebootBehavior, Approved, ApprovalSource, ProductVersion, PackageRepository, Type, ResourceGroup, ResourceType, OSType, ProductArch, CVENumbers, UpdateState, Product, SourceSystem, TimeGenerated\r\n| where Classification <> \"Others\"\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "title": "Updates (Azure Automation Update Management)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| extend RemediationLink = strcat(\"https://\",RecommendationLink)\r\n| summarize arg_max(TimeGenerated, *) by RecommendationDisplayName, AssessedResourceId\r\n| where RecommendationState == \"Unhealthy\"\r\n| project ResourceID=AssessedResourceId, RecommendationName=RecommendationDisplayName, MaturityLevel, Severity=RecommendationSeverity, RecommendationState, RemediationLink, DiscoveredDate=StatusChangeDate\r\n| parse RemediationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| where RecommendationName contains \"update\"\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "title": "Update Recommendations (Microsoft Defender for Cloud)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_1Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Software Updates", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Spam Dictionary Modifications](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) 🔷 [EmailEvents](https://docs.microsoft.com/microsoft-365/security/defender/advanced-hunting-emailevents-table) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### References\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n💡 [Configure anti-spam policies in EOP](https://docs.microsoft.com/microsoft-365/security/office-365-security/configure-your-spam-filter-policies)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft 365 Defender", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "Office 365", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Office365" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Email Filtering, Spam, and Phishing | Spam Dictionary Modifications | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 43 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_2", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_2", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_2", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_2}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where RecordType == \"ExchangeAdmin\"\r\n| where Operation contains \"policy\"\r\n| where Operation !contains \"access\"\r\n| project Operation, RecordType, UserId, UserType, OfficeWorkload, ResultStatus, Parameters, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Exchange Policy Changes (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| where ConfidenceLevel contains \"spam\" or DetectionMethods contains \"spam\" or DeliveryAction == \"Junked\"\r\n| summarize count() by ConfidenceLevel, DetectionMethods, DeliveryAction, EmailActionPolicy\r\n| sort by count_ desc", "size": 0, "title": "Configured Spam Filtering Policies (Microsoft 365)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_2Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Spam Dictionary Modifications", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Mainframes](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### References\r\n💡 [Mainframe rehosting on Azure virtual machines](https://docs.microsoft.com/azure/virtual-machines/workloads/mainframe-rehosting/overview)
\r\n💡 [Mainframe and midrange migration](https://azure.microsoft.com/migration/mainframe/#overview)
\r\n💡 [Hybrid Security Monitoring using Microsoft Defender for Cloud and Microsoft Sentinel](https://docs.microsoft.com/azure/architecture/hybrid/hybrid-security-monitoring)
\r\n\r\n\r\n" }, "customWidth": "50", "name": "LT-1", "styleSettings": { "maxWidth": "50" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Mainframes | • Syslog & Syslogd Data • Log4j Data • Sysout Data Resource Measurement Facility (RMF) Data • System Management Facility (SMF)16 • Output from Integrated Intrusion Detection Services | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 43 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_3", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_3", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_3", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_3}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 1, "content": { "json": "## ✳️ [Hybrid Security Monitoring](https://docs.microsoft.com/azure/architecture/hybrid/hybrid-security-monitoring)\r\n\r\n![ImageName](https://docs.microsoft.com/azure/architecture/hybrid/images/hybrid-security-monitoring.png)" }, "customWidth": "45", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "5", "name": "text - 4" }, { "type": 1, "content": { "json": "## ✳️ [Mainframe Rehosting on Azure](https://docs.microsoft.com/azure/virtual-machines/workloads/mainframe-rehosting/overview)\r\n\r\n![ImageName](https://docs.microsoft.com/azure/virtual-machines/workloads/mainframe-rehosting/media/01-overview.png)" }, "customWidth": "40", "name": "text - 2 - Copy" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_3Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Mainframes", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Container - Cluster/Pod Events](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Kubernetes Service (AKS)](https://azure.microsoft.com/services/kubernetes-service/) ✳️ [Container Instances](https://azure.microsoft.com/services/container-instances/) ✳️ [Azure Red Hat OpenShift](https://azure.microsoft.com/services/openshift/)
\r\n\r\n### References\r\n💡 [Monitoring a microservices architecture in Azure Kubernetes Service (AKS)](https://docs.microsoft.com/azure/architecture/microservices/logging-monitoring)
\r\n💡 [How to query logs from Container insights](https://docs.microsoft.com/azure/azure-monitor/containers/container-insights-log-query)
\r\n💡 [Microsoft Sentnel Azure Kubernetes Service Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-kubernetes-service-aks)
\r\n\r\n### Microsoft Portals\r\n\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "Azure Kubernetes Service", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKubernetes" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Container - Cluster/Pod Events | • Container User and Service Logs • Container and Application API Audit Logs • Container Management Access Logs • Changes to Container Resources Across Containers and Container Management Environment | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 44 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_4", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_4", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_4", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_4}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDiagnostics\r\n| where ResourceProvider == \"MICROSOFT.CONTAINERSERVICE\"\r\n| extend Cluster = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(log_s).responseObject)).metadata)).labels)).[\"kubernetes.azure.com/cluster\"])\r\n| where Cluster <> \"\"\r\n| project Cluster, log_s, ResourceId, Category, ResourceGroup, SubscriptionId, ResourceProvider, TenantId, Resource, ResourceType, OperationName, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Container - Cluster/Pod Events", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_4Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Container - Cluster/Pod Events", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Logging Orchestration, Automation & Response](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### References\r\n💡 [Tutorial: Setup Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\r\n💡 [Set up Azure Monitor logs and collect diagnostics data for Azure Logic Apps](https://docs.microsoft.com/azure/logic-apps/monitor-logic-apps-log-analytics)
\r\n\r\n### Microsoft Portals\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring" } }, { "id": "5376f148-0433-412d-ae31-3f20e2bc0435", "linkTarget": "OpenBlade", "linkLabel": "Automation", "style": "secondary", "bladeOpenContext": { "bladeName": "AutomationBlade", "extensionName": "Microsoft_Azure_Security_Insights" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Logging Orchestration, Automation & Response | Agencies shall finalize and implement automated hunt and incident response playbooks. Federal agencies shall also provide any updates to the playbooks and automation integrations to CISA no later than one business day after they are finalized. | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 9-10 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_5", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_5", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_5", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_5}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.logic/workflows\"\r\n| extend Connection = parse_json(properties)[\"parameters\"][\"$connections\"][\"value\"]\r\n| where Connection has \"managedApis/azuresentinel\"\r\n| project id, type, resourceGroup", "size": 0, "showAnalytics": true, "title": "Orchestration, Automation & Response (Microsoft Sentinel)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where ResourceProviderValue == \"MICROSOFT.LOGIC\"\r\n| where ActivityStatusValue == \"Success\"\r\n| extend Playbook = tostring(parse_json(Properties).resource)\r\n| summarize count() by Playbook\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Playbooks Triggered (Microsoft Sentinel)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "orangeBlue" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "name": "query - 3 - Copy", "styleSettings": { "maxWidth": "50" } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_5Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Logging Orchestration, Automation & Response", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User Behavior Monitoring](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft 365: Insider Risk Management](https://www.microsoft.com/microsoft-365/business/compliance-solutions)
\r\n\r\n### References\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Insider risk management in Microsoft 365](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-solution-overview)
\r\n💡 [Tutorial: Detect suspicious user activity with UEBA](https://docs.microsoft.com/cloud-app-security/tutorial-suspicious-activity)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Entity Behavior (UEBA)", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights" } }, { "id": "02db9ce0-e79d-4427-9e91-b72ca39da401", "linkTarget": "OpenBlade", "linkLabel": "Watchlist", "style": "secondary", "bladeOpenContext": { "bladeName": "WatchlistBlade", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "parameter", "value": "Subscription" }, { "name": "resourceGroup", "source": "parameter", "value": "DefaultSubscription_Internal" }, { "name": "workspaceName", "source": "parameter", "value": "Workspace" } ] } }, { "id": "981279fe-41f1-4dea-bd04-fe3a20994d4a", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Purview Insider Risk Management", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "OfficeIRM" } ] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| User Behavior Monitoring | User behavioral analytics must be implemented in order to allow for early detection of malicious behavior. This technology leverages machine learning and artificial intelligence techniques to detect anomalous user actions and help combat advanced threats. Agenciesshall implement a user behavior analytics capability, leveraging the logging requirements, in order identify potentially malicious or malicious activity. This capability shall monitor all user and non-user accounts. This capability shall be monitored and triaged by component\u0002and top-level agency Security Operations Centers (SOC). At a minimum, user Behavior Monitoring should be configured to detect and alert on: • Compromised user credentials • Privileged-user compromise • Improper asset access • Compromised system/host/device • Lateral movement of threat actor | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 10 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_6", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_6", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_6", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_6}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "ac6f7462-59ff-4d82-86b0-0a6eccc35a51", "version": "KqlParameterItem/1.0", "name": "UserPrincipalName", "label": "🔀 User Selector", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SigninLogs\r\n| summarize by UserPrincipalName ", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "User Selector Parameter - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//If query errors for \"where\" statement, comment out respective columns\r\nunion withsource= Table_Name *\r\n| where column_ifexists('AADEmail', '') in ({UserPrincipalName})\r\nor column_ifexists('Account', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountName', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Caller', '') in ({UserPrincipalName})\r\nor column_ifexists('CompromisedEntity', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('DisplayName', '') in ({UserPrincipalName})\r\nor column_ifexists('Email_s', '') in ({UserPrincipalName})\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('InitiatingProcessAccountUpn', '') in ({UserPrincipalName}) \r\nor column_ifexists('MailboxOwnerUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Owner', '') in ({UserPrincipalName})\r\nor column_ifexists('RecipientEmailAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('RequesterUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('SenderMailFromAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceIdentity', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('SubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUser', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('Upn', '') in ({UserPrincipalName})\r\nor column_ifexists('User_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserId_', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId_s_s', '') in ({UserPrincipalName}) \r\nor column_ifexists('userName', '') in ({UserPrincipalName})\r\nor column_ifexists('UserName', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('userPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName', '') in ({UserPrincipalName})\r\n| summarize count() by Table_Name \r\n| project-rename Log_Tables=Table_Name, Logs_Count=count_\r\n| sort by Logs_Count desc\r\n\r\n\r\n\r\n\r\n\r\n ", "size": 1, "showAnalytics": true, "title": "User Logs Summary", "color": "blue", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "tbMthlyUsage", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Log_Tables", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Logs_Count", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Other", "color": "green" } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "representation": "blueDark" } ] } } }, "customWidth": "40", "name": "Results316" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//If query errors for \"where\" statement, comment out respective columns\r\nunion withsource = Table_Name *\r\n| where column_ifexists('AADEmail', '') in ({UserPrincipalName})\r\nor column_ifexists('Account', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountName', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Caller', '') in ({UserPrincipalName})\r\nor column_ifexists('CompromisedEntity', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('DisplayName', '') in ({UserPrincipalName})\r\nor column_ifexists('Email_s', '') in ({UserPrincipalName})\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('InitiatingProcessAccountUpn', '') in ({UserPrincipalName}) \r\nor column_ifexists('MailboxOwnerUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Owner', '') in ({UserPrincipalName})\r\nor column_ifexists('RecipientEmailAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('RequesterUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('SenderMailFromAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceIdentity', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('SubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUser', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('Upn', '') in ({UserPrincipalName})\r\nor column_ifexists('User_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserId_', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId_s_s', '') in ({UserPrincipalName}) \r\nor column_ifexists('userName', '') in ({UserPrincipalName})\r\nor column_ifexists('UserName', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('userPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName', '') in ({UserPrincipalName})\r\n| project-rename Log_Tables=Table_Name\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Log_Tables\r\n| render areachart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "User Behavior Logs over Time", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Logs_Count", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "representation": "blueDark" } ] } } }, "customWidth": "60", "name": "Results316b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| distinct AlertName, ProductName, Status, AlertLink, UserPrincipalName, Tactics, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Microsoft 365: Insider Risk Management Alert Details", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indicaiton from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//witdstomstl\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignemt\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to priveleged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to priveleged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by AlertCount desc\r\n| limit 250\r\n", "size": 0, "title": "User Entity Behavior Analytics ", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let UncommonActionVolume = BehaviorAnalytics\r\n| extend UncommonActionVolume = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| where UncommonActionVolume == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename UncommonActionVolume = count_;\r\nlet UncommonAction = BehaviorAnalytics\r\n| extend UncommonAction = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| where UncommonAction == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename UncommonAction = count_;\r\nlet Uncommon = UncommonActionVolume | join(UncommonAction) on UserPrincipalName;\r\nlet FirstTimeDeviceLogon = BehaviorAnalytics\r\n| extend FirstTimeDeviceLogon = tostring(ActivityInsights.FirstTimeUserLoggedOnToDevice)\r\n| where FirstTimeDeviceLogon == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename FirstTimeDeviceLogon = count_;\r\nlet FirstTimeUserAction = BehaviorAnalytics\r\n| extend FirstTimeUserAction = tostring(ActivityInsights.FirstTimeUserPerformedAction)\r\n| where FirstTimeUserAction == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename FirstTimeUserAction = count_;\r\nlet FirstTime = FirstTimeUserAction | join(FirstTimeDeviceLogon) on UserPrincipalName;\r\nUncommon | join kind=fullouter(FirstTime) on UserPrincipalName\r\n| where UserPrincipalName <> \"\"\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| project UserPrincipalName, UncommonActionVolume, UncommonAction, FirstTimeUserAction, FirstTimeDeviceLogon\r\n| sort by UncommonActionVolume desc \r\n| limit 250\r\n\r\n", "size": 0, "title": "User Anomalies", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 8" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_6Visible", "comparison": "isEqualTo", "value": "true" }, "name": "User Behavior Monitoring", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Application Container Security, Operations, and Management ](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### References\r\n💡 [Container security in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/container-security)
\r\n💡 [Identify vulnerable container images in your CI/CD workflows](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-container-registries-cicd)
\r\n💡 [Use Microsoft Defender for container registries to scan your images for vulnerabilities](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-container-registries-usage)
\r\n💡 [Introduction to Microsoft Defender for container registries](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-container-registries-introduction)
\r\n💡 [Introduction to Microsoft Defender for Kubernetes](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-kubernetes-introduction)
\r\n\r\n### Microsoft Portals\r\n\r\n" }, "name": "LT-1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0b83c5ad-7810-4577-8c0e-457a9cc5a718", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security" } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Control Requirements\r\n| Log Category | Required Data | Format | Criticality | Retention Period | Page | \r\n|:--|:--|:--|:--|:--|:--|:--|\r\n| Application Container Security, Operations, and Management | Container security and monitoring tools should be integrated with security information and event management (SIEM) tools to ensure container-related events are captured by the enterprise. Alternatively, in cases where the uses and privileges of containers are appropriately constrained by the orchestration layer, agencies may rely on SIEM tools present at that layer. In general, Federal agencies shall ensure that their cyber hunt and incident response teams have appropriate tools and training to identify incidents within a containerized environment. | Log | 3 | 12 Months Active Storage, 18 Months Cold Storage | 10 |" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_7", "label": "Implementation Status", "type": 2, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_7", "label": "Implementation Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "NotesEL3_7", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf", "label": "Notes" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{NotesEL3_7}" }, "name": "text - 1" } ], "exportParameters": true }, "customWidth": "50", "name": "group - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityRecommendation\r\n| extend MaturityLevel=iff(RecommendationDisplayName has_any(\"agent\",\"extension\",\"retention\",\"logs encryption\",\"collect\",\"retained\",\"log profile\",\"CloudTrail\",\"metric\",\"AWS\",\"GCP\",\"DNS\",\"Auditing\",\"Flow\",\"logging\",\"usage\"), \"Event Logging (EL0)\",\r\niff(RecommendationDisplayName has_any(\"container registries\",\"logic apps\",\"Enhanced monitoring\",\"IoT Hub\",\"Event Hub\",\"App Service\", \"Kubernetes\",\"updates\",\"email\", \"automation\", \"adaptive\"), \"Advanced Event Logging (EL3)\",\r\niff(RecommendationDisplayName has_any(\"signatures\",\"CMK\",\"CMEK\",\"double encryption\",\"managed key\",\"KMS\",\"container\",\"Watcher\"), \"Intermediate Event Logging (EL2)\",\r\niff(RecommendationDisplayName has_any(\"Exploit Guard\",\"endpoint protection\",\"Antimalware\",\"health\",\"VPC\",\"Defender\",\"Vulnerabilities\",\"vulnerability\",\"diagnostic\",\"Key\",\"activity log alert\",\"\"), \"Basic Event Logging (EL1)\",\"Other\"))))\r\n| extend RemediationLink = strcat(\"https://\",RecommendationLink)\r\n| summarize arg_max(TimeGenerated, *) by RecommendationDisplayName, AssessedResourceId\r\n| where RecommendationState == \"Unhealthy\"\r\n| project ResourceID=AssessedResourceId, RecommendationName=RecommendationDisplayName, MaturityLevel, Severity=RecommendationSeverity, RecommendationState, RemediationLink, DiscoveredDate=StatusChangeDate\r\n| parse RemediationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| where RecommendationName contains \"container\" or RecommendationName contains \"kubernetes\" or RecommendationName contains \"pod\"\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "title": "Recommendation Details", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3_7Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Application Container Security, Operations, and Management ", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isEL3Visible", "comparison": "isEqualTo", "value": "true" }, "name": "Intermediate Event Logging (EL3)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Recommended Content](https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog)\r\n---\r\n\r\nThe following content packages provide utility for regulated industries use cases." }, "name": "NS Guide" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions", "linkTarget": "Url", "linkLabel": "About Microsoft Sentinel Content & Solutions", "style": "link" }, { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog", "linkTarget": "Url", "linkLabel": "Content Hub Catalog", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "40", "name": "group - 4" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "76c7831e-386d-4289-8145-486f52cba8ec", "linkTarget": "OpenBlade", "linkLabel": "Content Hub >>", "style": "secondary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS" } } ] }, "customWidth": "40", "name": "EL0" } ] }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [NIST SP 800-53 Solution](https://docs.microsoft.com/security/zero-trust/integrate/sentinel-solution)\r\n\r\n---\r\nThis solution is designed to augment staffing through automation, machine learning, query/alerting generation, and visualizations. This workbook leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align with NIST SP 800-53 control requirements. This offering telemetry from 25+ Microsoft Security products (1P/3P/Multi-Cloud/Hybrid/On-Premises). Each NIST SP 800-53 control includes a Control Card detailing an overview of requirements, primary/secondary controls, deep-links to referenced product pages/portals, recommendations, implementation guides, compliance cross-walks and tooling telemetry for building situational awareness of cloud workloads.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-nist-sp-800-53-solution/ba-p/3381485", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/ju9hxtYnj7s", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/NISTSP80053", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NISTSP80053/Workbooks/Images/NISTSP80053Black.png?raw=true)" }, "customWidth": "90", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Threat Analysis & Response Solution](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ThreatAnalysis%26Response)\r\n---\r\n\r\nThis solution enables SecOps Analysts, Threat Intelligence Professional, and Threat Hunters to gain situational awareness for threats in cloud environment. The Solution includes (2) Workbooks designed to enable threat hunting programs. Threat analysis provides an understanding of where the attacker is in the cycle which often drives both a historic lens of where the threat may have progressed, but also predictive analytics on the threat’s objectives. This approach is adversarial as understanding of the threat’s attack cycle drives defense actions in a red versus blue model. The Threat Analysis & Response Solution augments the customer burden of building threat hunting programs.\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ThreatAnalysis%26Response", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatAnalysis%26Response/Workbooks/Images/ThreatAnalysis%26ResponseWhite1.png?raw=true)" }, "customWidth": " 100", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Zero Trust (TIC 3.0) Solution](https://docs.microsoft.com/security/zero-trust/integrate/sentinel-solution)\r\n\r\n---\r\nThe Microsoft Sentinel Zero Trust (TIC 3.0) Solution provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft and partner ecosystem. This solution enables governance and compliance teams to design, build, monitor, and respond to Zero Trust (TIC 3.0) requirements across cloud, multi-cloud, 1st/3rd party workloads. The solution includes the new Zero Trust (TIC 3.0) Workbook, (1) Analytics Rule, and (3) Playbooks. While only Microsoft Sentinel and Microsoft Defender for Cloud are required to get started, the solution is enhanced with numerous Microsoft offerings.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/next-evolution-of-the-microsoft-sentinel-zero-trust-tic-3-0/ba-p/3278097", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/CxLzTRPuw-4", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ZeroTrust(TIC3.0)", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "Zero Trust Solution" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cybersecurity Maturity Model Certification (CMMC) 2.0](https://dodcio.defense.gov/CMMC/)\r\n---\r\n\r\nThis solution enables Compliance Teams, Architects, SecOps Analysts, and Consultants to gain situational awareness for cloud workload security posture. This solution is designed to augment staffing through automation, visibility, assessment, monitoring and remediation. This solution includes (1) Workbook for build/design/assessment/reporting, (2) Analytics rules for monitoring and (3) Playbooks for response/remediation. CMMC 2.0 is the next iteration of the Department’s CMMC cybersecurity model. It streamlines requirements to three levels of cybersecurity – Foundational, Advanced and Expert – and aligns the requirements at each level with well-known and widely accepted NIST cybersecurity standards.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-cybersecurity-maturity-model/ba-p/3295095", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/-_a5HxJgriE", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CybersecurityMaturityModelCertification(CMMC)2.0", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Security Benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\r\n---\r\n\r\nEnables Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Azure Security Benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/azure-security-benchmark-v3-workbook/ba-p/3257673", "linkTarget": "Url", "linkLabel": "Announce Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/v57gWjvcY4o", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "cc5f4830-f090-4f5e-afb2-47adba6be532", "cellValue": "https://youtu.be/qVJjwOipHDA", "linkTarget": "Url", "linkLabel": "ASC in the Field", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workbooks/Azure%20Security%20Benchmark%20v3", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Microsoft Insider Risk Management Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786)\r\n---\r\n\r\nInsider risk management helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft Advanced eDiscovery. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards. Insider risks come in various forms including both witting (intentional) and unwitting (unintentional). This workbook provides an automated visualization of Insider risk behavior cross walked to Microsoft security offerings.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MicrosoftPurviewInsiderRiskManagement", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IT/OT Threat Monitoring Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184)\r\n---\r\n\r\nThis solution provides the foundation for building a SOC for monitoring IoT/ OT and includes (1) workbook for visibility/reporting, (14) analytics rules for monitoring, and (4) playbooks for response. The workbook leverages Microsoft Sentinel telemetry to create visualization to understand, analyze, and respond to IoT/OT threats. Understanding alerts over time provides unprecedented insights into security posture and where teams need to focus to harden against threats. Deep links directly to Microsoft Defender for IoT alerts empower analysts to focus on remediating threats rather than pivoting between tools.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "8f7dce97-a41c-42b3-b62f-a21fbf5a1420", "cellValue": "https://youtu.be/hZS2aplJoy8", "linkTarget": "Url", "linkLabel": "YouTube Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/readme.md", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Maturity Model for Event Log Management Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\r\n---\r\n\r\nThis solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to increase visibility before, during, and after a cybersecurity incident.\"Executive Order 14028, Improving the Nation's Cybersecurity, directs decisive action to improve the Federal Government’s investigative and remediation capabilities. This memorandum was developed in accordance with and addresses the requirements in section 8 of the Executive Order for logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise security operations center (SOC) of each agency.\" For more information, see 💡[OMB's M-21-31 Memorandum](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/quV_80ts__k", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MaturityModelForEventLogManagementM2131", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Threat Intelligence Workbook](https://docs.microsoft.com/security/benchmark/azure/)\r\n---\r\n\r\nThe most commonly used form of CTI is threat indicators, also known as Indicators of Compromise or IoCs. Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it can be applied to security products and automation in large scale to detect potential threats to an organization and protect against them. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions.
\r\n\r\n---" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-azure-sentinel-threat-intelligence-workbook/ba-p/2858265", "linkTarget": "Url", "linkLabel": "Workbook Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/SjEG7iVVBbI", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/ThreatIntelligence.json", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "Zero Trust Solution - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "isGCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Recommended Content" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Lighthouse](https://azure.microsoft.com/services/azure-lighthouse/)\r\n---\r\nAzure Lighthouse helps service providers simplify customer engagement and onboarding experiences, while managing delegated resources at scale with agility and precision. Authorized users, groups, and service principals can work directly in the context of a customer subscription without having an account in that customer's Microsoft Entra ID tenant or being a co-owner of the customer's tenant. The mechanism used to support this access is called Azure delegated resource management. " }, "customWidth": "40", "name": "text - 5" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "1cf637a7-121d-4722-b511-b0c460625e31", "linkTarget": "OpenBlade", "linkLabel": "Azure Lighthouse >>", "style": "secondary", "bladeOpenContext": { "bladeName": "LighthouseBlade", "extensionName": "Microsoft_Azure_CustomerHub" } } ] }, "customWidth": "50", "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "managedservicesresources\r\n| where type == \"microsoft.managedservices/registrationassignments\"\r\n| where properties.provisioningState == \"Succeeded\"\r\n| extend ManageeTenantName = properties.registrationDefinition.properties.manageeTenantName\r\n| extend ManagedByTenantName = properties.registrationDefinition.properties.managedByTenantName\r\n| extend ManagedByTenantId = properties.registrationDefinition.properties.managedByTenantId\r\n| extend ManageeTenantId = tostring(properties.registrationDefinition.properties.manageeTenantId)\r\n| extend PermanentAccess = properties.registrationDefinition.properties.authorizations\r\n| extend JITAccess = properties.registrationDefinition.properties.eligibleAuthorizations\r\n| extend AddedDate = properties.registrationDefinition.systemData.createdAt\r\n| extend CreatedBy = systemData.createdBy\r\n| project ManageeTenantName, ManageeTenantId, ManagedByTenantName, ManagedByTenantId, AddedDate, CreatedBy", "size": 1, "showAnalytics": true, "title": "Azure Lighthouse Delegations", "noDataMessage": "No Azure Lighthouse Delegations/Customers Detected", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "ManageeTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Download", "text": "{0}{1}" } ] } }, { "columnMatch": "ManageeTenantId", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "ManagedByTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Upload", "text": "{0}{1}" } ] } }, { "columnMatch": "ManagedByTenantId", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "AddedDate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Clock", "text": "{0}{1}" } ] } }, { "columnMatch": "CreatedBy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "PermanentAccess", "formatter": 1 }, { "columnMatch": "JITAccess", "formatter": 1 } ], "filter": true } }, "name": "query - 21 - Copy" } ] }, "conditionalVisibility": { "parameterName": "isALVisible", "comparison": "isEqualTo", "value": "true" }, "name": "group - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "EL0", "loadType": "always", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "badea796-b8d1-48c5-aa6a-e79a03652f08" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "95c6ceac-92e9-454e-b2f2-e14edd4942b0" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a26bd2cc-bd61-4a29-968a-2266c288c9bd" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "74c84882-d8cc-44c0-90f7-1bd570ec4751" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a4f60d21-f6d2-4b2f-9ea4-f65ba934099f" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9ffc43fa-f9a9-46da-a037-727187e2fd25" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_8", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ae9ce6c9-dd07-487d-abdb-bde4265169b5" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_9", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "03574b5f-299f-4f16-82a6-8265e0fa0a1a" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_10", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e2c6db63-2f36-44ce-8a48-151bceaf2b0c" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_11", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "73e76a3f-24d9-4ea5-9dfe-dd3eed100639" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_12", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "39215726-d595-42e4-bcc2-e7ce7f4e44dc" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_13", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "cc8ef474-f254-4e2e-b0bf-2aecc66ad25b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_14", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "7b0e2449-2c78-4531-89a5-d971bca41dd3" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_15", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "c0d6fbf1-b403-4c82-9489-3be12557c4b4" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_16", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e935c60c-97b1-4cb8-aa6e-1c8628a2e9f6" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_17", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a7dd309f-1e2a-4e78-bf1f-bb852856aeee" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_18", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "c50676cd-5db0-4aa2-bff1-27a91a075316" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL01_20", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL01_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "99430269-ef69-444f-a191-a277bb3e7dc0" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL0_19", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL0_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "6bad20ea-e168-4bea-bf57-bf4a5f5fefb7" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b094bf32-2b67-496a-86a7-e11eccbc6b7a", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "1ba98d1d-be68-407e-89a8-0e4138c311a8" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "613493da-a51c-4bf1-bd0e-dbf359586abc" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ab66cadc-c9b4-4198-bcbf-97de004e8eab" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e06bc84e-ae34-425c-a0d2-dddcd86c07c9" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "3ea1aa09-e20c-4421-b699-f8b570314207" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "3081ae2c-2a88-48b1-9c1c-bf1191fa6db7" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_8", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "6a9b7167-de37-4263-ab4a-1bf94468a9f7" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_9", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9e0f795e-7d72-4243-8fa2-5f5709d2ad69" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_10", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "b4f367f5-9917-45d3-abb7-719b3c93f438" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_11", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "c06e61e5-309e-445a-9631-52236c2080c5" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_12", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "5d85cbde-a8f9-43c3-b70f-d9f126c204f7" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_13", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "8e401348-00d2-40fe-8c04-14435aba9977" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_14", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ee697882-5d0e-46ed-8a48-3287e24d255a" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_15", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "44ed4601-d96d-499a-8980-a0608089d081" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_16", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "bf29f612-6cbf-4ec3-b533-f795d255a67f" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_17", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "d7710dbf-8784-4cfd-b4fe-833c85191137" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_18", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ece0af98-6653-4aab-8944-b3406b9e6e61" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL0_19", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL0_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "b91d692d-cdc1-4a46-9421-079a4180b362" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL01_20", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL01_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "83c7ee3f-3d12-44a0-8ac7-83cfe7c798e1" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "31bd34c3-f085-4ca1-9a2c-957fd15e505d", "version": "KqlParameterItem/1.0", "name": "NotesEL0_1", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_2", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "13a7ebf5-c3d3-4b72-91c0-e75e929e546a" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_3", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "810a1f01-73ba-4c66-b884-f7785f475be8" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_4", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e0b74e23-f986-4aff-b222-a1983ff4aafb" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_5", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "62ad3c14-c8b0-4ac3-80cd-98e33743cb98" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_6", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "6033d997-516b-4eea-b09f-786efc38d27a" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_7", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "0925e926-bde9-4438-be37-939fe06099f6" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_8", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "1298f83f-ff06-4e8f-bbac-ffdd2b090bba" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_9", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "b733a996-56d8-4285-80f8-3311a8f019bb" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_10", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e9f357ef-ae93-48ff-8627-a935f838af02" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_11", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "340f5199-24f7-461b-9f01-39298fc66a9d" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_12", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "41f767a6-9714-4cb6-9e63-13ecffd9521a" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_13", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ede3725e-fd39-4b56-b685-2a5f453d9c42" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_14", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "2d454a13-d0a6-4d6f-ade2-ffcd6c12b89a" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_15", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "7c89112b-9a53-4923-9bc2-fa6856facec8" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_16", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "88a46aec-e624-4da7-8ded-80d94ac75bf1" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_17", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "d7710e0c-c751-4198-b959-b776c54e37ba" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_18", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e457bfd0-2269-4534-9a43-7b65dae7cbf5" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL0_19", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL0_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "68328c53-02db-417e-a33f-2c3b731d5cfe" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL01_20", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL01_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "aca0d913-975c-491a-a215-952a35b0c55d" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy - Copy" } ], "exportParameters": true }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "EL1", "loadType": "always", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "badea796-b8d1-48c5-aa6a-e79a03652f08" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "95c6ceac-92e9-454e-b2f2-e14edd4942b0" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a26bd2cc-bd61-4a29-968a-2266c288c9bd" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "74c84882-d8cc-44c0-90f7-1bd570ec4751" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a4f60d21-f6d2-4b2f-9ea4-f65ba934099f" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "398fcf6e-844b-4e3f-adfa-c6cd4b747519" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_8", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "e49cb3b4-5486-432e-b4c7-160423c38004" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_9", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "8b1006e8-9e9b-4424-8cbf-debbf90223eb" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_10", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "44ae2ace-de6f-428f-926e-daadfce5d316" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_11", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "82542d36-d468-4a24-9533-4cb03a9f4bce" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_12", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "5674a476-b21a-4d14-a9fa-f5381a881faa" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_13", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "87970b76-0e04-4804-94ad-df99b51100de" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_14", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9f86c08a-3882-4e5f-8846-fa85da4633b1" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_15", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "01524dcd-0216-4e36-8554-e04f45b5f13b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_16", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "1073052a-fe53-4d87-8145-27e4bb8fffa7" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_17", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "2521143b-1b5b-4f69-96c1-22f66c82e514" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_18", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "3d60ce7b-214f-4bc2-a15e-e1eb91fd8a4b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_19", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a4898ec2-df16-4294-a590-14978171835e" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_20", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "19364fc6-50fa-418b-8191-75038813494b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_21", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_21}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "5b9d5195-427f-4123-aba5-87417d13606f" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL1_22", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL1_22}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "1f937989-5f7f-4b07-9bc2-e6178b9317c0" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ae898bdf-6ee0-4b27-8ce7-02d5b0c5e0dc", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "4509cb50-697e-4314-b514-099b4941af11" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "0b0db6aa-7d2a-4cb5-becd-c996b0e1268b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "68a97cae-2f74-40f3-bf14-bd51e9773f92" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "cc44e3db-7792-4bdf-a704-d53f48fcefbb" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9a05b1f4-6f3b-41ec-911d-da43a59a8082" }, { "id": "694453be-42c3-4dd4-9bb2-4d1a37a3ed09", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "99369368-ab4c-45b0-8e4a-5acae1d72891", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_8", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "cfb0c9da-06b6-4d9c-99ce-6eba43fcfda2", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_9", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "dc15b416-61c2-446d-bde6-27149b34ed2d", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_10", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a044d47f-df3e-486f-a1c8-82461e4050fb", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_11", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "18ce58db-875e-429d-ac51-89409ecf2664", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_12", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "4dc457b2-ecc8-413a-85d6-225c4bc5c5b1", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_13", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "7f3f1552-3f06-4dec-866a-6257659706d4", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_14", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "d2b79e95-caac-4a36-801d-755ae35874f0", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_15", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "e8acdd2c-e698-4634-aa64-5c845ab811ed", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_16", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b0b8f48a-f7ca-4394-88c1-c0ef5ec16974", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_17", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1e70ec56-7779-4e2e-ae92-3de7069259c1", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_18", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "12d3158f-8954-4576-a38c-6b04445db7bb", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_19", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "51b53a57-818d-4798-ae41-cb6b2b7214af", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_20", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "92972838-03f3-44fc-a74c-e85085e7fe0d", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_21", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_21}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL1_22", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL1_22}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "f4c28637-c9a0-4d37-b0f2-ffbe79b6aa89" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c91625f3-a095-4547-b674-adcd6f254fc9", "version": "KqlParameterItem/1.0", "name": "NotesEL1_1", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_2", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "2d2d496b-59f6-4cf4-bee3-48ac13a5d9c0" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_3", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "5f738bdd-d025-47a8-97b0-2459b7455f6d" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_4", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "73f6e7fe-6024-4e53-8b56-1e58bbf09a67" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_5", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "dc8a4b8f-cf4b-47e5-bc56-951998cab88b" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_6", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "d2e3dc95-7a5a-42f8-b7b6-0f72993da560" }, { "id": "06b1ad08-7572-46dd-aa25-b71f458a57cb", "version": "KqlParameterItem/1.0", "name": "NotesEL1_7", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "0dd96da4-d946-4144-ba4a-d0f541c86d7e", "version": "KqlParameterItem/1.0", "name": "NotesEL1_8", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_8}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a2ae44a4-37e9-445b-b912-fe2c11c24aab", "version": "KqlParameterItem/1.0", "name": "NotesEL1_9", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_9}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "e9393791-78af-43b7-988d-39ad7dbd087b", "version": "KqlParameterItem/1.0", "name": "NotesEL1_10", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_10}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a8d2ed8e-08b3-4c5b-9f6e-e44e00a3d6a3", "version": "KqlParameterItem/1.0", "name": "NotesEL1_11", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_11}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "87be596b-43d8-485b-bce6-9eda050a7220", "version": "KqlParameterItem/1.0", "name": "NotesEL1_12", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_12}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "61f8f56a-29b4-47cb-955c-2f055628ace9", "version": "KqlParameterItem/1.0", "name": "NotesEL1_13", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_13}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f2a01918-1885-4cf3-96b0-cb48d5fd9b84", "version": "KqlParameterItem/1.0", "name": "NotesEL1_14", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_14}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "9de1c6f8-9006-4b11-bc5d-cc523f2f7690", "version": "KqlParameterItem/1.0", "name": "NotesEL1_15", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_15}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a10af883-02b8-4931-a2df-3606dd546ae7", "version": "KqlParameterItem/1.0", "name": "NotesEL1_16", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_16}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "4ba0ea7f-7b2f-4367-9307-d4b0b2623570", "version": "KqlParameterItem/1.0", "name": "NotesEL1_17", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_17}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "55a6788e-4f48-47e0-b87c-00e435a33ec3", "version": "KqlParameterItem/1.0", "name": "NotesEL1_18", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_18}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "447c88d2-7292-4e37-a77c-128ad591c505", "version": "KqlParameterItem/1.0", "name": "NotesEL1_19", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_19}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "09bba479-e2d7-4cd6-8ad2-5db05e8a956e", "version": "KqlParameterItem/1.0", "name": "NotesEL1_20", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_20}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "39207003-d6b7-4dad-98b2-e99f39cc7cb6", "version": "KqlParameterItem/1.0", "name": "NotesEL1_21", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_21}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL1_22", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL1_22}');\r\nprint VARIABLE", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "733cad49-84ad-4233-aba6-d763ced03c70" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy - Copy" } ], "exportParameters": true }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "EL2", "loadType": "always", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "badea796-b8d1-48c5-aa6a-e79a03652f08" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "95c6ceac-92e9-454e-b2f2-e14edd4942b0" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a26bd2cc-bd61-4a29-968a-2266c288c9bd" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "74c84882-d8cc-44c0-90f7-1bd570ec4751" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL2_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL2_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "a4f60d21-f6d2-4b2f-9ea4-f65ba934099f" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "fec47f95-98b7-43a6-ae69-e3f1491b3119", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9b10f3ea-744d-4b62-b746-b6b9e4a38617" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "4755ad54-dbcd-4725-bf50-fff7edc81507" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "972dfdb4-1851-40f5-9eb9-314f20f9dce8" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "c97f0e53-ddb8-4120-9af9-4940b2bafc8b" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL2_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL2_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "689403fd-a568-470e-864c-ee0d56cc0b25" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f7ce32fa-3a15-4ddb-aa8d-d01f7e4a0476", "version": "KqlParameterItem/1.0", "name": "NotesEL2_1", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_2", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "43f65638-9012-4be1-a395-28d6b9252438" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_3", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "715cef7a-fb3d-4256-9cad-f3acb3e3edd1" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_4", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "9a62229c-3ca0-4cf5-9cde-18a20ef26167" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_5", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "bd2a40ee-5c23-4398-af79-8ce51618dc4f" }, { "version": "KqlParameterItem/1.0", "name": "NotesEL2_6", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL2_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "094d6b14-9987-49fe-933d-1a1e02264094" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy - Copy" } ], "exportParameters": true }, "name": "group - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "EL3", "loadType": "always", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "977877b8-ef9a-4c69-8e18-0fea43d54778" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "ae69a727-1923-41eb-97d0-043b328003a6" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "b8b58663-aca9-4425-a859-504ac48f2e22" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "5ce394d9-d8ed-48c6-83e7-6de06cc26baa" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "35735e46-0dd4-46df-bfed-6f1ae82ea338" }, { "version": "KqlParameterItem/1.0", "name": "ImplementationStatusEL3_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationStatusEL3_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "7b850b69-4fd5-4308-b233-104ff87cee8f" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3cf48b00-7b35-46bd-b522-5286b7c0a94d", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_1", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "4b86de6d-3713-4d67-91bd-6c64e9dd239a", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_2", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "626b7fc0-5e5e-4f4c-b29c-490da7379030", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_3", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "229d6fec-11df-486b-9236-b4aa397530bd", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_4", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "4fafab7f-d050-4500-8a8e-103b6844d478", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_5", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "e1f80f22-7d41-491e-8a1d-c900544f48e7", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_6", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "88356b82-d1a2-4b8c-ba0f-643e2ad512ea", "version": "KqlParameterItem/1.0", "name": "ImplementationDateEL3_7", "type": 1, "query": "let VARIABLE = dynamic('{ImplementationDateEL3_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "2fd04610-cc1a-418f-a2d4-f45bdc4e78ab", "version": "KqlParameterItem/1.0", "name": "NotesEL3_1", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_1}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "7e37dae6-f738-423e-85ca-3e4a5318ef06", "version": "KqlParameterItem/1.0", "name": "NotesEL3_2", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_2}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "923c7f62-721f-4fdb-8bbd-ed241290f8cc", "version": "KqlParameterItem/1.0", "name": "NotesEL3_3", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_3}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "49e782d0-ce5f-4afb-9b94-d9292c457595", "version": "KqlParameterItem/1.0", "name": "NotesEL3_4", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_4}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b7d6f8ed-b7af-4059-8484-2d58903aea1f", "version": "KqlParameterItem/1.0", "name": "NotesEL3_5", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_5}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "ecb12bf7-7aaf-4c74-8f7b-ed6d29cd7c53", "version": "KqlParameterItem/1.0", "name": "NotesEL3_6", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_6}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "be16d435-a9aa-4992-8eb7-e5454cc243f2", "version": "KqlParameterItem/1.0", "name": "NotesEL3_7", "type": 1, "query": "let VARIABLE = dynamic('{NotesEL3_7}');\r\nprint VARIABLE", "timeContext": { "durationMs": 300000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status - Copy - Copy" } ], "exportParameters": true }, "name": "group - 3" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "1", "comparison": "isEqualTo", "value": "1" }, "name": "group - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Assessment Tracker](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\r\n---\r\n\r\nThis section captures the status of data connectors and the summary of the assessment tracker. Each control card includes logging category, requirements, criticality, log, status, implementation status, implementation date, and notes. As these control cards are completed, this section populates a csv for export and reporting. This assessment is dynamicly generated based on the state of your data connectors, data tables, and implementation notes. Connectors can be enabled from the Data Connectors section. Implementation Status/Date/Notes can be editing/saved in the Control Cards. " }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Data Connector Status", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "18ed59f0-c497-44b1-94b7-8700051cf189", "version": "KqlParameterItem/1.0", "name": "AWS", "label": "AWSCloudTrail", "type": 1, "query": "AWSCloudTrail\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "909d0019-23cb-43ad-8285-9f1dca1cd1be", "version": "KqlParameterItem/1.0", "name": "AzureActivity", "type": 1, "query": "AzureActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "64b61ce5-166b-4765-bed4-1a94e1e60b7e", "version": "KqlParameterItem/1.0", "name": "AzureDiagnostics", "type": 1, "query": "AzureDiagnostics\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureFirewall", "type": 1, "query": "AzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "IDS", "label": "AzureIDS", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallIDSLog\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureKeyVault", "type": 1, "query": "AzureDiagnostics | where ResourceProvider == \"MICROSOFT.KEYVAULT\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AKS", "label": "AzureKubernetes", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"kube-audit\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "SQL", "label": "AzureSQL", "type": 1, "query": "AzureDiagnostics | where Category contains \"SQL\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureWAF", "type": 1, "query": "AzureDiagnostics | where ResourceType in (\"APPLICATIONGATEWAYS\", \"FRONTDOORS\", \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"PROFILES\")\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AuditLogs", "type": 1, "query": "AuditLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "AuditLogs" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "a7584672-b235-4d9f-8fac-61f104e24ef5", "version": "KqlParameterItem/1.0", "name": "BehaviorAnalytics", "type": 1, "query": "BehaviorAnalytics\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4fcf795c-75b8-4010-bd24-1d66511ff6e8", "version": "KqlParameterItem/1.0", "name": "CommonSecurityLog", "type": 1, "query": "CommonSecurityLog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "db271fa5-a74a-4bbe-a644-37b4ee3dfcef", "version": "KqlParameterItem/1.0", "name": "DeviceNetworkEvents", "type": 1, "query": "DeviceNetworkEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "626b2557-9f68-46c3-bd56-cf86eeb93fb9", "version": "KqlParameterItem/1.0", "name": "DeviceProcessEvents", "type": 1, "query": "DeviceProcessEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "DNS", "label": "DNSEvents", "type": 1, "query": "DnsEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2603a8b5-ac15-4ceb-b785-1cbb4803ffd6", "version": "KqlParameterItem/1.0", "name": "EmailEvents", "type": 1, "query": "EmailEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "1924bd39-f249-420c-96a6-2d5381953750", "version": "KqlParameterItem/1.0", "name": "GatewayDiagnosticLog", "type": 1, "query": "AzureDiagnostics\r\n |where Category == 'GatewayDiagnosticLog'\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "GCP", "type": 1, "query": "GCP_IAM_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "InformationProtectionLogs_CL", "type": 1, "query": "InformationProtectionLogs_CL​​\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2a387de5-a882-451c-bf4e-677143f294b1", "version": "KqlParameterItem/1.0", "name": "InsightsMetrics", "type": 1, "query": "InsightsMetrics\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 20" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2f71cd92-4b68-467e-b3ef-2136128f3ba6", "version": "KqlParameterItem/1.0", "name": "IntuneAuditLogs", "type": 1, "query": "IntuneAuditLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 20 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "ac58f8e1-9ece-47f1-ab39-5cad6447654d", "version": "KqlParameterItem/1.0", "name": "KubeEvents_CL", "type": 1, "query": "KubeEvents_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MDE", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "MicrosoftDefenderForEndpoint" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "68bd12c8-e473-45d1-8bbc-2dd9f326ea69", "version": "KqlParameterItem/1.0", "name": "OfficeActivity", "type": 1, "query": "OfficeActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2525c4f7-0808-4574-a658-fb14e6d54535", "version": "KqlParameterItem/1.0", "name": "SecurityAlert", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b2737fbc-c0e2-4584-9fba-ee7d057d7db0", "version": "KqlParameterItem/1.0", "name": "SecurityEvent", "type": 1, "query": "SecurityEvent\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "SecurityRecommendation", "type": 1, "query": "SecurityRecommendation\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "779c8068-b40c-47f1-a76c-316bee6e7f07", "version": "KqlParameterItem/1.0", "name": "SecurityRegulatoryCompliance", "type": 1, "query": "SecurityRegulatoryCompliance\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "23ba579d-c894-43be-9fe1-d1b04bc34d7a", "version": "KqlParameterItem/1.0", "name": "SignInLogs", "type": 1, "query": "SigninLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Active Directory" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "fa63a08f-dd08-4e11-bcb6-c075a6d6c15c", "version": "KqlParameterItem/1.0", "name": "Syslog", "type": 1, "query": "Syslog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "6d3aa895-c4b8-4827-9ecd-f52116ffc031", "version": "KqlParameterItem/1.0", "name": "Update", "type": 1, "query": "Update\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 24 - Copy - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "VMwareESXi", "type": 1, "query": "VMwareESXi\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "20", "name": "parameters - 3" } ], "exportParameters": true }, "name": "Connectors", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"{\\r\\n\\t\\\"columns\\\":[\\r\\n\\t\\t{\\\"name\\\":\\\"LoggingCategory\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Required Data\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Log\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Criticality\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Retention Period\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Connector Status\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Implementation Status\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Implemented Date\\\", \\\"type\\\":\\\"string\\\"},\\r\\n\\t\\t{\\\"name\\\":\\\"Notes\\\", \\\"type\\\":\\\"string\\\"}],\\r\\n\\t\\\"rows\\\":[\\r\\n[\\\"Identity & Credential Management\\\",\\\"Identity & Credential Management\\\",\\\"SignInLogs\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SignInLogs}\\\",\\\"{ImplementationStatusEL0_1}\\\",\\\"{ImplementationDateEL0_1}\\\",\\\"{NotesEL0_1}\\\"]\\r\\n,[\\\"Privileged Identity & Credential Management\\\",\\\"Privileged Identity & Credential Management\\\",\\\"AuditLogs\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AuditLogs}\\\",\\\"{ImplementationStatusEL0_2}\\\",\\\"{ImplementationDateEL0_2}\\\",\\\"{NotesEL0_2}\\\"]\\r\\n,[\\\"Email Filtering, Spam, & Phishing\\\",\\\"IP & Domain Reputation\\\",\\\"EmailEvents\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{EmailEvents}\\\",\\\"{ImplementationStatusEL0_3}\\\",\\\"{ImplementationDateEL0_3}\\\",\\\"{NotesEL0_3}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"DHCP Lease Information\\\",\\\"DeviceNetworkEvents\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{DeviceNetworkEvents}\\\",\\\"{ImplementationStatusEL0_4}\\\",\\\"{ImplementationDateEL0_4}\\\",\\\"{NotesEL0_4}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"DNS\\\",\\\"DnsEvents\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{DNS}\\\",\\\"{ImplementationStatusEL0_5}\\\",\\\"{ImplementationDateEL0_5}\\\",\\\"{NotesEL0_5}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"Passive DNS\\\",\\\"DnsEvents\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{DNS}\\\",\\\"{ImplementationStatusEL0_6}\\\",\\\"{ImplementationDateEL0_6}\\\",\\\"{NotesEL0_6}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"DNS, DHCP, & Wi-Fi\\\",\\\"CommonSecurityLog\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{CommonSecurityLog}\\\",\\\"{ImplementationStatusEL0_7}\\\",\\\"{ImplementationDateEL0_7}\\\",\\\"{NotesEL0_7}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"IDS / IPS / NTA / NDR / SIEM\\\",\\\"AzureDiagnostics\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold, 72 Hours Packet Capture\\\",\\\"{IDS}\\\",\\\"{ImplementationStatusEL0_8}\\\",\\\"{ImplementationDateEL0_8}\\\",\\\"{NotesEL0_8}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"Routers & Switches\\\",\\\"AzureDiagnostics\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureDiagnostics}\\\",\\\"{ImplementationStatusEL0_9}\\\",\\\"{ImplementationDateEL0_9}\\\",\\\"{NotesEL0_9}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"Load Balancer / Reverse Proxy\\\",\\\"AzureDiagnostics\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureDiagnostics}\\\",\\\"{ImplementationStatusEL01_20}\\\",\\\"{ImplementationDateEL01_20}\\\",\\\"{NotesEL01_20}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"Proxies & Web Content Filters\\\",\\\"AzureDiagnostics\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureDiagnostics}\\\",\\\"{ImplementationStatusEL0_10}\\\",\\\"{ImplementationDateEL0_10}\\\",\\\"{NotesEL0_10}\\\"]\\r\\n,[\\\"Network Device Infrastructure\\\",\\\"Access, Authorization, & Accounting\\\",\\\"AzureActivity\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureActivity}\\\",\\\"{ImplementationStatusEL0_11}\\\",\\\"{ImplementationDateEL0_11}\\\",\\\"{NotesEL0_11}\\\"]\\r\\n,[\\\"Operating Systems\\\",\\\"Windows\\\",\\\"SecurityEvent\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SecurityEvent}\\\",\\\"{ImplementationStatusEL0_12}\\\",\\\"{ImplementationDateEL0_12}\\\",\\\"{NotesEL0_12}\\\"]\\r\\n,[\\\"Operating Systems\\\",\\\"MAC OS\\\",\\\"Syslog\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{Syslog}\\\",\\\"{ImplementationStatusEL0_13}\\\",\\\"{ImplementationDateEL0_13}\\\",\\\"{NotesEL0_13}\\\"]\\r\\n,[\\\"Operating Systems\\\",\\\"Linux\\\",\\\"Syslog\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{Syslog}\\\",\\\"{ImplementationStatusEL0_14}\\\",\\\"{ImplementationDateEL0_14}\\\",\\\"{NotesEL0_14}\\\"]\\r\\n,[\\\"Cloud Environments\\\",\\\"General Logging\\\",\\\"AzureActivity\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold, 72 Hours Packet Capture\\\",\\\"{AzureActivity}\\\",\\\"{ImplementationStatusEL0_15}\\\",\\\"{ImplementationDateEL0_15}\\\",\\\"{NotesEL0_15}\\\"]\\r\\n,[\\\"Cloud Environments\\\",\\\"AWS Cloud\\\",\\\"AWSCloudTrail\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AWS}\\\",\\\"{ImplementationStatusEL0_16}\\\",\\\"{ImplementationDateEL0_16}\\\",\\\"{NotesEL0_16}\\\"]\\r\\n,[\\\"Cloud Environments\\\",\\\"Azure\\\",\\\"AzureActivity\\\",\\\"EL0\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureActivity}\\\",\\\"{ImplementationStatusEL0_17}\\\",\\\"{ImplementationDateEL0_17}\\\",\\\"{NotesEL0_17}\\\"]\\r\\n,[\\\"Cloud Environments\\\",\\\"GCP\\\",\\\"GCP_IAM_CL\\\",\\\"EL0\\\",\\\"6 Months Hot, 18 Months Cold\\\",\\\"{GCP}\\\",\\\"{ImplementationStatusEL0_18}\\\",\\\"{ImplementationDateEL0_18}\\\",\\\"{NotesEL0_18}\\\"]\\r\\n,[\\\"System & Configuration Performance\\\",\\\"Configuration\\\",\\\"AzureActivity\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureActivity}\\\",\\\"{ImplementationStatusEL1_1}\\\",\\\"{ImplementationDateEL1_1}\\\",\\\"{NotesEL1_1}\\\"],\\r\\n\\t\\t\\t[\\\"System & Configuration Performance\\\",\\\"Endpoint Detection & Response\\\",\\\"SecurityEvent\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SecurityEvent}\\\",\\\"{ImplementationStatusEL1_2}\\\",\\\"{ImplementationDateEL1_2}\\\",\\\"{NotesEL1_2}\\\"],\\r\\n\\t\\t\\t[\\\"System & Configuration Performance\\\",\\\"Configuration Changes\\\",\\\"AuditLogs\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AuditLogs}\\\",\\\"{ImplementationStatusEL1_3}\\\",\\\"{ImplementationDateEL1_3}\\\",\\\"{NotesEL1_3}\\\"],\\r\\n\\t\\t\\t[\\\"Authentication & Authorization\\\",\\\"Administrative\\\",\\\"SignInLogs\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SignInLogs}\\\",\\\"{ImplementationStatusEL1_4}\\\",\\\"{ImplementationDateEL1_4}\\\",\\\"{NotesEL1_4}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"Authentication & Authorization\\\",\\\"Authorization\\\",\\\"DeviceProcessEvents\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{DeviceProcessEvents}\\\",\\\"{ImplementationStatusEL1_5}\\\",\\\"{ImplementationDateEL1_5}\\\",\\\"{NotesEL1_5}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Email Filtering, Spam, & Phishing\\\",\\\"Content Filtering Policy Updates\\\",\\\"OfficeActivity\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{OfficeActivity}\\\",\\\"{ImplementationStatusEL1_6}\\\",\\\"{ImplementationDateEL1_6}\\\",\\\"{NotesEL1_6}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"AV & Behavior Based Malware Protection\\\",\\\"AV & Behavior Based Malware Protection\\\",\\\"SecurityAlert\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{MDE}\\\",\\\"{ImplementationStatusEL1_7}\\\",\\\"{ImplementationDateEL1_7}\\\",\\\"{NotesEL1_7}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"AV & Behavior Based Malware Protection\\\",\\\"Indication of Host Connections to Specific URLs\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureFirewall}\\\",\\\"{ImplementationStatusEL1_8}\\\",\\\"{ImplementationDateEL1_8}\\\",\\\"{NotesEL1_8}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"Network Device Infrastructure\\\",\\\"All Devices\\\",\\\"DeviceProcessEvents\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{DeviceProcessEvents}\\\",\\\"{ImplementationStatusEL1_9}\\\",\\\"{ImplementationDateEL1_9}\\\",\\\"{NotesEL1_9}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Network Device Infrastructure\\\",\\\"Firewalls\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureFirewall}\\\",\\\"{ImplementationStatusEL1_10}\\\",\\\"{ImplementationDateEL1_10}\\\",\\\"{NotesEL1_10}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"Network Device Infrastructure\\\",\\\"IDS/IPS Alerts & Events\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{IDS}\\\",\\\"{ImplementationStatusEL1_11}\\\",\\\"{ImplementationDateEL1_11}\\\",\\\"{NotesEL1_11}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Network Device Infrastructure\\\",\\\"VPN Gateway\\\",\\\"GatewayDiagnosticLog\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{GatewayDiagnosticLog}\\\",\\\"{ImplementationStatusEL1_12}\\\",\\\"{ImplementationDateEL1_12}\\\",\\\"{NotesEL1_12}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"PKI Infrastructure\\\",\\\"All Events\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureKeyVault}\\\",\\\"{ImplementationStatusEL1_13}\\\",\\\"{ImplementationDateEL1_13}\\\",\\\"{NotesEL1_13}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Vulnerability Assessments\\\",\\\"Vulnerability Assessments\\\",\\\"SecurityRecommendation\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SecurityRecommendation}\\\",\\\"{ImplementationStatusEL1_14}\\\",\\\"{ImplementationDateEL1_14}\\\",\\\"{NotesEL1_14}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Database Level\\\",\\\"Database Level\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SQL}\\\",\\\"{ImplementationStatusEL1_15}\\\",\\\"{ImplementationDateEL1_15}\\\",\\\"{NotesEL1_15}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Application Level\\\",\\\"Web Applications\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureWAF}\\\",\\\"{ImplementationStatusEL1_16}\\\",\\\"{ImplementationDateEL1_16}\\\",\\\"{NotesEL1_16}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Application Level\\\",\\\"Web Application Crashes\\\",\\\"InsightsMetrics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{InsightsMetrics}\\\",\\\"{ImplementationStatusEL1_16}\\\",\\\"{ImplementationDateEL1_16}\\\",\\\"{NotesEL1_16}\\\"],\\r\\n\\t\\t\\t[\\\"Application Level\\\",\\\"Web Applications & Middleware\\\",\\\"AzureDiagnostics\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureWAF}\\\",\\\"{ImplementationStatusEL1_17}\\\",\\\"{ImplementationDateEL1_17}\\\",\\\"{NotesEL1_17}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"Virtualization on System\\\",\\\"Virtualization on System\\\",\\\"VMwareESXi\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{VMwareESXi}\\\",\\\"{ImplementationStatusEL1_18}\\\",\\\"{ImplementationDateEL1_18}\\\",\\\"{NotesEL1_18}\\\"]\\r\\n,\\r\\n\\t\\t\\t[\\\"Mobile\\\",\\\"EMM (UEM)/MTD Alerts\\\",\\\"IntuneAuditLogs\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{IntuneAuditLogs}\\\",\\\"{ImplementationStatusEL1_20}\\\",\\\"{ImplementationDateEL1_20}\\\",\\\"{NotesEL1_20}\\\"]\\t\\r\\n,\\r\\n\\t\\t\\t[\\\"Container Supply Chain\\\",\\\"Container Supply Chain\\\",\\\"ContainerInventory\\\",\\\"EL1\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AKS}\\\",\\\"{ImplementationStatusEL1_22}\\\",\\\"{ImplementationDateEL1_22}\\\",\\\"{NotesEL1_22}\\\"]\\r\\n,[\\\"System Configuration & Performance\\\",\\\"System Status\\\",\\\"InsightsMetrics\\\",\\\"EL2\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{InsightsMetrics}\\\",\\\"{ImplementationStatusEL2_1}\\\",\\\"{ImplementationDateEL2_1}\\\",\\\"{NotesEL2_1}\\\"]\\r\\n,[\\\"Email Filtering, Spam, & Phishing\\\",\\\"Raw & Metadata - Filtering Events\\\",\\\"EmailEvents\\\",\\\"EL2\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{EmailEvents}\\\",\\\"{ImplementationStatusEL2_2}\\\",\\\"{ImplementationDateEL2_2}\\\",\\\"{NotesEL2_2}\\\"]\\t\\r\\n,[\\\"Data Loss Prevention\\\",\\\"Data Loss Prevention\\\",\\\"InformationProtectionLogs_CL\\\",\\\"EL2\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{InformationProtectionLogs_CL}\\\",\\\"{ImplementationStatusEL2_3}\\\",\\\"{ImplementationDateEL2_3}\\\",\\\"{NotesEL2_3}\\\"]\\t\\r\\n,[\\\"Network Time\\\",\\\"Full Packet Capture\\\",\\\"FULL PCAP\\\",\\\"EL2\\\",\\\"72 Hours Packet Capture\\\",\\\"FULL PCAP\\\",\\\"{ImplementationStatusEL2_4}\\\",\\\"{ImplementationDateEL2_4}\\\",\\\"{NotesEL2_4}\\\"]\\t\\r\\n,[\\\"Application Level\\\",\\\"COTS, Non-COTS, & Custom Apps\\\",\\\"InsightsMetrics\\\",\\\"EL2\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{InsightsMetrics}\\\",\\\"{ImplementationStatusEL2_5}\\\",\\\"{ImplementationDateEL1_5}\\\",\\\"{NotesEL2_5}\\\"]\\t\\r\\n,[\\\"Conainers\\\",\\\"Image, Mgmt, Orchestration, OS\\\",\\\"KubeEvents\\\",\\\"EL2\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{KubeEvents_CL}\\\",\\\"{ImplementationStatusEL2_6}\\\",\\\"{ImplementationDateEL1_6}\\\",\\\"{NotesEL2_6}\\\"]\\t\\t\\t\\t\\r\\n,[\\\"System Configuration & Performance\\\",\\\"Software Update\\\",\\\"Update\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{Update}\\\",\\\"{ImplementationStatusEL3_1}\\\",\\\"{ImplementationDateEL3_1}\\\",\\\"{NotesEL3_1}\\\"]\\r\\n,[\\\"Email Filtering, Spam, & Phishing\\\",\\\"Spam Dictionary Modifications\\\",\\\"OfficeActivity\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{OfficeActivity}\\\",\\\"{ImplementationStatusEL3_2}\\\",\\\"{ImplementationDateEL3_2}\\\",\\\"{NotesEL3_2}\\\"]\\r\\n,[\\\"Mainframes\\\",\\\"Mainframes\\\",\\\"MAINFRAME\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"MAINFRAME\\\",\\\"{ImplementationStatusEL3_3}\\\",\\\"{ImplementationDateEL3_3}\\\",\\\"{NotesEL3_3}\\\"]\\r\\n,[\\\"Container\\\",\\\"Cluster/Pod Events\\\",\\\"AzureDiagnostics\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AKS}\\\",\\\"{ImplementationStatusEL3_4}\\\",\\\"{ImplementationDateEL3_4}\\\",\\\"{NotesEL3_4}\\\"]\\r\\n,[\\\"Logging Orchestration, Automation & Response\\\",\\\"SOAR\\\",\\\"AzureActivity\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{AzureActivity}\\\",\\\"{ImplementationStatusEL3_5}\\\",\\\"{ImplementationDateEL3_5}\\\",\\\"{NotesEL3_5}\\\"]\\r\\n,[\\\"User Behavior Monitoring\\\",\\\"UEBA\\\",\\\"BehaviorAnalytics\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{BehaviorAnalytics}\\\",\\\"{ImplementationStatusEL3_6}\\\",\\\"{ImplementationDateEL3_6}\\\",\\\"{NotesEL3_6}\\\"]\\r\\n,[\\\"Applications\\\",\\\"Container Security, Operations, & Mgmt\\\",\\\"SecurityRegulatoryCompliance\\\",\\\"EL3\\\",\\\"12 Months Hot, 18 Months Cold\\\",\\\"{SecurityRegulatoryCompliance}\\\",\\\"{ImplementationStatusEL3_7}\\\",\\\"{ImplementationDateEL3_7}\\\",\\\"{NotesEL3_7}\\\"]\\r\\n\\t\\t\\t\\r\\n\\t]\\r\\n}\",\"transformers\":null}", "size": 0, "showRefreshButton": true, "showExportToExcel": true, "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "Log", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "Implementation Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Implemented", "representation": "4", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Implemented", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Out of Scope", "representation": "Discovery", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Alternate Implementation", "representation": "1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Planned", "representation": "uninitialized", "text": "{0}{1}" }, { "operator": "Default", "representation": "Question", "text": "{0}{1}" } ] } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "1", "comparison": "isEqualTo", "value": "2" }, "name": "query - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:subscriptionId}/resourceGroups/{Workspace:resourceGroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}", "size": 4, "title": "Retention settings for All Tables", "showRefreshButton": true, "queryType": 12, "visualization": "table", "gridSettings": { "rowLimit": 500, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TableInteractivePeriod", "sortOrder": 1 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "TablePlan", "formatter": 1 }, "leftContent": { "columnMatch": "TableInteractivePeriod", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "ShowHiddenObjects", "comparison": "isEqualTo", "value": "Yes" }, "name": "TableRetentionQuery" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\",\"mergeType\":\"leftouter\",\"leftTable\":\"query - 21\",\"rightTable\":\"TableRetentionQuery\",\"leftColumn\":\"Log\",\"rightColumn\":\"TableName\"}],\"projectRename\":[{\"originalName\":\"[query - 21].LoggingCategory\",\"mergedName\":\"LoggingCategory\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Required Data\",\"mergedName\":\"Required Data\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Criticality\",\"mergedName\":\"Criticality\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Log\",\"mergedName\":\"DataTable\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Connector Status\",\"mergedName\":\"Connector Status\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"Hot Path Settings\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"Cold Path Settings\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Retention Period\",\"mergedName\":\"Retention Requirements\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Implementation Status\",\"mergedName\":\"Implementation Status\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Implemented Date\",\"mergedName\":\"Implemented Date\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[query - 21].Notes\",\"mergedName\":\"Notes\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetentionPeriod\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"b2be0a3f-9830-48eb-b4d8-fad52114cab9\"}]}", "size": 0, "title": "Assessment Tracker", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "LoggingCategory", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Book", "text": "{0}{1}" } ] } }, { "columnMatch": "DataTable", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Backlog", "text": "{0}{1}" } ] } }, { "columnMatch": "Hot Path Settings", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "is Empty", "representation": "Blank", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "365", "representation": "4", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "365", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Cold Path Settings", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "is Empty", "representation": "Blank", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "540", "representation": "success", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "540", "representation": "4", "text": "{0}{1}" }, { "operator": "Default", "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "TableName", "formatter": 5 }, { "columnMatch": "TableType", "formatter": 5 }, { "columnMatch": "TablePlan", "formatter": 5 }, { "columnMatch": "TotalRetentionPeriod", "formatter": 5 }, { "columnMatch": "lastPlanModifiedDate", "formatter": 5 } ], "filter": true, "sortBy": [ { "itemKey": "Criticality", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Criticality", "sortOrder": 1 } ] }, "showPin": false, "name": "query - 4" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isASVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Assessment" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [] }, "name": "group - 22" } ], "fromTemplateId": "sentinel-MaturityModelForEventLogManagement_M2131", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }