{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d1e2f3a4-b5c6-7d8e-9f0a-1b2c3d4e5f6a", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Summary", "subTarget": "summary", "style": "link" }, { "id": "a4b35478-499a-4fcc-8424-63abbb698bfa", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Incidents", "subTarget": "ai-analyst", "style": "link" }, { "id": "45805ae8-29d7-4774-a10a-8d60af407bbf", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Model Alerts", "subTarget": "overview", "style": "link" }, { "id": "0dc4ab10-226f-422f-a7bb-9e905f96fb6c", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "EMAIL", "subTarget": "email", "style": "link" }, { "id": "2eac3f00-5164-4a77-9781-118eb681b729", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Autonomous Response", "subTarget": "agn", "style": "link" }, { "id": "ff97b7e6-6bbf-401c-aaff-833d5309f00d", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "System Status Alerts", "subTarget": "status", "style": "link" }, { "id": "b3c1d8a2-5f4e-4a9b-8c7d-2e6f1a0b9d3c", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Attack Surface Management", "subTarget": "asm", "style": "link" } ] }, "name": "tabs" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "96e10804-35d4-4d5c-b2d8-1af544471721", "version": "KqlParameterItem/1.0", "name": "Timeframe", "type": 4, "description": "Set the global time range for all queries below", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Timescale " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let modelAlerts = DarktraceModelAlerts_CL\n| extend Source = \"Model Alerts\"\n| project TimeGenerated, Source;\nlet incidents = DarktraceIncidents_CL\n| extend Source = \"Incidents\"\n| project TimeGenerated, Source;\nlet email = DarktraceEMAIL_CL\n| extend Source = \"Email\"\n| project TimeGenerated, Source;\nlet responseActions = DarktraceResponseActions_CL\n| extend Source = \"Response Actions\"\n| project TimeGenerated, Source;\nlet systemStatus = DarktraceSystemStatusAlerts_CL\n| extend Source = \"System Status\"\n| project TimeGenerated, Source;\nlet asm = DarktraceASM_CL\n| extend Source = \"ASM\"\n| project TimeGenerated, Source;\nunion modelAlerts, incidents, email, responseActions, systemStatus, asm\n| summarize Count = count() by bin(TimeGenerated, {Timeframe:grain}), Source", "size": 0, "title": "All Darktrace Events Over Time", "color": "blue", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Model Alerts", "color": "blue" }, { "seriesName": "Incidents", "color": "purple" }, { "seriesName": "Email", "color": "orange" }, { "seriesName": "Autonomous Response", "color": "green" }, { "seriesName": "System Status", "color": "redBright" }, { "seriesName": "ASM", "color": "turquoise" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "all events stacked area chart" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries below _", "style": "info" }, "name": "text - summary timeframe" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let modelAlerts = DarktraceModelAlerts_CL | summarize Count=count() | extend Source = \"Model Alerts\";\nlet incidents = DarktraceIncidents_CL | summarize Count=count() | extend Source = \"Incidents\";\nlet email = DarktraceEMAIL_CL | summarize Count=count() | extend Source = \"Email\";\nlet responseActions = DarktraceResponseActions_CL | summarize Count=count() | extend Source = \"Response Actions\";\nlet systemStatus = DarktraceSystemStatusAlerts_CL | summarize Count=count() | extend Source = \"System Status\";\nlet asm = DarktraceASM_CL | summarize Count=count() | extend Source = \"ASM\";\nunion modelAlerts, incidents, email, responseActions, systemStatus, asm\n| project Source, Count\n| sort by Count desc", "size": 3, "title": "Total Events by Source", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Source", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "total events by source tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let modelAlerts = DarktraceModelAlerts_CL | extend Source = \"Model Alerts\" | project TimeGenerated, Source;\nlet incidents = DarktraceIncidents_CL | extend Source = \"Incidents\" | project TimeGenerated, Source;\nlet email = DarktraceEMAIL_CL | extend Source = \"Email\" | project TimeGenerated, Source;\nlet responseActions = DarktraceResponseActions_CL | extend Source = \"Response Actions\" | project TimeGenerated, Source;\nlet systemStatus = DarktraceSystemStatusAlerts_CL | extend Source = \"System Status\" | project TimeGenerated, Source;\nlet asm = DarktraceASM_CL | extend Source = \"ASM\" | project TimeGenerated, Source;\nunion modelAlerts, incidents, email, responseActions, systemStatus, asm\n| where isnotempty(Source)\n| summarize Count=count() by Source", "size": 3, "title": "Event Distribution by Source", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "45", "name": "event distribution pie chart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let modelAlerts = DarktraceModelAlerts_CL | extend Source = \"Model Alerts\" | project TimeGenerated, Source;\nlet incidents = DarktraceIncidents_CL | extend Source = \"Incidents\" | project TimeGenerated, Source;\nlet email = DarktraceEMAIL_CL | extend Source = \"Email\" | project TimeGenerated, Source;\nlet responseActions = DarktraceResponseActions_CL | extend Source = \"Response Actions\" | project TimeGenerated, Source;\nlet systemStatus = DarktraceSystemStatusAlerts_CL | extend Source = \"System Status\" | project TimeGenerated, Source;\nlet asm = DarktraceASM_CL | extend Source = \"ASM\" | project TimeGenerated, Source;\nunion modelAlerts, incidents, email, responseActions, systemStatus, asm\n| summarize Count=count() by Source\n| sort by Count desc", "size": 0, "title": "Event Counts by Source", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "55", "name": "event counts table" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "summary" }, "name": "summary group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "610136a1-b7cf-4eb3-9ef6-51a2d22e1621", "version": "KqlParameterItem/1.0", "name": "_severity", "type": 1, "description": "parameter to drill down on clicked severity tile", "value": "", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "label": "severity" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string, status_count: long) [0, \"Compliance\", 1, 0, \"Informational\", 2, 0, \"Suspicious\", 3, 0, \"Critical\", 4]\r\n| union\r\n (\r\n DarktraceModelAlerts_CL\r\n | extend status = case( \r\n compliance == false and category == \"Critical\", \"Critical\",\r\n compliance == true, \"Compliance\",\r\n compliance == false and category == \"Suspicious\", \"Suspicious\",\r\n compliance == false and category == \"Informational\", \"Informational\", \r\n \"True\"\r\n )\r\n | where status != \"True\"\r\n | extend status_count = case(status == \"Critical\", 4, status == \"Suspicious\", 3, status == \"Informational\", 2, 1)\r\n | summarize Count = count() by status, status_count\r\n )\r\n| summarize Count=sum(Count) by status, status_count\r\n| sort by status_count asc", "size": 3, "title": "Model Alerts by Category", "timeContextFromParameter": "Timeframe", "exportFieldName": "status", "exportParameterName": "_severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Compliance", "representation": "turquoise", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "model breaches by severity" }, { "type": 1, "content": { "json": "_Click on the tiles to view more details (maximum 100 entries displayed)_", "style": "info" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where compliance == true\r\n| limit 100\r\n| project TimeGenerated, score, modelName, description, deviceLabel, deviceCredentials, sourceIp, destIp, threatId, alertUrl \r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Compliance Model Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Compliance" }, "name": "Low severity model breaches" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where compliance == false and category == \"Informational\"\r\n| limit 100\r\n| project TimeGenerated, score, modelName, description, deviceLabel, deviceCredentials, sourceIp, destIp, threatId, alertUrl \r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Informational Model Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Informational" }, "name": "Medium severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where compliance == false and category == \"Suspicious\"\r\n| limit 100\r\n| project TimeGenerated, score, modelName, description, deviceLabel, deviceCredentials, sourceIp, destIp, threatId, alertUrl \r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Suspicious Model Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Suspicious" }, "name": "High severity model breaches " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where compliance == false and category == \"Critical\"\r\n| limit 100\r\n| project TimeGenerated, score, modelName, description, deviceLabel, deviceCredentials, sourceIp, destIp, threatId, alertUrl \r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Critical Model Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "red", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Critical" }, "name": "Critical severity model breaches" } ] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isNotEqualTo", "value": "hidden" }, "name": "Drill down group for different severities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 0, "title": "Visualizing Threat Patterns: Model Alerts", "color": "orange", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "Model Alerts" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "breaches in group" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries below _", "style": "info" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| summarize event_count=count() by modelName\r\n| top 10 by event_count", "size": 0, "title": "Top 10 Most Alerted Models", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60ch" } }, { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } } ], "labelSettings": [ { "columnId": "event_count", "label": "Count" } ] } }, "customWidth": "55", "name": "most breached models" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nDarktraceModelAlerts_CL\r\n| where isnotempty(destHost) \r\n| summarize count(modelName) by destHost", "size": 3, "title": "Top External Hostnames", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "45", "name": "top external hostnames" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| project TimeGenerated, score, modelName, description, deviceLabel, deviceCredentials, sourceIp, destIp, threatId, alertUrl \r\n| top 10 by score desc ", "size": 0, "title": "Top 10 Model Alerts with Highest Score", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "Severity", "formatter": 8, "formatOptions": { "min": 1, "max": 10, "palette": "yellowOrangeRed" } }, { "columnMatch": "DarktraceURL", "formatter": 5 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] }, "sortBy": [] }, "name": "Top 10 hitting devices" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\n| where isnotempty(destIp) \n| where destIp !startswith \"10\" and destIp !startswith \"192\" and destIp !startswith \"172\"\n| summarize event_count=count() by destIp\n| top 10 by event_count", "size": 0, "title": "Top 10 External IPs", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "80", "name": "top 10 external IPs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where compliance == true\r\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})\r\n", "size": 0, "title": "Compliance Model Alerts Over Time", "color": "orange", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "Model Alerts" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "compliance breaches over time" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "overview" }, "name": "overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceResponseActions_CL\n| limit 100\n| project TimeGenerated, codeId, deviceHostname, deviceIp, deviceLabel, deviceType, model, reason, score, state, url\n| sort by TimeGenerated desc", "size": 0, "title": "Autonomous Response", "timeContextFromParameter": "Timeframe", "exportFieldName": "codeId", "exportParameterName": "SelectedResponseCodeId", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 5" }, { "type": 1, "content": { "json": "_ Selecting an Autonomous Response in the table above will group all related Autonomous Response Actions with the same Code ID below _", "style": "info" }, "name": "text - response actions info" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceResponseActions_CL\n| where codeId == {SelectedResponseCodeId}\n| project TimeGenerated, codeId, deviceHostname, deviceIp, deviceLabel, deviceType, model, reason, score, state, url\n| sort by TimeGenerated desc", "size": 0, "title": "Related Autonomous Response Actions (Code ID: {SelectedResponseCodeId})", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "SelectedResponseCodeId", "comparison": "isNotEqualTo", "value": "" }, "name": "related response actions by codeid" }, { "type": 1, "content": { "json": "Below are RESPOND (Antigena) Model Alerts", "style": "info" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\r\n| where modelName contains (\"Antigena\") and modelName contains (\"Network\")\r\n| limit 100\r\n| project TimeGenerated, score, modelName, threatId, deviceLabel, sourceHost, sourceIp, destHost, destIp, alertUrl, mitreTechniques\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "NETWORK", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "agnActivity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url" } }, "subtitleContent": { "columnMatch": "TimeGenerated", "formatter": 6 }, "leftContent": { "columnMatch": "Device" }, "secondaryContent": { "columnMatch": "msgInfo", "formatter": 1 }, "showBorder": true, "sortCriteriaField": "TimeGenerated", "sortOrderField": 2, "size": "full" } }, "name": "top level query " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\n| where modelName contains (\"Antigena\") and modelName contains (\"SaaS\")\n| limit 100\n| project TimeGenerated, score, modelName, threatId, deviceLabel, sourceHost, sourceIp, destHost, destIp, alertUrl, mitreTechniques\n| sort by TimeGenerated desc\n", "size": 0, "title": "IDENTITY", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\n| where modelName contains (\"Antigena\") and modelName contains (\"MDR\")\n| limit 100\n| project TimeGenerated, score, modelName, threatId, deviceLabel, sourceHost, sourceIp, destHost, destIp, alertUrl, mitreTechniques\n| sort by TimeGenerated desc\n", "size": 0, "title": "MDR", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceModelAlerts_CL\n| where modelName contains (\"Antigena\") and modelName contains (\"CLOUD\")\n| limit 100\n| project TimeGenerated, score, modelName, threatId, deviceLabel, sourceHost, sourceIp, destHost, destIp, alertUrl, mitreTechniques\n| sort by TimeGenerated desc", "size": 0, "title": "CLOUD", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "agn" }, "name": "agn group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cd64e441-332e-4f47-8602-a25828ebc053", "version": "KqlParameterItem/1.0", "name": "aia_type", "label": "Darktrace Incident Types", "type": 2, "description": "Filter out the types of AI Analyst Incidents available.", "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\n {\"value\": \"DarktraceIncidents_CL | project TimeGenerated, aiaScore, bestAssetName, currentGroup, groupPreviousGroups, incidentEventTitle\", \"label\": \"All\"},\n {\"value\": \"DarktraceIncidents_CL | where deviceHostname !contains 'SaaS' | project TimeGenerated, aiaScore, bestAssetName, currentGroup, groupPreviousGroups, incidentEventTitle\", \"label\": \"/ NETWORK\"},\n {\"value\": \"DarktraceIncidents_CL | where deviceHostname contains 'SaaS' | project TimeGenerated, aiaScore, bestAssetName, currentGroup, groupPreviousGroups, incidentEventTitle\", \"label\": \"/ IDENTITY\"}\n]", "timeContext": { "durationMs": 86400000 }, "value": "DarktraceIncidents_CL | project TimeGenerated, aiaScore, bestAssetName, currentGroup, groupPreviousGroups, incidentEventTitle" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceIncidents_CL\r\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 0, "title": "Visualizing Threat Patterns: Darktrace Incident Events", "color": "lightBlue", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "Incident Events" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "incidents in group" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for queries below _", "style": "info" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceIncidents_CL\r\n| summarize event_count=count() by incidentEventTitle\r\n| top 10 by event_count", "size": 0, "title": "Most Frequent Darktrace Incident Events", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "blue" } } ], "labelSettings": [ { "columnId": "event_count", "label": "Count" } ] } }, "name": "Top 10 Most Frequent Incidents" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{aia_type}", "size": 0, "title": "All Darktrace Incident Events", "timeContextFromParameter": "Timeframe", "exportFieldName": "currentGroup", "exportParameterName": "SelectedAIAGroup", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "name": "query - 7" }, { "type": 1, "content": { "json": "_ Selecting a Darktrace Incident Event in the table above will group all the related Darktrace Incident Events below within the set timeframe _", "style": "info" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let selectedGroup = \"{SelectedAIAGroup}\";\nlet clickedIncidentGroups =\n DarktraceIncidents_CL\n | where currentGroup == selectedGroup\n | extend allGroups = array_concat(groupPreviousGroups, pack_array(currentGroup))\n | mv-expand group = allGroups\n | project groupStr = tostring(group)\n | summarize by groupStr;\nlet relatedGroups =\n DarktraceIncidents_CL\n | where groupPreviousGroups has selectedGroup or currentGroup == selectedGroup or currentGroup in (clickedIncidentGroups)\n | extend allGroups = array_concat(groupPreviousGroups, pack_array(currentGroup))\n | mv-expand group = allGroups\n | project groupStr = tostring(group)\n | summarize by groupStr;\nDarktraceIncidents_CL\n| where currentGroup in (relatedGroups)", "size": 0, "title": "Darktrace Incident", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "incidentEventTime", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "incidentEventTime", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "SelectedAIAGroup", "comparison": "isNotEqualTo", "value": "" }, "name": "query - 5" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "ai-analyst" }, "name": "ai- analyst group " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceEMAIL_CL\n| extend Actions = parse_json(actions)\n| extend Hold_Email=set_has_element(Actions, \"Hold\")\n| extend Junk_Email=set_has_element(Actions, \"Move to Junk\")\n| extend Lock_Link=set_has_element(Actions, \"Lock Link\")\n| extend Lock_All_Links=set_has_element(Actions, \"Lock All Links\")\n| extend Double_Lock_Link=set_has_element(Actions, \"Double Lock Link\")\n| extend Double_Lock_All_Links=set_has_element(Actions, \"Double Lock All Links\")\n| extend Strip_Attachment=set_has_element(Actions, \"Strip Attachment\")\n| extend Strip_All_Attachments=set_has_element(Actions, \"Strip All Attachments\")\n| extend Convert_Attachment=set_has_element(Actions, \"Convert Attachment\")\n| extend Convert_All_Attachments=set_has_element(Actions, \"Convert All Attachments\")\n| extend Unspoof=set_has_element(Actions, \"Unspoof\")\n| extend XAxis=set_has_element(Actions, \"Unspoof\")\n| summarize XAxis=countif(XAxis == true), Hold_Email=countif(Hold_Email == true), Junk_Email=countif(Junk_Email == true), Lock_Link=countif(Lock_Link == true), Lock_All_Links=countif(Lock_All_Links == true), Double_Lock_Link=countif(Double_Lock_Link == true), Double_Lock_All_Links=countif(Double_Lock_All_Links == true), Convert_Attachment=countif(Convert_Attachment == true), Convert_All_Attachments=countif(Convert_All_Attachments == true), Strip_Attachment=countif(Strip_Attachment == true), Strip_All_Attachments=countif(Strip_All_Attachments == true), Unspoof=countif(Unspoof == true)", "size": 0, "title": "Total Actions Taken", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "sortBy": [ { "itemKey": "Hold_Email", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Hold_Email", "sortOrder": 2 } ], "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Junk_Email", "label": "Junk Email", "color": "redBright" }, { "seriesName": "Lock_Link", "label": "Lock Link", "color": "lightBlue" }, { "seriesName": "Double_Lock_Link", "label": "Double Lock Link", "color": "green" }, { "seriesName": "Strip_Attachment", "label": "Strip Attachment", "color": "purple" }, { "seriesName": "Convert_Attachment", "label": "Convert Attachment", "color": "orange" }, { "seriesName": "Unspoof", "label": "Unspoof", "color": "pink" }, { "seriesName": "Hold_Email", "label": "Hold Email", "color": "redDark" }, { "seriesName": "Lock_All_Links", "label": "Lock All Links", "color": "blueDark" }, { "seriesName": "Double_Lock_All_Links", "label": "Double Lock All Links", "color": "greenDark" }, { "seriesName": "Convert_All_Attachments", "label": "Convert All Attachments", "color": "orangeDark" }, { "seriesName": "Strip_All_Attachments", "label": "Strip All Attachments", "color": "purpleDark" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Hold_Email", "sizeAggregation": "Sum", "legendMetric": "Hold_Email", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Hold_Email", "heatmapPalette": "greenRed" } } }, "name": "query - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ac642d55-be90-4144-8bc3-ce0cb7fcc161", "version": "KqlParameterItem/1.0", "name": "SearchRecipient", "label": "Search Recipient", "type": 1, "description": "Filter for held emails", "value": "", "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceEMAIL_CL\n| extend Actions = parse_json(actions)\n| extend Hold_Email=set_has_element(Actions, \"Hold\")\n| where Hold_Email == true \n| extend recipients=parse_json(recipients)\n| where \"{SearchRecipient}\" == \"\" or recipients contains \"{SearchRecipient}\"\n| project subject, from, recipients, anomalyScore, timestamp, direction, tags, attachmentNames, url, uuid", "size": 0, "title": "Held Emails", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceEMAIL_CL\n| where direction == \"inbound\"\n| project-rename Sender=from\n| summarize Count=count() by Sender\n| top 10 by Count", "size": 0, "title": "Top 10 Most Frequent External Senders ", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "orange" } }, { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } } ] } }, "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "email" }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4727607c-4f65-4373-b0e8-33b0e2accbac", "version": "KqlParameterItem/1.0", "name": "_severity", "label": "severity", "description": "parameter to drill down on clicked severity tile", "value": "hidden", "isHiddenWhenLocked": true, "type": 1, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string, status_count: long) [0, \"Low\", 1, 0, \"Medium\", 2, 0, \"High\", 3, 0, \"Critical\", 4]\n| union\n (\n DarktraceSystemStatusAlerts_CL\n | extend status = case( \n priority == \"low\", \"Low\",\n priority == \"medium\", \"Medium\",\n priority == \"high\", \"High\",\n priority == \"critical\", \"Critical\", \n \"True\"\n )\n | where status != \"True\"\n | extend status_count = case(status == \"Critical\", 4, status == \"High\", 3, status == \"Medium\", 2, 1)\n | summarize Count = count() by status, status_count\n )\n| summarize Count=sum(Count) by status, status_count\n| sort by status_count asc", "size": 3, "title": "System Status Alerts by Priority", "timeContextFromParameter": "Timeframe", "exportFieldName": "status", "exportParameterName": "_severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "query - 2" }, { "type": 1, "content": { "json": "_Click on the tiles to view more details (maximum 100 entries displayed)_", "style": "info" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceSystemStatusAlerts_CL\r\n| where priority == \"low\"\r\n| limit 100\r\n| project TimeGenerated, customLabel, darktraceHostname, deviceIp, friendlyModelName, message, modelName, priority, priorityCode, severity, status, statusName, url, uuid\r\n| sort by TimeGenerated desc\r\n", "size": 0, "title": "Low Priority System Status Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "yellow", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Low" }, "name": "Low" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceSystemStatusAlerts_CL\r\n| where priority == \"medium\"\r\n| limit 100\r\n| project TimeGenerated, customLabel, darktraceHostname, deviceIp, friendlyModelName, message, modelName, priority, priorityCode, severity, status, statusName, url, uuid\r\n| sort by TimeGenerated desc", "size": 0, "title": "Medium Priority System Status Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "OtherExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Medium" }, "name": "medium" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceSystemStatusAlerts_CL\r\n| where priority == \"high\"\r\n| limit 100\r\n| project TimeGenerated, customLabel, darktraceHostname, deviceIp, friendlyModelName, message, modelName, priority, priorityCode, severity, status, statusName, url, uuid\r\n| sort by TimeGenerated desc", "size": 0, "title": "High Priority System Status Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "LogSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "redBright", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "High" }, "name": "high" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceSystemStatusAlerts_CL\r\n| where priority == \"critical\"\r\n| limit 100\r\n| project TimeGenerated, customLabel, darktraceHostname, deviceIp, friendlyModelName, message, modelName, priority, priorityCode, severity, status, statusName, url, uuid\r\n| sort by TimeGenerated desc", "size": 0, "title": "Critical Priority System Status Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } }, { "columnMatch": "Activity", "formatter": 1, "formatOptions": { "linkColumn": "DarktraceURL", "linkTarget": "Url", "customColumnWidthSetting": "40%" } }, { "columnMatch": "DeviceName", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "DeviceAddress", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "17.5%" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "DarktraceURL", "formatter": 5 }, { "columnMatch": "LogSeverity", "formatter": 8, "formatOptions": { "min": 1, "max": 10, "palette": "greenRed" } }, { "columnMatch": "DarktraceUrl", "formatter": 5, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AdditionalExtensions", "formatter": 5, "formatOptions": { "customColumnWidthSetting": "70%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isEqualTo", "value": "Critical" }, "name": "critical" } ] }, "conditionalVisibility": { "parameterName": "_severity", "comparison": "isNotEqualTo", "value": "hidden" }, "name": "Drill down group for different severities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceSystemStatusAlerts_CL\n| project TimeGenerated, customLabel, darktraceHostname, deviceIp, friendlyModelName, message, modelName, priority, priorityCode, severity, status, statusName, url, uuid\n| sort by TimeGenerated desc", "size": 0, "title": "All System Status Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "status" }, "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "version": "KqlParameterItem/1.0", "name": "_asm_rating", "label": "rating", "description": "parameter to drill down on clicked rating tile", "value": "hidden", "isHiddenWhenLocked": true, "type": 1, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - asm" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, status: string, status_count: long) [0, \"A\", 1, 0, \"B\", 2, 0, \"C\", 3, 0, \"D\", 4, 0, \"E\", 5, 0, \"F\", 6]\n| union\n (\n DarktraceASM_CL\n | extend status = tostring(rating)\n | where status in (\"A\", \"B\", \"C\", \"D\", \"E\", \"F\")\n | extend status_count = case(status == \"F\", 6, status == \"E\", 5, status == \"D\", 4, status == \"C\", 3, status == \"B\", 2, 1)\n | summarize Count = count() by status, status_count\n )\n| summarize Count=sum(Count) by status, status_count\n| sort by status_count asc", "size": 3, "title": "ASM Alerts by Rating", "timeContextFromParameter": "Timeframe", "exportFieldName": "status", "exportParameterName": "_asm_rating", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "turquoise", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "E", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "auto" } }, "name": "asm alerts by rating" }, { "type": 1, "content": { "json": "_Click on the tiles to view more details (maximum 100 entries displayed)_", "style": "info" }, "name": "text - asm info" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"A\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating A - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "A" }, "name": "asm low" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"B\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating B - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "B" }, "name": "asm medium" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"C\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating C - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "C" }, "name": "asm high" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"D\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating D - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "D" }, "name": "asm critical" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"E\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating E - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "E" }, "name": "asm e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where rating == \"F\"\n| limit 100\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "Rating F - ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "20%" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Time" } ] } }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isEqualTo", "value": "F" }, "name": "asm f" } ] }, "conditionalVisibility": { "parameterName": "_asm_rating", "comparison": "isNotEqualTo", "value": "hidden" }, "name": "asm drill down group" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| make-series Count = count() default=0 on TimeGenerated in range({Timeframe:start}, now(), {Timeframe:grain})", "size": 0, "title": "Visualizing Attack Surface Management Alerts Over Time", "color": "orange", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Count", "label": "ASM Alerts" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 0 } } } } }, "name": "asm alerts over time" }, { "type": 1, "content": { "json": "_ Selecting a timeframe on the graph will change the timeframe for all queries below _", "style": "info" }, "name": "text - asm timeframe" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| summarize event_count=count() by alertTitle\n| top 10 by event_count", "size": 0, "title": "Top 10 Most Frequent Attack Surface Management Alert Types", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "event_count", "formatter": 3, "formatOptions": { "palette": "orange" } } ], "labelSettings": [ { "columnId": "event_count", "label": "Count" } ] } }, "customWidth": "55", "name": "top asm alert types" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| where isnotempty(assetName)\n| summarize count() by assetName", "size": 3, "title": "Attack Surface Management Alerts by Asset", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "45", "name": "asm alerts by asset" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DarktraceASM_CL\n| project TimeGenerated, alertTitle, alertType, assetName, assetUri, description, rating, state, riskUri, workbenchUri\n| sort by TimeGenerated desc", "size": 0, "title": "All ASM Alerts", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "all asm alerts" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "asm" }, "name": "asm group" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-DarktraceActiveAISecurityPlatform", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }